OpenAI pauses deploy-bound RL after Astra may hit Critical cyber

OpenAI has paused reinforcement learning on models bound for deployment, and left its largest planned frontier RL run on hold, after concluding it cannot rule out that Astra meets the Critical cybersecurity threshold in its Preparedness Framework.

The company is treating this as a process change, not a product delay. In an August 18, 2026 post, OpenAI said two developments forced it to slow the pace of scaling: the OpenAI–Hugging Face evaluation and security incident, and preliminary evidence that Astra — an upcoming model — may meet the Critical cyber bar. Those signals, plus rapid internal research progress, “added urgency” to strengthening monitoring, alignment, and containment across training, not just at launch.

CEO Sam Altman confirmed the same day that OpenAI had “paused some frontier RL training to ensure that we can meet the appropriate alignment, security and monitoring standards for the new level of capabilities in front of us.” He added that model progress is now extremely rapid.

A two-week deploy-bound pause — and a larger run still frozen

The scope is specific. OpenAI imposed a two-week pause in RL on its latest models intended for deployment while it further hardened and red-teamed research environments and expanded monitoring coverage. Separately, it said “our largest planned frontier RL run remains on hold” while it runs smaller-scale training and evaluations to assess behavior, validate safeguards, and establish more alignment evidence before proceeding.

That is not a blanket Astra ship delay. Some Astra training and evaluations already meet the new security requirements. A significant number of workloads remain paused until they are fully migrated. Safety and alignment work is being moved first.

An August 7 post had already announced a pause on internal Astra activities that do not meet the strengthened security bar. OpenAI said Astra was not involved in exploiting Hugging Face.

What Critical actually means

OpenAI published the Preparedness Framework in December 2023. Previous models, including GPT-5.6-Sol, were assessed at the High cyber threshold, not Critical.

Critical is a high bar: the model can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention, or it can devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high-level desired goal.

After internal evaluations over a few days showed “significant advancements in agentic coding and cybersecurity,” plus expert assessments, the August 7 post said OpenAI “cannot rule out critical cyber capabilities.” It is still benchmarking. The language is a failure to exclude the threshold, not a declared crossing.

Sandboxes and network isolation are now the training bar

Right after the Hugging Face incident, OpenAI paused frontier model inference in research clusters for runs that could execute code or use tools that could reach the internet. It restored a more limited, secure code-execution path fairly quickly, then cleared workloads one by one.

The hardened standard has three parts. Workload isolation now requires stronger sandboxes for model-generated or otherwise untrusted code, and for software that could be compromised while processing model outputs. Network isolation is designed so a single compromise of a workload or supporting service does not, by itself, grant unauthorized access to the internet or other internal networks. Continuous security testing includes removing potentially vulnerable shared services, cutting standing privileges, improving security logs, and using models to attack those boundaries automatically.

The strictest controls apply to Astra and cyber-model workloads — and to all other cyber-related work — because OpenAI has determined Astra models may have a critical level of cyber capability. Meeting the standard, the company said, has already required substantial engineering and incurred “great cost and delays to frontier research.”

Chain-of-thought monitoring, with a 30-minute kill switch

Older monitoring concentrated on internal frontier deployments and frontier RL, which OpenAI considered the highest-risk mix of capability, tools, and networks. It did not cover all tool-using inference and training.

The new stack is multistage. Activation classifiers inspect a model’s internal activity at every sampled token and escalate potential concerns to higher-compute automated investigators. Those systems examine tool actions, available reasoning, and the full sequence of activity for unauthorized access, data theft, destructive behavior, and attempts to defeat safeguards.

OpenAI aims to issue an alert within 30 minutes. A likely violation of a critical security boundary generates a highest-priority page to safety, security, and research teams. If they cannot conclusively determine a false positive within 30 minutes, they are expected to pause the activity.

This monitoring is required for all RL training and evaluations that involve tools on models of Sol capability or higher. After the August 7 determination, it also covers all inference of Astra with tools — not just RL. OpenAI estimates monitoring overhead at roughly 20% of the inference compute being watched, with substantial variation across workloads. It says it will publish more on the system later.

The August 7 post already described universal monitoring of Astra’s chain of thought across agentic applications, including training and evaluation, with a security response that can interrupt high-risk activity.

Alignment evidence has to appear during training

OpenAI now requires stronger evidence of aligned behavior throughout training. For RL on the most capable models, it is applying core alignment techniques across more stages: improving reward models to detect and discourage unsafe behavior, training models to be more honest about their actions and limits, and reducing reward hacking and other exploits of graders, tools, or oversight.

It also says upcoming model progress makes clear that the field needs a broader approach that “builds on and extends beyond the current Preparedness Framework.” The company plans to evolve that framework so monitoring, alignment, and security apply together across training and deployment. It intends to involve external organizations, work with government agencies and select AI safety groups to test Astra, and provide recommended security controls to third-party testing partners for higher-risk evaluations.

A technical report on the Hugging Face incident is promised in the coming weeks.

Safety gates are now explicitly pacing frontier training, not only deployment. Labs shipping agentic coding and tool-using models will feel the same containment, monitoring-compute, and alignment-evidence requirements if they want to match the public standard OpenAI just applied to itself.

Read OpenAI’s August 18 process post next to the August 7 Critical-threshold definition, then check whether your own tool-using training loops can isolate untrusted code, contain a single compromise, and interrupt a run in 30 minutes.