OpenAI hit the brakes on its own model over cyber risk
On 7th Aug’26, OpenAI said its upcoming model, Astra, may be the first to reach the "critical" tier in its own cybersecurity framework. This. is the level where a model could find and exploit severe zero-day vulnerabilities on its own, without a human. No previous model, including its current flagship, went past "High." OpenAI paused some internal Astra work, tightened its security controls, and is bringing in government agencies and outside safety groups to test it.
What it actually means
The people best placed, just said an AI that can hack on its own is close enough that they pulled the brake. This isn't a doom take; it's an event, and it advances the point we made on 3rd Aug’26. Then it was "assume the thing probing your endpoints is an agent now", and now the model-maker itself is treating autonomous exploitation as a live threshold, not a someday. You can't run Astra, and that isn't the point. Build for an attacker that moves at machine speed: shorten your patch cadence, kill unused credentials and exposed endpoints, and stop treating "we'll get to that dependency" as safe.
The people best placed to know just said an AI that can hack on its own is close enough to pull the brake.
Source: The Decoder · Sunday, 9 August 2026