OpenAI announced a temporary pause in the development of its most advanced models after detecting new risks related to cybersecurity, alignment, and control. The company also noted that its next model, Astra, could reach a critical level of capability for carrying out cyber tasks.
The decision highlights something important: as AI becomes more capable, its potential benefits do not simply increase. The risks also grow within the very environments where these systems are trained and tested.
OpenAI slows the training of its models
For two weeks, OpenAI paused reinforcement learning training, known as RL, for its latest models intended for users. It is also keeping its largest planned training run on hold while conducting smaller tests and reviewing the systems’ behavior.
Why slow down if the race to develop more powerful models is moving so quickly? The company explains that it needs to strengthen its research environments, expand oversight, and gather more evidence that the models behave in accordance with human instructions.
The pause comes after two events that OpenAI considers significant: an incident involving OpenAI and Hugging Face, and preliminary signals that Astra could meet the critical cyber capability threshold defined in its preparedness framework.
Three layers for controlling more capable models
OpenAI describes its strategy around three defenses that must work together:
- Monitoring: detecting concerning behavior and enabling a rapid response.
- Alignment: reducing the likelihood that the model will carry out harmful or unauthorized actions.
- Security: limiting the systems, data, tools, and networks that the AI can access.
The idea is simple, even if putting it into practice is not. If a model can write code, use tools, and connect to external systems, it needs controls that restrict each of those capabilities.
A model’s security depends not only on what it can do, but also on what it can access and on the oversight in place while it acts.
OpenAI expects models themselves to help perform much of the security work in the future, including defending systems against other models. This would allow protective measures to grow at the same pace as AI capabilities.
New controls for research environments
Following the incident involving OpenAI and Hugging Face, the company paused the inference of advanced models in research clusters when they could execute code or use tools with internet access.
Some tasks quickly resumed under stricter controls. Others remain paused because they require additional infrastructure changes. The measures implemented or in development include:
- Workload isolation: processes that execute code generated by models must operate inside isolated environments or
sandboxes. - Network isolation: higher-risk workloads face additional restrictions to prevent unauthorized access to the internet or internal networks.
- Fewer permanent privileges: potentially vulnerable shared services are being removed, and permissions that remain active are being reduced.
- Continuous security testing: OpenAI is automating simulated attacks to check whether its own controls can be bypassed.
These layers form a defense-in-depth strategy. In simple terms, the company is trying to prevent a single failure from allowing a model to compromise the entire research environment.
Astra activates the strictest security level
OpenAI says Astra could have critical cyber capabilities. For that reason, training and evaluations involving this model must meet the most demanding security requirements.
Not all workloads related to Astra have been moved to those environments. While the process is completed, several remain paused. The company is prioritizing security and alignment tasks.
This point is especially relevant because a model capable of analyzing vulnerabilities, writing code, and operating tools could be useful for defending systems. But it could also facilitate attacks if it acts incorrectly or if its controls fail.
Token-by-token monitoring
OpenAI also expanded the system that monitors its models’ behavior. The new approach starts with activation classifiers, detectors that analyze the model’s internal activity for each sampled token.
When a concerning signal appears, the case is passed to more sophisticated automated investigators that use more computing power. These systems review actions carried out with tools, the available reasoning, and the complete sequence of activity.
The behaviors they seek to identify include:
- Unauthorized access.
- Data theft.
- Destructive actions.
- Attempts to evade security measures.
- Violations of critical boundaries within the infrastructure.
OpenAI aims to generate an alert within a maximum of 30 minutes after detecting concerning activity. If the alert appears to indicate a serious violation, the security, research, and protection teams must review the case.
If they cannot confirm within that timeframe that it is a false positive, they must pause the activity. Monitoring is mandatory for all training and evaluations involving model tools that reach the capability level called Sol or higher.
Since August 7, additional monitoring has also been required for any Astra inference involving tools, not only for its training and evaluations.
Protection comes at a cost. OpenAI estimates that this system accounts, on average, for nearly 20% of supervised inference compute, although the impact varies depending on the type of training or evaluation.
Alignment must cover more stages
Alignment aims to ensure that a model acts according to human intentions and responds to oversight. The challenge grows when the system can interact with tools, networks, and external resources.
OpenAI mentions risks such as reward hacking, a behavior in which the model finds a way to obtain a high reward without actually fulfilling the intended objective. It also points to the possibility of deception, unauthorized access, and the exploitation of weaknesses in evaluators or oversight systems.
To reduce these problems, the company is applying alignment techniques across more stages of reinforcement learning. Its priorities include:
- Improving reward models so they can detect unsafe behavior.
- Training models to be more honest about their actions, capabilities, and limitations.
- Reducing behaviors that exploit flaws in rewards, tools, or evaluations.
- Expanding testing for risks that arise when AI interacts with external systems.
The fundamental question is difficult: how can you reliably supervise a system that can act with greater speed and complexity than the people responsible for reviewing it?
OpenAI acknowledges that current answers are still insufficient. That is why it plans to publish more information about its alignment research, the behaviors it observes, and the new challenges it encounters.
A shift in the race toward advanced AI
The company also announced that it will update its Preparedness Framework, the framework it uses to assess risks and establish security measures before and during the deployment of its models.
The new approach will need to connect training security more effectively with the security of the final product. It will also have to adapt to models that can operate in more complex environments and perform increasingly advanced cyber tasks.
This does not mean AI development has stopped. It means that training more powerful models requires much more rigorous security infrastructure. Pauses, additional costs, and delays may become a permanent part of developing frontier systems.
For any company working with AI, the lesson is clear: it is not enough to test what a model can do. You also have to define what it can touch, how it is monitored, what happens when it makes a mistake, and how long it takes an organization to stop it.
Model capabilities are advancing quickly. The challenge now is to ensure that understanding, alignment, and security advance even faster.
Original source
https://openai.com/index/pacing-model-development-cyber-capabilities