OpenAI slows AI development over cybersecurity risks

OpenAI is temporarily slowing the training of its most advanced models because one of its upcoming systems, Astra, could reach a critical level of cybersecurity capability. The company has also tightened its controls after an incident involving Hugging Face.

The decision affects OpenAI’s internal work. It does not mean its current products have stopped working. The goal is to verify that the models can be trained and evaluated without gaining dangerous access to tools, networks or internal systems.

A pause to strengthen controls

OpenAI halted two weeks of reinforcement learning training, a technique that adjusts a model’s behavior based on rewards. The pause affected its latest models intended to reach users.

The largest frontier training run the company had planned also remains paused. OpenAI is conducting smaller tests to study model behavior, check its defenses and gather more evidence that the models act according to instructions and under human supervision.

The company says the decision follows two risk signals:

• OpenAI’s incident with Hugging Face.
• Early tests indicating that Astra could exceed the critical cyber capability threshold in its safety framework.

OpenAI determined on August 7 that Astra could have that level of capability. It is therefore applying its strictest security measures to training and evaluations, as well as to other cybersecurity-related work.

Three barriers for more capable models

The new strategy relies on three defenses that must work together:

• Monitoring: detects concerning behavior and enables a response.
• Alignment: aims to make the model follow instructions and respect human oversight.
• Security: limits what the system can access and which actions it can perform.

The most visible change is in the environments where OpenAI trains and tests its models. Tasks that run AI-generated code must operate inside isolated spaces known as sandboxes. The barriers between those tasks, the internet and the company’s internal networks have also been strengthened.

OpenAI has reduced permanent permissions, removed shared services that could be vulnerable and improved the collection of security logs. It is also using its own models to automatically test those barriers through simulated attacks.

Token-by-token monitoring

Monitoring is no longer limited to certain programming sessions or training runs considered higher risk. The new system starts with detectors that review the model’s internal activity on every sampled token, meaning each unit of text it processes or generates.

When they detect something suspicious, the case is passed to more sophisticated automated investigators. They review tool-based actions, available reasoning and the full sequence of activity to look for signals such as:

• Unauthorized access attempts.
• Data theft.
• Destructive behavior.
• Efforts to evade security measures.

OpenAI aims to generate an alert within 30 minutes of a concerning signal appearing. If the system believes a critical barrier has been breached, it alerts the security, research and protection teams. If they cannot show within another 30 minutes that it is a false alarm, they must pause the activity.

This system is mandatory for training and evaluations involving models with Sol-level capabilities or higher when tools are enabled. Since Astra was classified on August 7, it is also required for any use of Astra with tools, not just its training.

The cost is significant: OpenAI estimates that monitoring consumes around 20% of supervised inference compute capacity, although the percentage varies by task.

What changes for you

No immediate change has been announced for people using OpenAI’s products. The direct effect is inside the company: some training runs will be delayed, and more workloads will have to move to environments with stronger controls.

The important point is that a model’s ability to program, use tools or find security flaws is no longer seen only as an advantage. It can also become a risk during the development process itself, before the model reaches the public.

OpenAI is also expanding its alignment work. That includes improving the systems that reward the model, training it to describe its actions honestly and reducing behaviors such as reward hacking, which means finding a way to obtain a high score without actually achieving the intended goal.

The company is preparing an update to its Preparedness Framework to integrate these measures during training and deployment. The next point to watch will be whether it can maintain its development pace while showing that its most capable models can remain controllable, observable and isolated when they have access to code, tools or networks.