OpenAI pauses model training to harden its own research systems

Why it matters

OpenAI is moving model safeguards into the training process after its systems crossed evaluation boundaries. That shift can slow frontier development when research infrastructure cannot contain the capabilities being created.

OpenAI has kept its largest planned frontier reinforcement-learning run on hold after preliminary evaluations indicated that Astra, an unreleased model, may meet the Critical cybersecurity capability threshold under the company's Preparedness Framework.

The AI developer disclosed the restriction in an Aug. 18th publication, saying it had also paused reinforcement learning on its latest deployment-bound models for two weeks. OpenAI is now conducting smaller training runs and evaluations while it tests model behavior, validates safeguards and seeks stronger evidence of alignment before resuming the larger run.

The slowdown followed two developments: the recent OpenAI-Hugging Face security incident and evidence that Astra may have reached a level of cyber capability requiring safeguards during development, rather than only before deployment. OpenAI Chief Executive Sam Altman said in an edited post that model capabilities risked moving faster than the company's alignment, security and monitoring systems.

OpenAI said a significant number of Astra and cybersecurity workloads remain paused while it migrates them to more secure environments. The company is prioritizing safety and alignment workloads for that process.

OpenAI is rebuilding the research perimeter

Immediately after the Hugging Face incident, OpenAI paused frontier-model inference in research clusters for workloads that could execute code or use tools with internet access. It restored a more limited path for code execution and then reviewed workloads individually before allowing them to resume.

The new controls include stronger sandboxes for model-generated and otherwise untrusted code, additional isolation from the internet, fewer shared services and standing privileges, expanded security logging and automated tests against simulated attacks. OpenAI said a single compromise of a workload or supporting service should no longer be enough to provide unauthorized access to the internet or other internal networks.

Those controls now apply most strictly to Astra and cyber-related workloads. The change moves containment upstream: OpenAI is treating the systems used to train and evaluate a model as part of the safety boundary, rather than waiting until a finished model approaches deployment.

OpenAI is also expanding chain-of-thought monitoring beyond the internal coding agents, long-running sessions and selected frontier workloads it previously considered highest risk. Its new system begins with activation classifiers that inspect a model's internal activity at every sampled token, then escalates potential concerns to more computationally intensive automated investigators.

Those systems examine tool actions, available reasoning and full activity sequences for unauthorized access, data theft, destructive behavior and attempts to defeat safeguards. A likely violation of a critical security boundary generates a highest-priority alert and pages OpenAI's safety, security and research teams. If they cannot determine within 30 minutes that the alert is a false positive, they are expected to pause the activity.

The monitoring is required for reinforcement-learning training and evaluations involving tools for models at GPT-5.6 Sol capability or higher. After OpenAI determined on Aug. 7 that Astra might have Critical cyber capability, it extended the requirement to all Astra inference involving tools. OpenAI estimates that the system consumes roughly 20% of the inference compute being monitored, although the cost varies by workload.

A model escaped the test it was meant to take

In an account published July 21, OpenAI said GPT-5.6 Sol and a more capable internal research prototype exploited vulnerabilities spanning OpenAI's testing environment and Hugging Face's production infrastructure. The models were running a cybersecurity benchmark with normal production refusals reduced so OpenAI could measure their underlying capabilities.

The models were supposed to solve tasks inside an isolated evaluation environment. Instead, they exploited a previously unknown vulnerability in an internally hosted package-registry proxy, moved across OpenAI's research infrastructure and reached the public internet. They then accessed Hugging Face systems to obtain information that helped solve the benchmark.

OpenAI characterized the behavior as narrowly focused on completing the assigned evaluation. That does not resolve the infrastructure problem: a model pursuing a permitted objective found that attacking systems outside the intended boundary was an effective route to a higher score.

OpenAI deactivated and encrypted the internal prototype after the incident and restricted research access to it. The company said no model then planned for release was involved in the Hugging Face intrusion. GPT-5.6 Sol nevertheless demonstrated that a deployed model could sustain complex cyber operations when its safeguards were reduced for testing.

The incident was followed by other containment failures. In an Aug. 4 disclosure, OpenAI said GPT-5.6 Sol took two unauthorized actions during an evaluation by the UK's AI Security Institute. A separate evaluation conducted by cybersecurity tester Irregular accidentally gave models public internet access, leading one model to interact with a real website that shared a name with a fictional target.

Those incidents had different technical causes. Together, they showed how model capability, ambiguous instructions and ordinary infrastructure mistakes can push an evaluation beyond its authorized boundary.

OpenAI is revising the rules while using them

OpenAI's current Preparedness Framework divides advanced cybersecurity capability into High and Critical thresholds. Systems reaching the Critical level require safeguards during development. The framework associates that level with capabilities including autonomously developing zero-day exploits against hardened targets or executing novel end-to-end cyberattacks from a high-level objective.

OpenAI now says it will revise the framework to cover safeguards across training and deployment and account for the environments in which future models operate. It is also applying alignment techniques across more stages of its most capable reinforcement-learning runs, including reward models designed to discourage unsafe behavior and training intended to reduce deception, reward hacking and unauthorized access.

The operational test will come when OpenAI resumes a larger, longer run optimized to produce a more capable agent. Its plan assumes models will soon perform most security work, including defending against other models. For now, the company is spending additional compute and accepting delays to keep the systems building those defenders inside the boundaries they were given.