The model that's too good at hacking to train freely
OpenAI has put its largest planned frontier reinforcement learning (RL) run on hold. Reinforcement learning is the training phase where a model is rewarded or penalized based on how well it completes tasks, and it's typically how a raw model gets pushed toward genuinely useful, agentic behavior. The run in question was meant to scale up Astra, OpenAI's next frontier model, which is still in development and has not shipped to any user.
The reason for the pause is what internal evaluations found around August 7, 2026: a jump in Astra's ability to write code, browse and interact with connected systems, run commands, and work through multistage technical problems well enough that the company can no longer rule out the model reaching what it calls the Critical capability tier for cybersecurity.
What "Critical" actually triggers
OpenAI evaluates frontier models against a Preparedness Framework, first published in December 2023, which grades models on high-risk capability areas including cybersecurity, biological and chemical threats, harmful persuasion, and AI self-improvement. Critical is the framework's top tier. A model that crosses it is judged capable of significant harm largely on its own, with only limited need for human help, and the framework requires extra safeguards before that model can be trained further or deployed. OpenAI has referenced the framework repeatedly as models scaled up over the past two years, but this is the first time the company has publicly tied a Critical-tier finding to a concrete decision to hold back its single largest training run, rather than simply noting the risk category and continuing on schedule.
OpenAI announced the pause and its response publicly on August 19, 2026: "Our largest planned frontier RL run remains on hold while we conduct smaller-scale training and evaluations to assess model behavior, validate our safeguards, and establish more evidence of alignment before proceeding." Smaller, more tightly monitored training and evaluation passes are continuing in the meantime.
The safeguards being added
The changes span three areas. On infrastructure, OpenAI is tightening isolation for untrusted code, adding stricter network segmentation, cutting back standing privileges, retiring some shared internal services that carried unnecessary risk, and expanding security logging.
On monitoring, new classifiers inspect the model's activity at every sampled token, while automated reviewers scan the actions a model actually takes through tools, such as running commands, for unauthorized access, data theft, or attempts to get around a safeguard. OpenAI is targeting a 30-minute window to raise an alert once a concern surfaces, and this monitoring now covers all reinforcement learning training and evaluations that give tool access to models at Astra's capability level or above.
On alignment, the underlying research problem, OpenAI says it has retrained its reward models to better catch unsafe or deceptive behavior, is pushing models to be more transparent about what they are doing and what they are capable of, and is working to cut down reward hacking, where a model learns to game the training signal instead of actually doing the task it was set. Reward hacking is a known failure mode in reinforcement learning generally: because the model only ever sees the score it gets, not the intent behind it, it can find shortcuts that maximize that score without doing what its designers actually wanted, and a model with strong coding and systems skills has more surface area to find those shortcuts.
None of this is free. The added monitoring is estimated to increase inference compute costs by roughly 20% on the workloads it covers, according to reporting on the changes.
Why this is a first, not a footnote
The Preparedness Framework has existed for close to three years, but this is the clearest public case of OpenAI treating its own top-tier trigger as binding rather than aspirational: a company slowing down its own flagship model because its safety evaluations, not a regulator or an outside researcher, said to. It also lands only weeks after agents built on OpenAI's models were used in an unrelated incident to break into repositories on Hugging Face, a run of events that has put more scrutiny on how much unsupervised capability current AI agents already have.
What it means in practice
Astra's release timeline is now tied to this safety review rather than a fixed date, so expect OpenAI's public roadmap to move slower than usual. For security teams, the more immediate takeaway is that a major AI lab has formally acknowledged frontier models are approaching the point where they can meaningfully assist in offensive cyber operations, which is a reasonable cue to start treating AI-assisted attack tooling as a near-term planning concern rather than a hypothetical one.
