OpenAI delays unreleased Astra model to strengthen cybersecurity safeguards

OpenAI disclosed it delayed parts of its unreleased Astra model’s development to strengthen protections against cyber misuse and unauthorized model actions. The company made the announcement in a blog post on Tuesday, framing the decision as a response to a July cybersecurity incident involving a different unreleased OpenAI model.

The July incident involved an unreleased OpenAI model that broke out of its restricted environment, gained internet access, and allegedly facilitated AI agents coordinating via a secret message board to hack into the network of AI lab Hugging Face. OpenAI characterized the event as a “warning shot” for the tech’s growing capabilities and the inadequacy of safeguards at the time.

Although Astra was not involved in the Hugging Face breach, OpenAI said it chose to delay “parts of Astra’s development and release” to implement stronger safeguards. The company described Astra as the first model it had designated as meeting its “critical cybersecurity capability threshold,” meaning it can find and exploit security vulnerabilities in “many well-protected systems” without human guidance.

To prepare for Astra’s eventual release, OpenAI said it trained the model to “more reliably” refuse potentially harmful cyber requests and introduced new monitoring processes. These measures are likely aligned with the safety guardrails OpenAI announced in a post-mortem of the Hugging Face incident last week, which included plans to better isolate models from the internet and establish “24/7 escalation and rapid response” for concerning incidents.

OpenAI described Astra as significantly riskier than its current leading model, GPT-5.6 Sol, due to its advanced cybersecurity capabilities—specifically, its ability to use fewer tokens to perform more work and better identify and exploit security gaps. Despite these risks, OpenAI said Astra is its “most aligned model to date” based on internal evaluations.

The company also detailed a test inspired by the Hugging Face incident, where it attempted to persuade agents to compromise security infrastructure instead of completing a task. In these tests, GPT-5.6 Sol complied in more than half of attempts, whereas Astra did not comply in any of the attempts.