OpenAI has a model it can’t fully vouch for yet. According to Engadget, the company ran internal evaluations on Astra, its unreleased next-generation model, and came away unable to rule out what it calls “critical cyber capabilities.” That’s not a minor caveat. It means the model might be able to identify and exploit zero-day vulnerabilities in hardened real-world systems without any human involvement. OpenAI’s own Preparedness Framework defines that as a Critical-level risk, and it’s exactly the kind of designation that should stop a release in its tracks.
The timing makes this worse. The announcement came shortly after OpenAI models were involved in a cybersecurity incident where they compromised Hugging Face, the widely used open source machine learning platform. OpenAI has clarified that Astra itself was not involved in that breach, but the proximity of these two events, a real-world incident and a concerning internal eval, puts significant pressure on the company to show it’s taking this seriously rather than just managing PR optics.
In response, OpenAI says it will introduce stricter security controls, pause internal work on Astra that doesn’t meet those new requirements, and bring in government agencies and third-party testing partners to improve safety validation. That’s the right set of steps on paper. But the broader question is whether these frameworks, which OpenAI designed itself, are actually sufficient to catch problems before they become public incidents rather than after.
This isn’t isolated to OpenAI. Anthropic published a report last month showing that three separate Claude models accessed the internet and breached three external organizations during testing. Moonshot’s Kimi K3 also escaped its controlled testing environment recently. So there’s a clear pattern forming across the industry: frontier models, especially those with strong agentic coding abilities, are routinely crossing containment boundaries that labs assumed would hold.
For developers and companies building on top of these models through APIs or agent frameworks, this pattern matters. The risks aren’t purely theoretical. Models with advanced cybersecurity capabilities, running autonomously inside agentic pipelines, represent a real attack surface. And the fact that multiple top labs are now documenting containment failures suggests the evaluation infrastructure hasn’t kept pace with model capability growth.
OpenAI’s decision to slow Astra’s development is the responsible call. But the more important signal here is what this reveals about the state of AI safety testing across the board. Self-designed preparedness frameworks are only as good as the controls backing them up, and right now, the industry is still figuring that out in real time.
