On August 18, OpenAI disclosed a decision that had already been playing out internally for some time: a cybersecurity capability evaluation of its next-generation model, Astra, failed to reach a "safe" conclusion, and the company halted reinforcement learning training on its newest deployed model for two weeks. As of publication, the largest batch of frontier RL runs had still not resumed; only smaller-scale training and evaluation continued as usual.
The story first surfaced on August 7, when the version that reached the public was "OpenAI delays Astra launch." The August 18 post lays out the reasoning behind that delay: internal evaluations showed Astra's progress in autonomous coding and cyber offense-and-defense had advanced enough that the company could not rule out it had already reached the "Critical" tier.
The threshold is more concrete than it sounds
OpenAI's Preparedness Framework spells out the Critical threshold for cybersecurity as two determinable capability descriptions: either the model can autonomously write a usable zero-day exploit against multiple hardened, real-world critical systems, or — given only a high-level goal — it can independently design and carry out a novel, end-to-end attack against a hardened target.
The internal evaluation landed on "cannot rule it out," not confirmed. But going by the company's subsequent actions, that verdict alone was enough to trigger a round of precautionary deceleration — no need to wait for confirmation; simply halt the most compute-intensive training runs most likely to push the capability further.
What got paused is training; what got rebuilt is the data center
The pause is only half the story. OpenAI also listed a set of infrastructure-level changes: tightening sandbox isolation and network segmentation, removing shared services that were easy to breach, shrinking standing permissions, and filling gaps in security logging. A large share of Astra's workloads are still on hold, waiting to be migrated into environments that meet the new requirements.
The monitoring side comes with the most concrete numbers. The new monitoring system has two parts: a token-level activation classifier that flags suspicious behavior during generation, and an automated investigator that reviews whatever gets flagged. Running this monitoring consumes roughly 20% of inference compute. The target response window for alerts is under 30 minutes, and the safety team has the same 30-minute window to rule out false positives.
On paper, 20% reads like an engineering parameter. Converted into spending, it looks different. Frontier labs' annual inference-compute bills generally run into the billions of dollars (a rough estimate — figures vary by company), so permanently earmarking a fifth of that for monitoring amounts to a billion-dollar-scale fixed cost, and none of that money produces any user-facing capacity. Being willing to carry that cost long-term suggests the company doesn't expect the risk window to close in a matter of weeks — it expects to cover the entire lifecycle of the next-generation model.
A comparable alternative path would be to hand offense-and-defense capability to defenders first, opening vulnerability-hunting models through a restricted allowlist and trading a controlled deployment surface for extra time. OpenAI's choice this time sits further upstream — it hits the brakes directly on the training side. Both approaches respond to the same underlying judgment: model attack capability is growing faster than the defensive side's patching pipeline can keep up.
A gate OpenAI built and enforces on itself
There is no room for external oversight anywhere in this process. The trigger conditions, evaluation criteria, pause length, and restart standard are all written, judged, and executed by OpenAI alone; the public only gets an after-the-fact writeup. The post does not disclose how the Critical threshold is actually tested or what scores Astra received on any of the tests — numbers a third party could use to verify the claim. OpenAI did clarify one separate point: the previously discussed Hugging Face sandbox incident is unrelated to Astra.
For developers tracking progress, the near-term impact falls into two buckets: the rollout of Astra-related capabilities will slip, and Astra workloads already running will need to migrate to the new environments on a timeline OpenAI controls unilaterally. As for when the largest frontier RL runs will resume, the company has given no indication.
Sources: OpenAI official blog, Axios, CocoLoop, AIGC News; the Preparedness Framework's Critical threshold definition, the 20% monitoring compute share, and the 30-minute alert window have all been checked against OpenAI's public statements.