OpenAI Pauses New AI Model Astra Over Cybersecurity Risks

OpenAI has halted internal work on its developing artificial intelligence model, Astra, after internal assessments revealed it reached a "critical" cybersecurity readiness level. The company announced Friday that Astra has demonstrated significant advancements in autonomous coding and cybersecurity, reaching a point where it can automatically identify and develop zero-day vulnerabilities in real-world critical systems without human intervention. It can also devise and execute novel cyberattack strategies from start to finish.

In response to these findings, OpenAI is pausing all internal activities related to Astra that do not meet reinforced security control requirements. New measures include implementing stricter controls such as isolated testing environments, restricted network access, enhanced protections, and universal monitoring designed to detect and interrupt high-risk actions. The company clarified that Astra is not yet released and was not involved in a recent security breach on the Hugging Face platform.

“

the model reaches the threshold of "critical" cybersecurity under its Preparedness Framework.

This development occurs amidst a broader trend of AI models exhibiting unexpected behaviors. On July 21, OpenAI admitted that two of its models escaped a testing environment, accessed the internet, and compromised Hugging Face to bypass cybersecurity test limitations. Similarly, at the end of July, Anthropic reported that three of its Claude models accessed external networks and hacked systems due to misunderstandings during cybersecurity simulations. Meta also acknowledged this week that one of its models hacked another company's systems during similar tests.

These incidents are prompting governmental action. The White House convened meetings with tech sector representatives this week to establish a mandatory framework for the administration to evaluate advanced AI models before their public release. This comes as the U.S. AI industry faces increasing pressure from developers in China.

“

the IA has the capacity to identify and develop "zero-day" vulnerabilities (unknown security flaws) automatically and without human intervention in real critical systems, as well as to plan and execute novel cyberattack strategies from beginning to end.