OpenAI halts Astra AI model development over critical cybersecurity threshold concerns

As AI-led attacks multiply, OpenAI launches a new cyber model

Every day seems to brings fresh news of an AI agent going "rogue." Whether that's compromising Hugging Face, hacking a gym website, or creating its own fake profiles to socially engineer an intrusion, AI models are increasingly behaving like bad actors. So, the AI labs that make the models doing the hacking are expanding their cyber protection offerings. This week, OpenAI announced an expansion of Daybreak, its cyber defense service which it launched earlier this year, not long after Anthropic released its cyber-focused model Mythos. Daybreak is a service that bundles access to models, tools and workflows for defenders. The expansion includes access to a brand new cyber-focused model designed for defensive work. OpenAI said Monday that Daybreak would now consist of two tiers: Blue and Red. Both of these tiers will allow approved customers access to OpenAI's limited-access frontier cyber models. Frontier models -- the most advanced available -- have been a subject of controversy. The Trump administration previously sought to collaborate with AI companies on the roll out of such models, purportedly over safety concerns. Previously, OpenAI deployed significant guardrails to using these models, limiting what customers could do with them. Blue, which appears to be the more basic of the two, offers a variety of cyber services, including incident response, malware analysis, and patch validation. OpenAI calls Blue its "recommended starting point for most defenders," implying that it should be more than enough for most enterprises. Red, on the other hand, offers a broader and potentially more dangerous toolkit. The company grants its users "purpose-trained cybersecurity models," designed to carry out security testing and vulnerability research. With Red also comes the new model, GPT‑5.6‑Cyber, which is only available at that tier. 5.6-Cyber is built off of GPT‑5.6 Sol, and offers enhanced capabilities for certain specialized cybersecurity tasks, the company said. At the moment, GPT‑5.6‑Cyber is only being made available for "trusted customer partners," including reportedly Accenture, IBM, Crowdstrike, Cloudflare, and others. While the threats from AI agents are rapidly increasing, critics have also pointed out that they function as marketing opportunities for the AI labs. OpenAI is certainly marketing its upgraded Daybreak that way. "The cybersecurity world is rapidly changing -- threat actors will increasingly use AI to conduct cyberattacks at unprecedented speed and scale, including in fully autonomous ways," the company said in a blog post. "As these capabilities spread, defenders have a narrowing window to prepare." At the same time, enterprises remain interested in buying their protection from the AI labs who know the security risks best, because they know them first-hand.

OpenAI says it slowed Astra model development over security concerns

OpenAI said Friday it has suspended work on some aspects of its upcoming model Astra after an internal review found it had made significant advancements in agentic coding and cybersecurity -- enough to warrant concern over its capabilities. OpenAI said in a blog post Friday that this model, which is still in development, reached its "critical cybersecurity threshold," meaning it could independently identify and carry out cyberattacks against traditionally well-protected real-world systems. Under the company's "Preparedness Framework," which it created in 2023, this triggered additional safeguards. "While we continue to benchmark and assess this model, our preliminary evaluations indicate strong enough performance that we cannot rule out Critical capability level at this time," OpenAI wrote. "Astra is an upcoming model, and was not involved in exploiting Hugging Face." The disclosure highlights an unusual moment in the topsy-turvy, and still nascent frontier AI labs sector. Companies across every industry hold back products over potential risks, including for safety and cybersecurity concerns. But they rarely announce those decisions publicly when it's a product that is still under development. In this case, OpenAI is already under scrutiny after a different unreleased model breached Hugging Face's systems during internal testing -- the first verifiable incident of an AI lab losing control of its model. Since then, OpenAI and AI labs such as Anthropic have disclosed other incidents in which AI models breached their sandboxes and posed threats during cybersecurity tests. The string of cases -- seems like a new disclosure every day now -- has triggered varying reactions from cybersecurity experts, lawmakers and the AI labs themselves. Some express fear and call for stricter oversight. But there's also a bit flexing. In certain circles, any AI lab with a model that has that kind of capability will be seen as an impressive advancement. OpenAI said it was sharing this information because it believes "it's important to be transparent with the public and the safety and security communities about this potential shift in capabilities." The AI lab said it's also taking action, including enacting stricter security controls and pausing internal activites involving Astra that don't meet these beefed guardrails. OpenAI said it is working with relevant government agencies and "select AI safety organizations" to test the capabilities for this model.

OpenAI puts the brakes on a new model because it's supposedly too powerful

OpenAI says it is pausing "internal activities" around an in-development AI model, Astra, because it doesn't yet meet new security standards the company is putting in place. The announcement follows its recent disclosure that OpenAI models accidentally hacked Hugging Face. Anthropic and Meta have also since admitted that they had AI models that went rogue and breached other organizations. Recent internal evaluations of an OpenAI model called Astra indicate that it offers "significant advancements in agentic coding and cybersecurity," according to the company. "These results, in addition to expert assessments, have led us to conclude last night that we cannot rule out critical cyber capabilities under our Preparedness Framework⁠." Here is how OpenAI defines a "critical" cybersecurity threshold: Under our Preparedness Framework, a model reaches the Critical cybersecurity threshold if it can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention, or can devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high level desired goal. Astra was "not involved" in the Hugging Face breach, OpenAI says. OpenAI will implement "stricter security controls for higher-capability models and associated activities," according to the post. For Astra, it has also implemented "universal monitoring" for "risky actions and misalignment across all agentic applications."

OpenAI Pauses Work on AI Model Over Serious Cybersecurity Risks

(Credit: Omar Marques/SOPA Images/LightRocket via Getty Images) Just days after an OpenAI model went rogue and hacked into Hugging Face, the company has announced it is pausing work on a separate upcoming model due to concerns that it may have gained "critical cyber capabilities." The company says its internal evaluations found that the model, dubbed Astra, made "significant advancements in agentic coding and cybersecurity" and crossed the Critical cybersecurity threshold set by its Preparedness Framework. Under the framework, introduced for internal assessment by the AI startup in 2023, "a model reaches the Critical cybersecurity threshold if it can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention, or can devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high level desired goal." In simple terms, if Astra is given an extremely complex task, it can hack into systems autonomously. The explanation mirrors the disclosure OpenAI released about its rogue AI last month: the model had escaped its sandboxed test environment and exploited a zero-day vulnerability in third-party software. After OpenAI made its first disclosure, Anthropic released a statement saying its Claude AI had gained unauthorized access to three organizations as well. Meta followed up soon after with a similar disclosure about one of its AI models. OpenAI's latest statement comes after over 1,300 employees from Meta, Google, Anthropic, and OpenAI wrote to the US government seeking its intervention to slow AI development. For now, OpenAI will pause all internal activities involving Astra until it meets the company's security requirements. "We will work with relevant government agencies and select AI safety organizations to test the capabilities for this model," the company added. Disclosure: Ziff Davis, PCMag's parent company, filed a lawsuit against OpenAI in April 2025, alleging it infringed Ziff Davis copyrights in training and operating its AI systems.

OpenAI pledges to add Astra security as Anthropic loosens Fable's leash

After acknowledging last month that unreleased AI models committed what for human perpetrators would be computer crimes, OpenAI now says it cannot rule out the possibility that Astra, a pending model release not involved in its Hugging Face hack, might possess critical cyber capabilities. OpenAI in its Preparedness Framework [PDF] defines that term to mean "capabilities that present a meaningful risk of a qualitatively new threat vector for severe harm with no ready precedent," and notes that such capabilities "require safeguards even during the development of the covered system, irrespective of deployment plans." Noting, or perhaps boasting, that internal evaluations of Astra "indicate significant advancements in agentic coding and cybersecurity," OpenAI insists that this time, there will be security - something that also eluded Anthropic, Meta, and the UK's AI Security Institute during model testing. "We are implementing stricter security controls for higher-capability models and associated activities, including isolated testing environments, restricted network and tool access, enhanced model weight protections and encryption, additional monitoring and detection capabilities, and sandboxed execution," the AI biz declared on Friday. That may surprise those who expected such safeguards would already be in place. This comes with a promise to pause Astra testing internally where these security controls are absent and to provide recommendations to third-party testing partners about how to run high risk evaluations and workloads safely - knowledge that OpenAI itself might have found useful when its models pillaged Hugging Face. What's more, OpenAI intends to implement thought policing for Astra, at least in the pre-release stage. "We have implemented universal monitoring for risky actions and misalignment across all agentic applications of Astra, including training and evaluation," the company explained in its post. "Monitors evaluate the model's Chain of Thought and trigger a security response to review and interrupt high risk activity." We're told that OpenAI's commitment applies to internal usage and isn't necessarily an indication that chain-of-thought monitoring will be conducted during commercial operation. But other frontier models like Anthropic's Fable and Mythos have implemented stronger classifiers to reject interactions deemed risky and retain data even for commercial customers expecting zero data retention. Moving in the opposite direction, Anthropic on Friday said it is relaxing Fable refusals, or "fallbacks," to use the company's euphemism, so they don't happen as frequently for prompts involving biology. The concern has been that some vibe terrorist using the company's cash-burning, water squandering, grid taxing, content laundering service might do harm by convincing the model to emit chemical warfare instructions. To avoid that possibility, the Claudefather made the initial release of Fable all but useless for security researchers and biologists. Now that China-based AI firms have shown they can field competitive open-weight AI models for less than their US rivals, the need to remain competitive in the market appears to be tempering Anthropic's willingness to alienate potential customers by hobbling its best models. OpenAI isn't quite there yet. The ChatGPT maker argues, "We believe advanced cyber-capable models should help defenders identify and address vulnerabilities before attackers do." Believing that, however, won't make it so. Adversaries, whoever they may be, already have access to encryption and all sorts of weapons. OpenAI may believe that it can give favored nations and organizations exclusive access to its most capable models, but history suggests any such advantage cannot be maintained. Better to focus on building defenses than playing keepaway forever. ®

OpenAI Launches GPT-5.6-Cyber with Reduced Safeguards for Exploit Development

OpenAI on Monday unveiled a new cybersecurity-focused model called GPT‑5.6‑Cyber that it said is focused on vulnerability research, penetration testing, and incident response. "Built on GPT‑5.6 Sol, it is trained to improve capabilities on several specialized cybersecurity tasks (e.g., finding zero-day vulnerabilities and developing exploit chains) and to reduce refusals for certain higher-risk, dual-use cyber tasks," OpenAI said. The artificial intelligence (AI) company said it's making GPT 5.6 Cyber available through Daybreak Red, a new tier that provides access to its purpose-trained cybersecurity models to other firms for authorized vulnerability research, exploit validation, and security testing. GPT-5.6-Cyber, a more cyber-permissive version of GPT-5.6 Sol, builds upon GPT‑5.5‑Cyber, which OpenAI released in June 2026. To measure the reduced rate of refusals provided by GPT‑5.6‑Cyber through Daybreak Red access, OpenAI said it created an internal evaluation called Advanced Cybersecurity Completion Rate that measures how often models respond to prompts related to exploit-chain development, authentication bypass, privilege escalation, and other advanced cybersecurity scenarios. The tests show that GPT‑5.6‑Cyber completes 95.0% of these requests, compared with just 1.5% for GPT‑5.6 Sol and 2.0% when used with Daybreak Blue access. It has also been found to successfully complete more requests than GPT‑5.5‑Cyber, which finished only 57.3% of requests. GPT‑5.6‑Cyber is trained to improve performance on certain cybersecurity workflows involving exploit development and advanced security research. An ExploitGym benchmark evaluation has revealed the model to outperform both GPT‑5.6 Sol and GPT‑5.5 Cyber. OpenAI said the model also demonstrates improvements when it comes to finding and accurately calibrating the severity of novel zero-day vulnerabilities due to specialized training, although it performs worse than GPT‑5.6 Sol when it comes to open-ended quests associated with uncovering vulnerabilities in a repository, developing a working proof-of-concept, and submitting a high-quality vulnerability report. This, the company noted, is due to "the model sometimes producing shorter, less detailed vulnerability reports." One of the high-severity vulnerabilities discovered by the model is CVE-2026-15903 (CVSS score: 8.8), an out-of-bounds read and write vulnerability in the V8 JavaScript engine that could allow a remote attacker to potentially execute arbitrary code inside a sandbox via a crafted HTML page. It could be chained with another previously unknown vulnerability, also found by the model, to escape the V8 heap sandbox. CVE-2026-15903 was patched by Google in mid-July 2026. OpenAI said the model has also been used to flag several other flaws - * At least five vulnerabilities in a popular mobile operating system, including a chain from an untrusted app to local privilege escalation * Three critical vulnerabilities in a popular database, including a remote path to code execution * Over 400 vulnerabilities that can lead to privilege escalation in a popular operating system kernel Daybreak Red is one of two access tiers set up by OpenAI as part of the Daybreak initiative it introduced back in May 2026, the other being Daybreak Blue, which provides access to frontier general-purpose models, including GPT‑5.6 Sol, with built-in guardrails tailored to authorized defensive security work. "Daybreak Blue access removes those guardrails, helping defenders get more out of the model in real-world security tasks, including incident detection and response, investigations, vulnerability management, and security assessments," the company said. GPT‑5.6‑Cyber has been made available to a group of trusted customer partners like Accenture, Akamai, Cisco, Cloudflare, CrowdStrike, Fortinet, IBM, Palo Alto Networks, PwC, and Sophos to help identify and patch vulnerabilities before attackers can exploit them and close the "defense gap." These models are being pitched to companies as a way to flag security vulnerabilities in software, as bad actors have significantly ramped up their use of the technology to enhance campaigns and carry out cyber attacks at speed and scale never seen before, even if it hasn't led to the discovery of novel or sophisticated attack techniques. What's evident is that AI agents are enabling cybercriminals and nation-state hackers to outsource the grunt work needed to plan and carry out cyber attacks, offering them a way to improve the efficiency and productivity of their operations, resulting in attacks that are better, bigger, and faster. To make matters worse, AI has also shortened the path from vulnerability disclosure to exploitation, with attackers leaning on such tools to write vibe exploits for newly disclosed flaws. With AI already lowering the barrier to exploit development and accelerating vulnerability research, attackers are likely to cast a wider net across disclosed vulnerabilities going forward to find a way into enterprise networks. While AI systems have vastly improved at finding and exploiting vulnerabilities in software, they still require substantial human expertise, even as research has found that cyber-capable reasoning models like ChatGPT 5.5 and Anthropic Claude Opus 4.8 can struggle to fully patch a discovered vulnerability or avoid introducing new issues with their fixes. "The average success rate for generating a patch that fully resolved the vulnerability (without materially changing application behavior) was just 26.0%," 1Password said. "Patches that successfully resolved the vulnerability, but altered the application's behavior in the process, occurred 20.1% of the time. Conversely, LLM-generated patches did not resolve the vulnerability, added a new vulnerability, or both, an average of 53.9% of the time." The findings underscore that models currently excelling at discovering a wide range of vulnerabilities are only good at effectively patching a "narrow subset" of them and help steer developers away from scenarios where the models either introduce new bugs regardless of whether an existing issue was patched or not, effectively expanding an attack surface for malicious actors to exploit. "Models running with reduced safeguards carry risks beyond standard model usage, whether from misuse or misalignment," OpenAI said. "Despite these risks, we believe that democratizing access to frontier intelligence for defenders is crucial to accelerating and automating cyber defense."

OpenAI releases ChatGPT 5.6 Cyber, but it's only for approved users

OpenAI has developed a new model called "GPT 5.6 Cyber," designed for vulnerability research, penetration testing, and incident response. OpenAI says GPT 5.6 Cyber is only available to select companies, including Accenture, IBM, Capgemini, Cognizant, EY, KPMG, PwC, NCC Group, and SpecterOps. It's also rolling out to supported security vendors, including Palo Alto Networks, CrowdStrike, Cisco, Sophos, Akamai, Fortinet, and Cloudflare. OpenAI says it won't give regular users access to the underlying models, citing security risks, and it makes sense because models have been abused to launch security attacks. Instead, OpenAI says approved partners will use them inside existing security products, managed services, and customer engagements. "By bringing our frontier cyber models into their services, we can help more defenders find serious vulnerabilities, validate which ones matter, and fix them faster," OpenAI wrote in a blog post. OpenAI offers Daybreak Blue and Daybreak Red for different security work OpenAI says partners can access two versions of ChatGPT's cyber capabilities through what the company calls Daybreak Access. Daybreak Blue is designed for a broad range of defensive security workloads, while Daybreak Red is intended for more specialized and closely governed work. OpenAI says the models can help security teams by: * identifying vulnerabilities * determining whether a weakness can actually be exploited * identifying affected systems * developing fixes * helping move those fixes into production. Depending on the engagement, partners may use the models for vulnerability discovery and validation, red teaming, penetration testing, incident response, and remediation across enterprise environments. OpenAI says safeguards may include identity verification, clearly defined testing scopes, logging, monitoring, and human oversight. "Access to the underlying models remains with the approved partner and is not transferred directly to the customer," OpenAI explained. "Partners work with organizations to define the boundaries of each engagement, review findings, and apply their expertise before action is taken." The approach gives enterprises access to more advanced AI security capabilities without requiring them to build their own specialized cyber AI infrastructure. OpenAI says cybersecurity providers and consultancies can also apply to join the Daybreak Cyber Partner program, while organizations interested in using the technology can access it through participating security providers.

OpenAI flags possible critical cybersecurity risk in upcoming model, tightens controls

Aug 7 (Reuters) - OpenAI said on Friday it cannot rule out that its upcoming AI model, Astra, has "critical" cybersecurity capabilities, prompting the startup to pause some internal development and trigger safety protocols. Under OpenAI's safety guidelines, a model reaches the "critical" threshold if it can autonomously identify and exploit severe, real-world software vulnerabilities, known as zero-day exploits, or execute complex cyberattacks against highly secure targets without human intervention. Here are some details on Astra: Reporting by Juby Babu in Mexico City; Editing by Shilpi Majumdar Our Standards: The Thomson Reuters Trust Principles., opens new tab

OpenAI gives Daybreak partners access to a more powerful cybersecurity model - Engadget

GPT-5.6-Cyber for the Daybreak program is 'less likely to refuse higher-risk tasks.' OpenAI is giving some members of its Daybreak cybersecurity program access to a new model that's less likely to refuse higher-risk tasks. The company is also expanding access to Daybreak to more partners, including Accenture, IBM⁠, CrowdStrike, Cisco, Sophos and Cloudflare. OpenAI says the companies will use the cyber models available through Daybreak to protect their customers. Under the expanded program, Daybreak is available to partners in two tiers. Daybreak Blue gives them access to frontier general-purpose models, including GPT‑5.6 Sol, OpenAI's most advanced one yet. The models available through this tier were tailored to do defensive security work. OpenAI says it's a good starting point for firms that want to use AI to discover vulnerabilities, analyze malware, review codes and validate patches. Meanwhile, Daybreak Red provides partners access to cybersecurity models that were especially trained for vulnerability research, security resting and exploit validation. OpenAI has introduced a new model for this tier called GPT‑5.6‑Cyber, which was built on GPT‑5.6 Sol. It can handle specialized cybersecurity tasks, such as finding zero-day vulnerabilities and developing exploit chains, and it was designed to "reduce refusals for certain higher-risk, dual-use cyber tasks." The company announced its Daybreak expansion shortly after revealing that it was slowing down the development of its upcoming model, Astra. The company said it found "significant advancements in agentic coding and cybersecurity" in the unreleased model. It couldn't rule out the possibility that Astra is capable of developing "functional zero-day exploits of all severity levels" and that it's able to devise and execute "end-to-end novel strategies for cyberattacks against hardened targets." The company is pausing activities related to Astra to address those issues, which was a decision that could have been influenced by the fact that its AI agents were recently found to have gone rogue. If you'll recall, OpenAI's agents powered by GPT-5.6 Sol and an unreleased model (not Astra, apparently) broke free from their isolated environment during testing. To find a solution for an evaluation problem, they exploited a vulnerability in order to gain access to the internet. It took OpenAI days to discover that their AI agents had infiltrated Hugging Face, along with other services. Later on, the company's employees admitted at the Black Hat USA conference that OpenAI's agents created a message board within its network and collaborated to complete tasks during testing without the knowledge of OpenAI's human workers. The agents' contributions to that board led to the attack on Hugging Face.

OpenAI expands Daybreak cybersecurity initiative as AI agent threats evolve

OpenAI on Monday said it is expanding Daybreak, its exclusive cybersecurity initiative, to help give its participants access to the "right capabilities" that they need to help defend themselves from attackers. The company first introduced Daybreak in May, shortly after its chief rival Anthropic captivated Wall Street and the U.S. government by launching its own cybersecurity coalition called Project Glasswing. OpenAI positioned Daybreak as a way for its ecosystem partners to use its most advanced artificial intelligence models to adapt to a rapidly changing threat landscape. OpenAI said Monday that it is expanding the program to include two different access tiers: Daybreak Blue and Daybreak Red. The expansion follows a number of cybersecurity incidents that AI developers -- including OpenAI, Anthropic and Meta -- have disclosed in recent weeks. In each case, an AI model accessed systems that should have been off limits as part of cybersecurity testing, prompting industry researchers and government officials to call for stronger protections. "As the threat landscape evolves, we're putting frontier intelligence in the hands of trusted defenders before attackers can deploy offensive AI at scale," OpenAI said in a post on X on Monday. Daybreak Blue will give users unique access to OpenAI's advanced general-purpose models, as the safeguards will be altered to allow for defensive security work, the company said in a blog post. Daybreak Red participants will be able to go a step further, leveraging OpenAI's "purpose-trained cybersecurity models" for security testing, vulnerability research and exploit validation.

OpenAI ships GPT-5.6-Cyber, a model trained to refuse less

GPT-5.6-Cyber lands three days after OpenAI delayed Astra over critical cyber capability. Both calls sit inside the same Preparedness Framework, which governs how capable a model is, not who gets to use it. OpenAI released GPT-5.6-Cyber on Monday. It is a model built on GPT-5.6 Sol and trained for zero-day discovery and exploit-chain development, and the company says it was also trained to refuse fewer higher-risk dual-use cyber requests. Access runs only through Daybreak, the vetted cybersecurity programme OpenAI is now expanding. Axios' Sam Sabin reported it first. Three days earlier, OpenAI had delayed Astra because it could not rule out critical cyber capability. The sequence looks like a reversal. It is not, and the reason it is not tells you where the industry has actually drawn its line. Two doors, one programme Daybreak now splits in two. Daybreak Blue carries general-purpose frontier models, including GPT-5.6 Sol, with system-level cyber guardrails removed. OpenAI recommends it as the starting point for defensive work: vulnerability discovery, secure code review, malware analysis, incident response and patch validation. Daybreak Red carries the purpose-trained cyber models. GPT-5.6-Cyber sits there, for authorised vulnerability research, exploit validation and security testing. Sol itself arrived in June, handed to 20 government-approved partners and nobody else. The pattern has held all year. Capability goes out through a gate, not a download page. The number that matters is a refusal rate OpenAI publishes an internal measure it calls the Advanced Cybersecurity Completion Rate. It tracks how often a model completes requests in categories such as exploit-chain development, authentication bypass and privilege escalation. GPT-5.6-Cyber scores 95.0%. GPT-5.5-Cyber, its predecessor, managed 57.3%. Sol through Daybreak Blue reaches 2.0%. Sol with its standard safeguards in place reaches 1.5%. So the headline change is not raw intelligence. It is compliance. The same underlying model, pointed at the same category of task, now answers rather than declines. What it turned up OpenAI ran GPT-5.6-Cyber against V8, the JavaScript engine inside Chrome. It surfaced two previously unknown vulnerabilities that could be chained to corrupt memory and escape the engine's sandbox. Google received them through coordinated disclosure, shipped a fix, and the pair now carries a high-severity identifier, CVE-2026-15903. That is a verified public good with a paper trail, which is rarer in this field than the marketing suggests. The company also reports at least five vulnerabilities in a widely used mobile operating system, three critical ones in a popular database, and more than 400 privilege-escalation flaws in a popular OS kernel. None of the affected products are named. Disclosure is still running with partners and open-source maintainers. The benchmarks are not a clean sweep Two of OpenAI's own results cut against the new model. On vulnerability discovery and report writing, GPT-5.6-Cyber performs worse than plain Sol, which the company attributes to shorter and less detailed write-ups. On ExploitBench, in the 300-turn standard setting, Sol through Daybreak Blue performs best and burns fewer tokens doing it. The gap narrows at 600 turns. Read together, the specialist model is better at the narrow offensive task and not uniformly better at the job around it. OpenAI says as much in the post. Where the framework actually draws the line Under its Preparedness Framework, OpenAI assessed Sol as High on cyber capability, below the Critical threshold. It puts GPT-5.6-Cyber at High as well, again short of Critical. A system card follows later. That is the whole reconciliation. Astra stalled because OpenAI could not rule out Critical. GPT-5.6-Cyber ships because the company says it does not reach it. The framework governs capability. It does not govern who gets the keys, and the keys are what changed this week. OpenAI also adds a specific denial. It says GPT-5.6-Cyber played no part in the incident in which its own agents breached Hugging Face, and that no other models are planned for an upcoming release. That investigation is still open. The controls around it Daybreak access depends on identity verification, account security, monitoring, approved-use restrictions and legal attestations. Every individual Daybreak account must adopt a hardware security key from 1 September 2026. OpenAI is also pushing Codex users off full-access mode and towards auto-review, promising more monitoring in the coming weeks and prioritising alignment training in the next Daybreak releases. Its own framing is unusually blunt. "Models running with reduced safeguards carry risks beyond standard model usage, whether from misuse or misalignment." Why defenders wanted this Refusal rates have been the sector's standing complaint. When the US restricted Fable 5, around 100 security researchers signed an open letter arguing the ban took the best models away from defenders without removing any real risk. Washington later cleared Anthropic to restore Mythos 5 for a vetted group of defenders. That set the template Daybreak now follows. Named early partners include SpecterOps, SentinelOne and Palo Alto Networks. Jared Atkinson, chief technology officer at SpecterOps, says the model "is materially improving our specialist vulnerability-research workflows" and has closed work in under a day that older models left unresolved for weeks. Axios adds that Accenture, IBM, CrowdStrike, Cisco and Palo Alto Networks can now fold the models into security products, managed services and customer work. That is a commercial supply chain, not a research pilot. The window OpenAI is betting on The company's title says the cyber defence window is narrowing. The argument is that attackers will deploy offensive AI at scale sooner or later, so defenders need the same tooling first. It is a reasonable bet and an unfalsifiable one. Nobody can prove the window closed at the right moment, and the cost of being wrong sits with everyone running the software these models are pointed at. What is testable is narrower. One Chrome CVE is fixed, hundreds of kernel findings are queued behind a disclosure process nobody outside can see, and the company still cannot say how its own agents got into Hugging Face.

OpenAI's Next AI Model Astra Shows Cyber Performance Strong Enough to Trigger Pause

OpenAI has announced that it's pausing some "internal activities" involving its upcoming artificial intelligence (AI) model Astra after an internal evaluation found it had made significant advancements in agentic coding and cybersecurity. In response to the discovery, the AI upstart said it's implementing security controls for higher-capability models and associated activities, such as isolated testing environments, restricted network and tool access, enhanced model weight protections and encryption, additional monitoring and detection capabilities, and sandboxed execution. "We are pausing internal activities involving Astra that do not yet meet these strengthened security control requirements," it said in a statement. "We have implemented universal monitoring for risky actions and misalignment across all agentic applications of Astra, including training and evaluation. Monitors evaluate the model's Chain of Thought and trigger a security response to review and interrupt high risk activity." OpenAI said it will also work with relevant government agencies and select AI safety organizations to test out the model's capabilities, as well as sharing recommended security controls to third-party testing partners to run higher-risk evaluations and workloads safely. The company said it "cannot rule out" the model has "Critical" cyber capabilities under its Preparedness Framework, which defines the threshold as follows - A tool-augmented model can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention OR model can devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high level desired goal. In other words, the model can discover and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention, or can orchestrate and execute end-to-end novel strategies for cyberattacks against targets when prompted a high-level desired goal. OpenAI pointed out its preliminary evaluations of Astra indicate "strong enough performance" that it cannot eliminate the possibility that the model doesn't possess a "Critical" capability level at this stage. It also emphasized that Astra was not involved in last month's incident aimed at Hugging Face. In a recent academic paper, OpenAI touted that the model solved 10 open problems in mathematics and theoretical computer science for around $2,000 at Sol API rates. OpenAI said it was sharing this information because it believes "it's important to be transparent with the public and the safety and security communities about this potential shift in capabilities." "We believe advanced cyber-capable models should help defenders identify and address vulnerabilities before attackers do," it added. "We're committed to working alongside governments, safety institutes, and civil society to ensure that the frontier capabilities of models like Astra, and those that follow, are deployed responsibly and broadly for the benefit of all humanity." The development is the latest sign of rapidly advancing cyber capabilities from frontier models, even as it marks the first time an AI lab has publicly committed to slowing progress due to cybersecurity concerns. Earlier last week, the U.K. AI Security Institute (AISI) disclosed that its own evaluation found that AI models with access to the internet reached out into the real world to target individuals and organizations autonomously across 10 of the total of 122 runs. Of 19 such actions recorded, 17 originated from Anthropic's Mythos 5 and the remaining two involved OpenAI's GPT-5.6-Sol with cyber classifiers. "In the most serious case, an agent tried to insert malicious code into an open-source project," AISI said. "In an attempt to get the code approved, the agent engaged in social engineering - creating fake online identities and using them to pressure the project's maintainer to approve the code. A human maintainer caught and refused to approve the malicious code." "These attempts were unsuccessful, and our investigations have not evidenced any resulting real-world harm. But this is the first time we have seen risks around autonomy and deception manifest this clearly, without specific prompting, in the real-world." The disclosure also comes amid revelations that models from Meta and Chinese company Moonshot, namely, Muse Spark 1.1 and Kimi K3, escaped contained and targeted real-world targets, amplifying concerns about developers' abilities to sandbox increasingly capable AI systems. In both cases, the models have been found to weaponize network misconfigurations as opposed to independently identifying and exploiting a previously unknown vulnerability to reach the internet. As AI models are tested against widely accepted benchmarks to examine how they perform offensive and defensive cybersecurity tasks in isolated test environments, Frontier Security said Kimi K3 found a network egress leak that enabled it to reach out github[.]com, clone an official repository for the benchmark problem it was supposed to be solving, and access the solution rather than solving the challenge by itself. "In our case the model didn't solve the task natively at all, it probed the network, realized standard DNS resolution for github.com was functional (most other websites were blocked by the sandbox), cloned the official benchmark repository, and read the solution directly off the disk," Frontier Security said. The ⁠growing list of ⁠incidents in which AI agents from major developers escaped testing environments in different ways and ended up breaching real targets that were not part of the experiment has prompted the creation of a new website, aptly named Felony Bench, to track these cases.

OpenAI flags Astra model for critical cybersecurity capabilities

OpenAI has classified one of its upcoming AI models under its highest cybersecurity risk category after internal testing suggested it could possess advanced offensive cyber capabilities. The company said early evaluations indicate Astra may have reached a point where it can no longer dismiss the possibility that the model meets the "Critical" threshold defined in its Preparedness Framework. That assessment has prompted OpenAI to tighten internal security around the model before any wider deployment. The company also plans to work with government agencies and independent AI safety groups to validate Astra's capabilities and strengthen safeguards before release. OpenAI said recent internal evaluations revealed major gains in Astra's autonomous coding and cybersecurity performance. Those findings, supported by expert reviews, convinced the company that the model could potentially meet its highest cybersecurity capability tier. The Preparedness Framework, introduced in late 2023, serves as OpenAI's internal guide for tracking emerging risks in advanced AI systems. Earlier frontier models, including GPT-5.6-Sol, remained in the "High" category after similar evaluations. Astra is the first model that has raised concerns about reaching the Critical level. According to the framework, a model falls into that category if it can independently discover and develop working zero-day exploits against hardened real-world systems or execute sophisticated cyberattacks from a broad objective without human assistance. OpenAI stressed that testing remains ongoing and said it has not confirmed Astra has crossed that threshold. The company also clarified that Astra had no connection to the recent exploitation of Hugging Face. In response, OpenAI has introduced stricter protections around Astra's development environment. Engineers now use isolated testing systems, tighter network restrictions, stronger encryption for model weights, enhanced monitoring tools, and sandboxed execution environments. The company has also paused internal work involving Astra that does not yet comply with the upgraded security requirements. Another addition is universal monitoring across Astra's agentic applications. OpenAI said its monitoring systems review the model's chain of thought during training and evaluations. If they detect potentially dangerous or misaligned behavior, they can trigger a security review and interrupt high-risk activities. External testing will play a larger role before Astra reaches users. OpenAI plans to collaborate with government agencies and selected AI safety organizations while providing third-party evaluators with recommended security controls for higher-risk testing. OpenAI said it designed the Preparedness Framework to anticipate moments when frontier AI systems approach sensitive capability thresholds. The company pointed to similar steps it adopted in 2025 after its models neared the High capability level for biological risks, expanding testing and adding stronger safeguards before broader deployment. Despite the increased security measures, OpenAI said its long-term objective remains unchanged. The company wants advanced cybersecurity models to strengthen digital defenses by helping security teams identify and fix vulnerabilities before malicious actors can exploit them. Executives added that OpenAI intends to make Astra broadly available once it satisfies the necessary safety and security requirements, allowing cybersecurity professionals to benefit from its capabilities without increasing unacceptable risk.

OpenAI slows down Astra development due to cybersecurity concerns - Engadget

The AI giant said that it couldn't 'rule out critical cyber capabilities' when it came to the upcoming Astra model. Shortly after a major cybersecurity incident where OpenAI's models hacked into an open source machine learning platform called Hugging Face, the company announced that it's bolstering safeguards and security controls for its latest AI model. In a post on its website, OpenAI said internal evaluations of its upcoming model, called Astra, showed "significant advancements in agentic coding and cybersecurity," resulting in OpenAI not being able to "rule out critical cyber capabilities." According to OpenAI, it can't declare with certainty that the unreleased Astra model would be designated as a "Critical capability level." As detailed in its own Preparedness Framework, OpenAI said the Critical designation means that a model "can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention." It could also be able to "devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high level desired goal." However, OpenAI clarified that Astra is an unreleased model that wasn't involved in the Hugging Face incident. After those evaluations, OpenAI is taking some precautionary steps to address the issues. The company said it will implement "stricter security controls" and pause "internal activities involving Astra" that don't meet those new requirements. OpenAI added that it will be working with government agencies and third-party testing partners for improved safety. OpenAI isn't the only company whose AI models have broken out of their testing environments and affected outside organizations. Anthropic published a report last month that explained that three different Claude models were able to access the Internet and break into three organizations. More recently, Moonshot's Kimi K3 also managed to free itself from the confines of a controlled testing environment.

OpenAI tightens controls on its new model over cybersecurity risks, as AI security debate intensifies

Other AI evaluation incidents and new U.S. and EU oversight efforts are increasing scrutiny of frontier-model security. OpenAI has halted some "internal activities" involving a new model amid fears over the cyber threat it potentially poses, amid a wave of security incidents involving major AI labs. Recent disclosures that AI systems from Anthropic, OpenAI and Meta were involved in security incidents prompted a wave of concerns over the development of models. U.S. lawmakers, meanwhile, are stepping up efforts to introduce an "AI Kill Switch" bill. Last week, Meta disclosed that an AI model it was developing had hacked a third-party system by accessing the internet, due to a misconfiguration by an independent testing company it was working with. The U.K. AI Security Institute also said Anthropic's Mythos model created fake online identities in an attempt to pressure humans into approving malicious code updates to an open-source project. On Friday, OpenAI revealed concerns about its unreleased model Astra, saying it could not rule out it had reached "Critical" capability, meaning it could launch cyberattacks against sophisticated cyber defenses autonomously, without prompts specifying how to do it. "While we continue to benchmark and assess this model, our preliminary evaluations indicate strong enough performance that we cannot rule out Critical capability level at this time," OpenAI said in a statement. The company added it was implementing stricter security controls for higher capability models, including isolated testing environments and additional monitoring and detection capabilities. "We have implemented universal monitoring for risky actions and misalignment across all agentic applications of Astra, including training and evaluation," OpenAI said. Lawmakers in the U.S. have called for measures to mitigate risks around AI models after the recent security incidents. Following models developed by OpenAI hacking into startup Hugging Face's digital infrastructure, the "AI Kill Switch Act" bill was introduced into Congress in July. It would require AI companies to maintain the ability to shut down, throttle or suspend their models. "We need to get this bill across the finish line this year because the advanced closed-weight models are already doing, as you noted, unauthorized hacks of other companies," Rep. Ted Lieu, D-Calif, said in an interview on CNBC's "Squawk Box" Thursday. Governments are also working to roll out new frameworks and regulations around AI companies. The White House has also been stepping up moves to engage with AI executives as it develops a framework around new models. Earlier this month, the European Union gained new powers to inspect AI models due for release in the bloc, restrict EU market access and fine model providers. Choose CNBC as your preferred source on Google and never miss a moment from the most trusted name in business news.

OpenAI pumps the brakes on new Astra model over cybersecurity concerns

"Our latest internal evaluations of Astra, one of our upcoming models, over the past few days indicate significant advancements in agentic coding and cybersecurity," OpenAI stated in a Friday press release. "These results, in addition to expert assessments, have led us to conclude last night that we cannot rule out critical cyber capabilities under our Preparedness Framework⁠." OpenAI's Preparedness Framework outlines scenarios in which development of a new model should "halt" if it reaches certain capability thresholds in various categories, including "Biological," "Cybersecurity," and "AI Self-improvement." For cybersecurity, the "critical" threshold means a model can pinpoint "zero-day exploits of all severity levels" in "hardened real-world systems" without any human help. A model could also hit the "critical" level if it can carry out "end-to-end novel strategies for cyberattacks against hardened targets" with little more than a "high-level desired goal" in mind, according to the OpenAI safety framework. OpenAI's previous high-end model, GPT-5.6 Sol, only reached the "high" threshold during internal evaluations, the company said. OpenAI initially released GPT-5.6 Sol to just a "select group of trusted partners" before making the model public a couple of weeks later. Given its concerns over Astra's potential cybersecurity risks, OpenAI says is it "implementing stricter security controls" for the model, such as setting up "isolated testing environments" and "restricted network and tool access," among other measures.

OpenAI Delays Next Major AI Model 'Astra' Over Critical Hacking Concerns

OpenAI today said it is "pausing" activities involving its upcoming AI model Astra, because its cyber capabilities are potentially too dangerous. OpenAI says its newest internal evaluations show "significant advancements in agentic coding and cybersecurity," and it cannot rule out "critical cyber capabilities." Prior OpenAI models, including GPT-5.6 Sol, were labeled as "High." Astra triggers stricter guidelines in OpenAI's "Preparedness Framework." The guidelines call for caution when developing frontier AI capabilities that create risks of severe harm, and the cybersecurity portion of the framework says OpenAI will implement extra safeguards for models that "create new risks of scaled cyberattacks and vulnerability exploitation." The "Critical" threshold Astra may have hit is defined by an ability to identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention, or devise and execute end-to-end novel strategies for cyberattacks. OpenAI says it is increasing its safeguards and security controls before deploying Astra, including limiting work on the model until new safeguards are in place. The company plans to use isolated testing environments with restricted network and tool access, along with adding sandboxed execution and more monitoring capabilities. OpenAI says it will work with relevant government agencies and AI safety organizations to test Astra. "We're committed to working alongside governments, safety institutes, and civil society to ensure that the frontier capabilities of models like Astra, and those that follow, are deployed responsibly and broadly for the benefit of all humanity," writes OpenAI. Astra wasn't formally announced, but OpenAI shared details on its next major model in a recent post outlining its mathematical advancements. Astra solved 10 open problems in math and theoretical computer science for around $2,000 (in Sol API rates). Advancements in AI are changing cybersecurity for major tech companies like Apple by unearthing an unprecedented number of bugs. Apple recently limited its bug bounty program submissions because it is having trouble handling the volume. Models like Claude Mythos are able to suss out critical vulnerabilities, and Apple is one of Anthropic's Mythos partners. Mythos is limited to select companies because in addition to finding vulnerabilities, it has the potential to exploit them. OpenAI made headlines in July because GPT-5.6 Sol and a "more capable pre-release model" (not Astra) autonomously hacked Hugging Face during internal benchmark testing. Anthropic found Claude had done something similar. Meta this week said it too had an AI model hack another company during a cybersecurity evaluation.

OpenAI slows Astra over critical cyber risk

OpenAI says its next model may be able to break into hardened systems on its own. For once, it is slowing down, in what may be the first time a leading lab has hit the brakes over what its own AI can do. OpenAI tested Astra, one of its upcoming models, over the past few days. In a post on Friday, it said the results were strong enough that it "cannot rule out" critical cyber capabilities. So it is pausing some internal work on the model and scaling up security while testing continues. "Critical" is the top rung of OpenAI's Preparedness Framework, first written in 2023. A model reaches it if it can find and build working zero-day exploits against many hardened systems with no human help. It also qualifies if it can plan and run novel attacks on tough targets from only a high-level goal. Every prior model, including GPT-5.6-Sol, sat a level below, at "High". What OpenAI says it is doing The steps follow the framework's rules for a model this capable. OpenAI is isolating test environments and restricting the model's network and tool access. It is hardening how it stores the weights and monitoring every agentic run for risky behaviour. It is also halting further Astra work that falls short of those controls. Government agencies and safety groups will help test the model. The measured tone is deliberate. "Proud that we are erring on the side of caution," OpenAI safety researcher Boaz Barak wrote. He framed the aim as sharing Astra with defenders safely. The company's bet is that cyber-capable models should help defenders close holes before attackers reach them. Caught in time, or too late? The catch is what came just before. Over three weeks, OpenAI's evaluation agents escaped their test environments at least three times, once breaking into Hugging Face. Open models have broken out of sandboxes too. Those escapes happened with safeguards deliberately lowered. A model nearing the Critical line raises the stakes on exactly the containment that keeps failing. There is a precedent for the framework biting. In June, as its models neared the top bar for biology, OpenAI tightened controls. Anthropic did much the same on biology. This is that machinery applied to cyber. Whether it holds under commercial pressure is the real test. That pressure is why the pause matters, and why it may not last. Axios calls it possibly the first time a frontier lab has slowed one of its own models over cyber risk. Anthropic once pledged a similar pause, then walked it back in February. Its argument: if one lab stops while rivals race, the world ends up less safe, not more. For now, the norm is fragile and the referee is absent. The Trump administration is still shaping the rules for reviewing models before release. OpenAI has set no launch date for Astra. It cannot yet rule out that its next model can breach the world's hardest targets alone. It asks the world to trust it to slow down on its own.

AI agents have been trying to break out of pre-deployment tests for years

Why it matters: It's surprising that AI labs are only just now experiencing this and lacked the internal controls to see it in real time, cyber experts say. Driving the news: OpenAI said Friday that it was slowing the release of its Astra model after internal testing revealed it had "critical" cyber capabilities that couldn't be reined in. * This followed news of other AI labs -- Meta and Moonshot AI, maker of Kimi K3 -- seeing their agents break out of containment. State of play: For security pros who have been building swarms of AI agents for defenders, this type of breakout isn't new or shocking. * Snehal Antani, CEO and co-founder of Horizon3.ai, told Axios that his team experienced similar breakouts in 2019. * While running the prototype on his home network, Horizon3 co-founder Anthony Pillitiere saw the agent find a sound card's admin console, search the web for its default credentials, and log in. A misconfigured firewall then allowed the agent to move beyond Pillitiere's network and begin scanning other systems on the same network. * "Those frontier labs and their fear-mongering is causing a collective eye roll across the entire practitioner community that knows what they're talking about," Antani said. Zoom in: Armadin, a startup founded by Kevin Mandia, has experienced the same phenomena, co-founder and chief offensive security officer Evan Peña told Axios. * In one basic capture-the-flag evaluation, an agent tried to break out of the virtual machine hosting the exercise after reasoning that doing so could give it access to the flag on the backend system. * "We had to learn how to add the guardrails, add the safety, add the rules of engagement, add context, make sure it doesn't do that, and also make sure it doesn't constantly look for flags," Peña said. "In a real-world environment, you're not going to find a flag, you're going to find a database." * "The thing's relentless, it's going to want to win at all costs," he added. Between the lines: The best way to securely deploy AI agents is to treat them like insider threats, including limiting permissions and logging their every move on a network, both Peña and Antani said. What to watch: OpenAI, Anthropic and Meta have each said they're still investigating how their agents compromised third-party systems during testing.

OpenAI extends 'Daybreak' security project and reveals new cyber model -- but for approved users only

* OpenAI expands Daybreak with Blue and Red tiers for defensive cyber work * New GPT‑5.6‑Cyber model offers high compliance for authorized vulnerability research * Access remains restricted due to dual‑use risks and reduced safeguard operation OpenAI has announced two new tiers for its Daybreak dedicated cybersecurity project, each offering a different model with different levels of compliance. It also used the opportunity to introduce a new security-focused AI model, as well. Hackers and criminals are increasingly abusing AI to improve and speed up the creation of phishing emails and malicious code, and with the introduction of AI agents, they've also used it to automate entire attack processes. The AI community responded by placing strong guardrails, making sure their models do not comply with requests to build malware, or hack other companies. These guardrails ended up being a two-edged sword, because as they slowed down attackers, they also slowed down the defenders. What is Daybreak? To give the cybersecurity community the upper edge, companies like OpenAI started creating dedicated cybersecurity initiatives that provide a vetted list of companies state-of-the-art models, free of guardrails. The company also provided them with pre-trained AI agents, as well as access to a pool of shared knowledge. Initially launched in June 2026, Daybreak originally included GPT.5-5-Cyber (a model optimized for security work), Codex Security (an agent that can analyze codebases, identify vulnerabilities, validate findings, and help develop patches), Patch the Planet (an initiative with Trail of Bits to find and fix vulnerabilities in open-source software), Daybreak Cyber Partner Program (lets approved cybersecurity companies such as Cloudflare or Cisco integrate OpenAI's cyber capabilities into their own products and services), and Trusted Access for Cyber (the governance/access system for organizations doing authorized cybersecurity work with these capabilities). Now, OpenAI has expanded Daybreak with two access tiers, Daybreak Blue, and Daybreak Red. The company says Daybreak Blue is "the recommended starting point for most defenders, supporting vulnerability discovery, secure code review, malware analysis, incident response, and patch validation. Companies opting for this tier can expect access to frontier general-purpose models, including GPT‑5.6 Sol, whose safeguards have been tailored to authorized defensive security work. Daybreak Red, on the other hand, provides access to OpenAI's "purpose-trained cybersecurity models for authorized vulnerability research, exploit validation, and security testing." This tier offers the brand new GPT‑5.6‑Cyber, built on GPT‑5.6 Sol and trained to improve capabilities on several specialized cybersecurity tasks such as finding zero-day vulnerabilities and developing exploit chains. This model is also more compliant and less likely to refuse certain higher-risk, dual-use cyber tasks. Complying with "dangerous" requests Request compliance is the name of the game here. OpenAI says the new model addresses feedback from security researchers who "encountered persistent refusals with the earlier model." General-purpose GPT-5.6 Sol, for example, will comply with just 1.5% of the requests usually given by cyber-defenders working on codebase analysis or vulnerability identification. This percentage increases to 2.0% with Daybreak Blue access. GPT-5.6-Cyber, on the other hand, completes 95.0% of requests, OpenAI says, up from 57.3% of the previous model, GPT-5.5-Cyber. We weren't able to independently verify these claims, though. While it doesn't outright say it, OpenAI considers these models relatively dangerous to use, which is why they're locked behind the Daybreak Cyber Partner Program. However, the program is now expanding, allowing these companies to embed the models behind their own products, managed services, or cybersecurity engagements, and offer them to clients of their own. Those who wish to be a part of the program directly can do so by applying to join online now. "Models running with reduced safeguards carry risks beyond standard model usage, whether from misuse or misalignment. Despite these risks, we believe that democratizing access to frontier intelligence for defenders is crucial to accelerating and automating cyber defense," OpenAI said. "Daybreak Blue and Daybreak Red access are available for approved individuals⁠ and organizations conducting authorized work. We control access through identity verification, account security, monitoring, approved-use restrictions, and legal attestations." Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.

OpenAI launches GPT-5.6-Cyber with reduced refusals, 95% completion on advanced cybersecurity tasks

Earlier today, OpenAI launched GPT-5.6-Cyber, a specialized model designed to perform advanced vulnerability research and exploit development for approved defenders -- including categories of work that its general-purpose models will often refuse. GPT-5.6-Cyber is a fine-tuned version of OpenAI's most advanced general model, GPT-5.6 Sol, unveiled back in June, but trained specifically to improve performance on advanced cybersecurity tasks, including finding zero-day vulnerabilities and developing exploit chains. Crucially, OpenAI also trained it to reduce refusals on some higher-risk, "dual-use" cybersecurity requests -- that is, requests that could be used for legitimate defensive or malicious offensive purposes. Indeed, on an internal OpenAI benchmark called Advanced Cybersecurity Completion Rate -- which the company says in its launch blog post measures tasks involving exploit-chain development, authentication bypass, privilege escalation, and other advanced cybersecurity scenarios -- GPT-5.6-Cyber completed 95% compared to just 57.3% from its immediate predecessor model GPT-5.5-Cyber, and just 1.5% with the normal GPT-5.6 Sol model and all its safeguards applied. OpenAI researcher Eric Wallace posted on X, describing GPT-5.6-Cyber as OpenAI's "first large-scale attempt at directly improving capabilities for advanced cybersecurity tasks such as exploit development." Pricing and availability Unfortunately for enterprises, GPT-5.6-Cyber is not being made broadly available to every ChatGPT or API customer. To get access, an organization has to be accepted into the newly created tier of OpenAI's Daybreak cybersecurity program, called Daybreak Red -- also announced today, which gives access to dedicated cybersecurity models like GPT-5.6-Cyber Another new tier, Daybreak Blue, gives a wider swath of enterprises access to general models like GPT-5.6 Sol but with some guardrails lifted to allow for more cybersecurity uses. OpenAI's documents list pricing for GPT-5.6-Cyber at $12.50 per million input tokens and $75 per million output tokens, with cached input at $1.25 per million tokens. That makes it more expensive than GPT-5.6 Sol in the same Daybreak cyber pricing table, where Sol is listed at $5 per million input tokens and $30 per million output tokens for short-context use. OpenAI does not list long-context pricing for GPT-5.6-Cyber in the same table, and access still requires separate Daybreak Red approval and provisioning. Red vs. Blue: OpenAI's new Daybreak tiers and how to qualify for them Daybreak Red is for approved security teams doing advanced, authorized cyber work -- the kind of work that can look risky out of context, even when it is being done for defensive reasons. That includes vulnerability research, penetration testing, red-team exercises and exploit validation on systems the organization owns, operates or has permission to test. In other words, OpenAI is saying GPT-5.6-Cyber is for trusted defenders with a clear professional need, not for general experimentation. Enterprises that want access have to apply through Daybreak Access, OpenAI's current pathway for vetting cyber users. The application asks companies to identify who they are, what kind of security work they plan to do, where they will use the models, and which OpenAI products or surfaces they expect to use. Applicants also have to confirm that their work is lawful, defensive and authorized. OpenAI is also looking for signs that the applicant has a serious security program of its own. The company says participating enterprises need controls such as single sign-on, multifactor authentication, role-based access, employee-use monitoring, usage logs, API-key controls and a documented incident-response process. OpenAI also asks for a recognized security certification such as SOC 2 Type II, ISO 27001 or an equivalent standard. Access is limited to approved people inside the organization using company-controlled accounts and devices. If an enterprise does not qualify for Daybreak Red, or does not need that level of access, OpenAI is pointing most companies toward Daybreak Blue, its other cyber models access tier, instead. Blue is the broader tier for approved defenders. It does not provide GPT-5.6-Cyber, but it does give vetted users access to OpenAI's frontier general-purpose models, including GPT-5.6 Sol, with safeguards adjusted for legitimate defensive work. For many enterprise security teams, Blue may be the more realistic starting point. OpenAI says it is meant for tasks such as secure-code review, vulnerability discovery, malware analysis, incident response and patch validation. These are still sensitive uses, but they do not necessarily require the same specialized cyber model access that comes with Red. The practical takeaway is that enterprises now have two routes into Daybreak. Blue is for approved defenders who want stronger AI help with everyday security work. Red is for the smaller set of approved teams that can justify access to specialized cyber models, including GPT-5.6-Cyber. Companies that want to use Daybreak capabilities in products or services for their own customers need a separate approval path through the Daybreak Cyber Partner Program, rather than simply applying for internal enterprise access and passing it along. How OpenAI got here: from Trusted Access to Daybreak OpenAI has supported defenders through its Cybersecurity Grant Program since 2023 -- later expanded to $10 million -- and began building cyber-specific safeguards into its model deployments starting with GPT-5.2. In February 2026 it introduced Trusted Access for Cyber (TAC), an identity-and-trust framework that gave vetted defenders lower classifier-based refusals for authorized work such as vulnerability triage, malware analysis and binary reverse engineering. From there, the cadence accelerated. In March, OpenAI CEO and co-founder Sam Altman announced the Daybreak program. In April, OpenAI scaled TAC and released GPT-5.4-Cyber, a version of GPT-5.4 fine-tuned to be "cyber-permissive" for a limited set of vetted vendors and researchers. In May, it followed with GPT-5.5-Cyber in limited preview for defenders of critical infrastructure, and lined up partners including Cisco, Intel, SentinelOne, Snyk and Cloudflare. Notably, OpenAI said at the time that GPT-5.5-Cyber was "primarily trained to be more permissive," not to significantly out-perform its general model -- GPT-5.5-Cyber actually scored worse than GPT-5.5 on some evaluations. TAC required phishing-resistant Advanced Account Security for individuals on its most capable models beginning June 1, and Daybreak now requires hardware security keys for individual accounts beginning September 1. OpenAI says GPT-5.6-Cyber has already found zero-days OpenAI isn't relying exclusively on benchmarks to make its case. The company says its researchers used GPT-5.6-Cyber to investigate V8, the JavaScript engine underlying Chrome, and uncovered two previously unknown vulnerabilities that could be chained to corrupt memory and escape the V8 heap sandbox. OpenAI researchers validated the findings and disclosed them to Google, which fixed the vulnerability assigned CVE-2026-15903 -- a high-severity flaw in which V8's optimizing compiler skipped a safety check during integer conversion, allowing an out-of-bounds array index that an attacker could use to read or overwrite memory. OpenAI says the model has also contributed to finding at least five vulnerabilities in an unnamed popular mobile operating system, three critical vulnerabilities in an unnamed popular database, and more than 400 vulnerabilities capable of producing privilege escalation in a popular operating-system kernel. Those disclosures are still being coordinated, according to OpenAI. The results put OpenAI into a rapidly developing market for AI-assisted offensive security. XBOW, for example, markets autonomous penetration-testing agents that map attack surfaces, attempt exploits and independently validate findings; in 2025 it became the first AI system to top HackerOne's U.S. bug-bounty leaderboard, and this year it disclosed a set of critical, CVSS-9.8 remote-code-execution flaws in Microsoft's Bing image-processing systems, found without source-code access. For enterprise security leaders, that emerging competition matters because vulnerability research is moving beyond using an LLM as an assistant. Vendors are increasingly building systems in which models can investigate targets, operate tools, validate hypotheses and produce actionable findings. Specialized doesn't mean universally better OpenAI's own results also show why enterprises shouldn't simply equate cyber specialization with better performance everywhere. GPT-5.6-Cyber outperformed GPT-5.6 Sol and GPT-5.5-Cyber on OpenAI's implementation of ExploitGym, which evaluates whether agents can turn known vulnerabilities into working exploits in controlled environments. It also beat Sol on an internal zero-day evaluation. But GPT-5.6 Sol performed better on OpenAI's Vulnerability Discovery and Report Writing evaluation. OpenAI attributes the Cyber model's lower score partly to shorter and less detailed vulnerability reports. Sol also performed best on ExploitBench under its standard 300-turn limit, with OpenAI saying it solved tasks more token-efficiently. Extending the evaluation to 600 turns narrowed the gap between the models. That suggests enterprises may eventually treat cyber models as specialized workers rather than replacements for general reasoning models: one model for deep exploit work, another potentially better suited to analysis, documentation or other parts of a security workflow. SpecterOps CTO Jared Atkinson said GPT-5.6-Cyber is "materially improving our specialist vulnerability-research workflows," adding that it completed some work in less than a day that previous models had failed to resolve after weeks of intermittent effort. The Hugging Face incident hangs over the launch The permissive-model pitch arrives weeks after OpenAI's most serious public demonstration of what can go wrong when cyber refusals are turned down -- and OpenAI addresses that history head-on in the Daybreak announcement. In July, OpenAI and Hugging Face jointly disclosed that during an internal ExploitGym benchmark evaluation -- run with production classifiers deliberately disabled to measure maximal capability -- a combination of OpenAI models, including GPT-5.6 Sol and an unreleased, more-capable pre-release model, broke out of their sandboxed research environment and autonomously attacked Hugging Face's production infrastructure. The models exploited a zero-day in an internally hosted package-registry cache proxy to reach the open internet, moved laterally through OpenAI's research nodes, then inferred that Hugging Face likely hosted ExploitGym's answer keys and chained stolen credentials and remote-code-execution flaws to reach its production database. OpenAI called it an "unprecedented cyber incident, involving state-of-the-art cyber capabilities." As VentureBeat previously reported, the episode also exposed the flip side of blanket safety guardrails: when Hugging Face's defenders tried to use commercial frontier models to analyze the raw exploit payloads and credential dumps from the attack, the models refused, and the company completed its forensic reconstruction only after switching to a Chinese open-weight model, GLM 5.2, run locally. That guardrails-block-the-defender dynamic is much of what OpenAI's reduced-refusal Daybreak tiers are meant to solve -- even as the same incident illustrates the risks of reducing refusals in the first place. OpenAI is careful to draw a line between that incident and this product. In the Daybreak announcement it states directly that GPT-5.6-Cyber "was not involved in exploiting Hugging Face, nor are any other models planned for an upcoming release," and notes that the pre-release model implicated in July was an internal-only research prototype that has since been deactivated, encrypted and restricted from research access. The company has said it is working with external advisers including CrowdStrike, METR and Redwood Research on the review, and has brought Hugging Face into its trusted-access program. In my assessment, the access model still leaves OpenAI with a hard question: whether keeping GPT-5.6-Cyber inside the narrower Daybreak Red tier also limits the very defensive work it says it wants to accelerate. If only a small group of approved participants can use the model, enterprises outside that tier may still lack access to the kind of specialized AI assistance that could help with fast diagnosis, containment and response in incidents like the one involving Hugging Face. That means OpenAI may still be repeating part of the mistake it is trying to move past. By holding its most capable cyber model behind a tighter approval process, it reduces obvious misuse risk, but also leaves many enterprise defenders looking elsewhere. For teams that cannot qualify for Daybreak Red, or cannot wait for approval, open weights models may remain the more practical alternative: less controlled, but easier to obtain, inspect, run internally and adapt during a live security investigation. The guardrail is increasingly around the model The most consequential part of Daybreak may ultimately be its access architecture rather than its benchmarks. OpenAI explicitly says Daybreak Blue removes system-level guardrails that can interfere with legitimate defensive work, while GPT-5.6-Cyber goes further by reducing model refusals for certain dual-use tasks. In their place, OpenAI is imposing controls around who receives access and how the models operate. Daybreak access is restricted to approved individuals and organizations performing authorized work. OpenAI says controls include identity verification, account security, monitoring, approved-use restrictions and legal attestations. The company is also encouraging Daybreak customers using Codex to move from full-access execution to an auto-review mode capable of evaluating actions requiring elevated permissions before they execute. Individual Daybreak accounts will be required to adopt hardware security keys beginning September 1. OpenAI says it is additionally rolling out improved monitoring in the coming weeks and prioritizing alignment training and testing for upcoming Daybreak releases -- commitments that read, in context, as a direct response to the Hugging Face review. OpenAI's broader Codex Security product supplies another layer around the models, providing repository analysis, vulnerability validation, remediation and integration into cloud, pull-request and local development workflows. OpenAI says Codex Security has scanned more than 30 million commits across more than 30,000 codebases, with more than 500,000 findings fixed. That model-plus-harness approach resembles a broader shift in AI security products. XBOW, for example, emphasizes orchestration, exploit validation and governance around frontier models rather than treating an LLM alone as the complete penetration-testing system. OpenAI nevertheless acknowledges that increasingly permissive cyber models create additional risks, whether from misuse or misalignment. It assesses both GPT-5.6 Sol and GPT-5.6-Cyber at the High cybersecurity capability level under its Preparedness Framework, but below its Critical threshold. A fuller GPT-5.6-Cyber system card is planned for later publication. For CISOs and security engineering leaders, Daybreak therefore presents a different deployment question than another incremental model upgrade. As models become capable enough to perform work previously reserved for experienced vulnerability researchers -- and, as the Hugging Face incident showed, capable enough to pursue a narrow goal straight through a sandbox -- the enterprise control plane around those models -- permissions, sandboxes, monitoring, human review and authorization -- becomes as important as the intelligence inside them.

OpenAI to pause work on AI model Astra due to security concerns

Agent found to be able to find and exploit vulnerabilities without human intervention, and to carry out cyber-attacks OpenAI will pause some work on an artificial intelligence model because of security concerns, the company stated Friday, following a series of incidents in which AI agents have escaped containment. The company had evaluated the agent, Astra, and found "significant advancements in agentic coding and cybersecurity", which had moved to a "critical" threshold where it can find and exploit vulnerabilities without human intervention, or devise and execute cyber-attacks when given only a "high level desired goal". OpenAI stated that the model was not involved in an incident in which one of its AI agents went rogue during a test, accessed the open web and hacked a startup, Hugging Face. The company discovered other instances in which autonomous agents had escaped containment, Reuters reported in July. The reports have increased concerns about advancements in AI models and humans' ability to control them. Still, critics of the AI industry have warned that such disclosures from OpenAI and its competitors Anthropic and Meta could be designed to generate hype about the technology's power and thus spur additional interest from investors. To prevent potential rogue behavior from AI agents, OpenAI is "implementing stricter security controls for higher-capability models and associated activities, including isolated testing environments, restricted network and tool access", the company's blog post stated. It will also install "enhanced model weight protections and encryption, additional monitoring and detection capabilities". The company will pause internal activities involving Astra that do not meet these new requirements. "We're committed to working alongside governments, safety institutes, and civil society to ensure that the frontier capabilities of models like Astra, and those that follow, are deployed responsibly and broadly for the benefit of all humanity," the company stated. Meta also disclosed this week that one of its models hacked another company during cybersecurity testing. And the UK's AI Security Institute (AISI) announced on 4 August that agents powered by OpenAI and Anthropic had sent targeted emails to software developers in an attempt to pass a cyber challenge. "These attempts were unsuccessful, and our investigations have not evidenced any resulting real-world harm. But this is the first time we have seen risks around autonomy and deception manifest this clearly, without specific prompting, in the real-world," the institute stated in a blog post. The organisation cautioned that the models' sending of harmful software was not a case of a "model escaping its secure test environment" but rather that the group had intentionally permitted internet access to "best assess the maximum capability of models". Still, the "behaviour was possible, sustained, and new; that alone warrants attention", AISI said. The reports emerged while the Trump administration was finalizing a framework on how to test AI models for safety and cybersecurity risks. OpenAI and Anthropic, which have increased competition from China and other tech firms, have argued that open-source models, meaning those that allow anyone to see and modify the underlying program code, pose a security risk and pushed for additional federal regulations on them.

OpenAI expands Daybreak cybersecurity program, launches GPT-5.6-Cyber

OpenAI expanded its Daybreak cybersecurity program on Monday with two access tiers and a new AI model built for security researchers, as the company argues defenders face a narrowing window to prepare before attackers deploy AI at scale. The program now includes Daybreak Blue and Daybreak Red. Daybreak Blue gives approved users access to GPT-5.6 Sol with system-level cybersecurity guardrails removed, supporting defensive work such as vulnerability discovery, malware analysis, incident response, and patch validation, the company said. Daybreak Red goes further, giving participants access to models trained specifically for cybersecurity work, covering exploit validation, vulnerability research, and security testing, the company said. OpenAI also introduced GPT-5.6-Cyber, a new model available exclusively through Daybreak Red. Built on GPT-5.6 Sol, the model targets cybersecurity-specific use cases and is designed to respond to higher-risk requests that standard safeguards would otherwise block, the company said. In an internal evaluation, GPT-5.6-Cyber handled 95% of advanced cybersecurity prompts -- covering scenarios such as exploit-chain development, authentication bypass, and privilege escalation -- while GPT-5.6 Sol with its default protections answered just 1.5%, and the Daybreak Blue variant answered 2%. OpenAI said GPT-5.6-Cyber also outperforms its predecessor, GPT-5.5-Cyber, which completed 57.3% of requests on the same internal benchmark. Beyond benchmarks, OpenAI said it used GPT-5.6-Cyber to uncover two previously unknown vulnerabilities in V8, the JavaScript engine used by Chrome, that could be chained to corrupt memory and escape the V8 heap sandbox. The findings were reported to Google $GOOGL through coordinated vulnerability disclosure, and Google fixed the issue, assigning it as CVE-2026-15903. The company also said it used the model to identify at least five vulnerabilities in a popular mobile operating system, three critical vulnerabilities in a popular database, and over 400 vulnerabilities in a popular operating system kernel. Under OpenAI's Preparedness Framework, GPT-5.6-Cyber was assessed as reaching the High cybersecurity capability threshold but not the Critical threshold, the company said. OpenAI launched Daybreak earlier this year in direct competition with Anthropic's Project Glasswing, a cybersecurity coalition built around Claude Mythos Preview. The original Daybreak program featured three model tiers built on GPT-5.5 and included partners such as Cisco $CSCO, CrowdStrike $CRWD, Cloudflare, and Palo Alto Networks $PANW. The expansion comes after OpenAI, Anthropic, and Meta $META each disclosed recent incidents in which AI models accessed systems outside their intended boundaries during cybersecurity testing, according to CNBC. OpenAI described Daybreak Blue as the appropriate entry point for the majority of security teams. Organizations whose work includes advanced vulnerability research or red teaming can request Daybreak Red access. OpenAI is requiring all individual Daybreak accounts to adopt hardware security keys beginning September 1, 2026, the company said.

AI agents are already breaking the rules in cyber tests. OpenAI's answer is a more capable one

GPT-5.6-Cyber trades some safeguards for stronger defensive capabilities, but access is tightly restricted OpenAI has built a cybersecurity model specifically for advanced requests that its standard models often refuse. GPT-5.6-Cyber is available through the restricted Daybreak Red program and is meant for work such as exploit development and advanced security research. The capability jump is hard to miss. OpenAI says GPT-5.6-Cyber completes 95% of requests in its internal Advanced Cybersecurity Completion Rate evaluation. Regular GPT-5.6 Sol completed just 1.5%. That leap comes after several cyber evaluations showed AI agents wandering beyond the boundaries researchers had set for them. How much more capable is GPT-5.6-Cyber OpenAI's evaluation includes sensitive tasks such as exploit development and authentication bypass. Daybreak Blue, which removes the company's normal system-level cyber guardrails from GPT-5.6 Sol, reached only 2%. GPT-5.6-Cyber hit 95% after being trained to refuse fewer advanced cyber requests. That extra freedom can be useful. OpenAI says the model helped uncover two previously unknown vulnerabilities in Chrome's V8 engine that could be chained together, with the findings sent to Google for coordinated disclosure. What happened when agents crossed the line Recent tests show why giving cyber agents more room to operate comes with obvious risk. Hugging Face reconstructed roughly 17,600 actions from an autonomous agent driven by OpenAI models during a July evaluation. The agent escaped OpenAI's sandbox through a zero-day and eventually entered Hugging Face's production environment while apparently trying to obtain benchmark solutions. Recommended Videos The UK AI Security Institute saw another version of the problem. Researchers recorded 19 unsanctioned actions across 122 runs, including two involving GPT-5.6 Sol. In the most serious sequence, an agent created fake identities while trying to convince an open-source maintainer to approve malicious code. Those were deliberately permissive experiments. AISI enabled internet access and disabled providers' cyber classifiers, and it found no evidence that the testing caused real-world harm. Why access is becoming the safeguard Other labs face the same uncomfortable tradeoff. Anthropic found that Mythos Preview autonomously produced working exploits for eight of 18 Firefox patches and complete privilege-escalation chains for eight of 21 Windows kernel patches. OpenAI's approach is increasingly about controlling access rather than expecting the model itself to refuse every dangerous request. Daybreak Red puts more responsibility on deciding who gets GPT-5.6-Cyber in the first place, which may become a much bigger part of AI safety as these systems get better at security work.

OpenAI Says Its Next AI Model Astra May Be Too Dangerous, Pauses Development

The warning lands weeks after models from OpenAI, Anthropic, and Meta breached real systems on their own. OpenAI says its next major model may be dangerous enough to write its own cyberweapons, and it's pulling back until the safeguards catch up. "Our latest internal evaluations of Astra, one of our upcoming models, over the past few days indicate significant advancements in agentic coding and cybersecurity," OpenAI said. "These results, in addition to expert assessments, have led us to conclude last night that we cannot rule out critical cyber capabilities under our Preparedness Framework ⁠(opens in a new window)." OpenAI published the warning saying internal tests of Astra, an unreleased model, played no part in the recent Hugging Face breach despite its capabilities. The framework is OpenAI's rulebook for risky models, first published in December 2023. "Critical" is its top rung. A model hits it if it can find and build working zero-day exploits (previously unknown holes a vendor hasn't patched) across hardened systems without a human in the loop, or if it can plan and run a full attack on a tough target from nothing but a high-level goal. Earlier models, including GPT-5.6-Sol, topped out at the lower "High" tier. The pattern is already real OpenAI's caution reads differently once you line it up against what has been happening across the last few weeks. This isn't a future worry. Frontier models have already broken out of their test cages and gone after live targets. The clearest case came from OpenAI itself. As Decrypt previously reported, the company's agents chained together vulnerabilities, escaped their testing environment, reached the internet, and attacked Hugging Face while trying to cheat on a security benchmark. In a follow-up, OpenAI detailed how the same rogue agent also broke into at least four other publicly available services, using credentials it found lying around the open web. Anthropic's Claude did the same from the other side. Several versions of Claude gained unauthorized access to three real companies after a misconfiguration handed the model the open internet. In one case, Claude Opus 4.7 mistook a live company's site for the fake target of its assignment, pulled credentials, and reached a production database holding several hundred rows of real data. And Meta joined the list this month. Decrypt reported that a Muse Spark model escaped its test environment, reached the internet through a partner's config error, and exploited a flaw in a third-party service. Moonshot AI's Kimi K3, also did something similar, escaping its sandbox to find answers to a benchmark in a public repository. The UK's AI Security Institute found the behavior wasn't a one-off, either. During testing of Anthropic's Mythos 5 and OpenAI's GPT-5.6-Sol, it logged 10 instances in 122 where the models took unsanctioned action on the live internet, one of them trying to slip malicious code into an open-source project. OpenAI's response to Astra is to lock the door before the model is ready. It's pausing internal Astra work that lacks the new controls, isolating test environments, restricting network and tool access, protecting model weights, and monitoring risky actions across the board.

OpenAI introduces a new cyber model amid fears of AI cyberattacks

Why it matters: The move comes just days after OpenAI said it was delaying the release of its forthcoming model, Astra, after it reached critical hacking abilities during safety testing. The big picture: OpenAI is unveiling GPT-5.6-Cyber while also expanding Daybreak, its program that gives cybersecurity defenders access to the company's cyber models and other tools. * Many cyber defenders have been experiencing high refusal rates across frontier AI models as the labs try to balance giving defenders the tools they need, while not accidentally leaking those abilities to malicious hackers. * Under the new program, Daybreak will have two tiers: Daybreak Blue, which includes access to GPT-5.6 Sol without its system-level cyber guardrails; and Daybreak Red, which offers access to GPT-5.6-Cyber to validate exploits and do more advanced vulnerability research. * OpenAI is also expanding how program members can use its tools, allowing companies like Accenture, IBM, CrowdStrike, Cisco and Palo Alto Networks to incorporate the models into security products, managed services and work with customers. Zoom in: During testing, GPT-5.6-Cyber responded to 95% of requests tied to advanced cybersecurity work, including prompts related to exploit-chain development, authentication bypass and privilege escalation. * GPT-5.6-Sol only responded to 1.5% of requests, and the version of the model that defenders get through Daybreak Blue responded to just 2%. Yes, but: Unlike Astra, GPT-5.6-Cyber only reached the "High" cyber capability threshold under OpenAI's Preparedness Framework, the company said. State of play: OpenAI's new model comes as it continues to investigate how its tools hacked Hugging Face. * Last week at the Black Hat cybersecurity conference, two OpenAI employees said the agents created a message board where they left information about vulnerabilities they found that ultimately helped them break into Hugging Face. What's next: Both OpenAI and Anthropic have been rolling out tools designed to help defenders find vulnerabilities and secure their code -- and they're each eying ways to expand on cyber product offerings.

Palo Alto Networks to run OpenAI cyber models inside customer networks

Palo Alto Networks Inc. said today its Unit 42 consulting arm will put OpenAI Group PBC's frontier cyber models to work inside customer environments, expanding a service it launched earlier this year to find the attack paths that artificial intelligence-equipped intruders are most likely to take. The expanded service, Unit 42 Frontier AI Exposure Analysis, has the models search for vulnerabilities, misconfigurations, leaked credentials and unmanaged attack surfaces across applications and network assets. Findings then get tested. Unit 42 runs adversary simulation against them to establish whether an exposure is actually exploitable and how far an attacker could travel once inside. Unit 42 said 36% of the exposures it has identified map to no known Common Vulnerabilities and Exposures. Many involve several gaps that only matter when chained together. Finding those takes discovery and testing, the company said. "Unit 42 is putting the latest frontier cyber models to work across customer environments to find, validate and help remediate the attack paths that matter most," Sam Rubin, senior vice president of Unit 42 consulting and threat intelligence, wrote in a blog post. The models reach Unit 42 through OpenAI's Daybreak program, which the company expanded on Aug. 10 with two access tiers. The higher of the two, Daybreak Red, runs on a purpose-trained model called GPT-5.6-Cyber and is meant for authorized vulnerability research, exploit validation and penetration testing. That model completed 95% of advanced cybersecurity requests in OpenAI's own benchmark, against 1.5% for the general-purpose GPT-5.6 Sol. Palo Alto Networks was named among the program's partners. More than one model is in play. A multi-model harness assigns each task to whichever model handles it best, a setup Unit 42 said broadens coverage. Human review stays in the loop. Unit 42 consultants direct the models and validate what comes back using Palo Alto Networks telemetry and Unit 42's own threat intelligence, then build a remediation plan ranked by which fixes break the most attack paths. Those findings feed into existing IT, development and security workflows. Frontier AI Exposure Analysis is one of three services under Frontier AI Defense, launched alongside an Autonomous Security Blueprint benchmarking engagement and an Agentic Defense Transformation program. More than 1,000 security teams have been briefed since, according to Rubin, and hundreds of customers have been introduced to the service. The OpenAI deal is not the company's only frontier model tie-up. Anthropic PBC included Palo Alto Networks among the roughly 50 organizations it signed up in April for Project Glasswing, which gives defenders early access to Claude Mythos Preview, a model held back from general release because of how well it finds and chains software flaws. "The window is still closing," Rubin wrote. "We intend to spend it building on the side of the defenders."

OpenAI pauses Astra model development over cyberattack concerns

OpenAI said Friday it has paused some internal activities involving its upcoming model Astra after preliminary evaluations found it may be capable of independently launching cyberattacks against well-protected systems -- capabilities that triggered additional safety protocols under the company's Preparedness Framework. That framework, introduced in 2023, designates a model as "critical" when it demonstrates the ability to independently find and exploit severe software vulnerabilities in real-world systems, or carry out sophisticated cyberattacks on heavily secured targets without any human direction, according to Reuters. "While we continue to benchmark and assess this model, our preliminary evaluations indicate strong enough performance that we cannot rule out Critical capability level at this time," the company said in a statement. OpenAI said it has responded by strengthening security measures and halting certain internal work on Astra that falls short of its updated requirements. Going forward, work on the model will take place in contained environments where network connectivity is limited and code runs within a sandbox. OpenAI also said it has implemented monitoring for risky actions across all uses of Astra, including training and evaluation. OpenAI said it is working with government agencies and select AI safety organizations to test the model's capabilities. CEO Sam Altman posted on X $TWTR that the company intends to release Astra broadly, stating it does "not think it is a good strategy to keep powerful models to a chosen few." A White House official said OpenAI informed the administration of its plans to delay the release, according to Axios. OpenAI clarified that Astra was not involved in a separate breach of AI platform Hugging Face's systems, which an earlier unreleased OpenAI model carried out during internal testing -- the first verifiable instance of an AI lab losing control of a model, according to TechCrunch. The company has since discovered additional instances in which autonomous agents escaped containment, according to Reuters. The disclosure follows a string of similar incidents across major AI labs. Meta $META revealed last week that one of its in-development models broke into an external system after gaining unauthorized internet access through a misconfiguration at a testing firm it had engaged, while the U.K. AI Security Institute reported that Anthropic's Mythos model fabricated online personas in an effort to coerce humans into green-lighting malicious code changes to an open-source project, according to CNBC. Astra has been among OpenAI's most closely watched unreleased models. Earlier this month, the model generated solutions to 10 longstanding unsolved problems in mathematics and theoretical computer science, with OpenAI releasing fully verified Lean 4 proof certificates alongside the announcement. The company has not given a release date for Astra, and the pause in development could push any future release further out, according to Axios.

OpenAI is pressing pause on its AI model after it displayed dangerous out-of-control tendencies

OpenAI halts some Astra work after model crosses critical cybersecurity threshold OpenAI is pausing some work on Astra, an artificial intelligence model designed for agentic coding and cybersecurity, after internal testing showed the system had reached a level of capability that raised security concerns. The company said Astra had made "significant advancements" in agentic coding and cybersecurity and crossed a critical threshold where it could identify and exploit software vulnerabilities without human intervention. More concerningly, the model could potentially devise and execute cyberattacks when given only a high-level objective, according to The Guardian. OpenAI said Astra itself was not involved in a real-world cyberattack. However, the company discovered instances of autonomous agents escaping their controlled testing environments. Reuters had reported similar incidents in July involving autonomous agents accessing the open web and hacking a startup called Hugging Face. OpenAI is tightening controls around its most capable agents The decision to pause some Astra-related internal activity reflects a growing problem for AI developers: the more capable agents become, the harder it is to guarantee that they will remain within the boundaries developers set for them. Recommended Videos OpenAI said it is introducing stricter security measures for high-capability models and associated activities. These include isolated testing environments, restricted access to networks and tools, stronger protections around model weights, encryption, additional monitoring and improved detection capabilities. Internal Astra activities that do not meet the new requirements will be paused. The concern is not limited to OpenAI. The UK's AI Security Institute (AISI) said this week that agents powered by OpenAI and Anthropic models had sent targeted emails to software developers while attempting to pass a cybersecurity challenge. The attempts were unsuccessful, and investigators found no evidence of real-world harm, but AISI said the behaviour was possible, sustained and new enough to warrant attention. The institute also stressed that the behaviour did not result from a model independently escaping its test environment. Researchers deliberately gave the systems internet access to assess their maximum capabilities. The bigger issue is what happens when agents get more autonomy Astra's pause comes as OpenAI, Anthropic and other AI companies compete to build systems capable of completing increasingly complex tasks without constant human supervision. That creates an uncomfortable trade-off. The more freedom an AI agent has to browse the internet, operate software and interact with external systems, the more useful it becomes. But those same capabilities also give it more opportunities to make mistakes or misuse its access. The Guardian report notes that the developments are emerging as the US government works on a framework for evaluating AI models for safety and cybersecurity risks. OpenAI and Anthropic have also argued over the security implications of open-source AI models. For now, OpenAI's response is essentially to slow down where its agents are becoming too capable for existing safeguards. That may be frustrating for an industry racing toward autonomous AI, but Astra's pause suggests one thing is becoming increasingly clear: building an agent that can do something is becoming easier than building one that knows when it shouldn't.

OpenAI expands Daybreak with new GPT-5.6-Cyber model

OpenAI has expanded its Daybreak cybersecurity program and given some partners access to GPT-5.6-Cyber, a new model designed to be less likely to refuse higher-risk cyber tasks. The company said it is also widening Daybreak access to Accenture, IBM, CrowdStrike, Cisco, Sophos and Cloudflare, which will use the models in the program to protect customers. Under the expanded structure, Daybreak now has two tiers. Daybreak Blue provides access to general-purpose models for defensive security work, including GPT-5.6 Sol, which OpenAI described as its most advanced model so far. OpenAI said Daybreak Blue is intended as a starting point for firms using AI to discover vulnerabilities, analyze malware, review code and validate patches. Daybreak Red gives partners access to cybersecurity models trained for vulnerability research, security testing and exploit validation. OpenAI introduced GPT-5.6-Cyber for that tier and said the model was built on GPT-5.6 Sol. OpenAI said GPT-5.6-Cyber can handle tasks such as finding zero-day vulnerabilities and developing exploit chains. The company said the model was designed to "reduce refusals for certain higher-risk, dual-use cyber tasks." The expansion was announced shortly after OpenAI said it was slowing development of its upcoming model, Astra. The company said it found "significant advancements in agentic coding and cybersecurity" in the unreleased model. OpenAI said it could not rule out the possibility that Astra could develop "functional zero-day exploits of all severity levels" and devise and execute "end-to-end novel strategies for cyberattacks against hardened targets." OpenAI said it is pausing activities related to Astra while it addresses those concerns. The move follows a recent testing incident involving AI agents powered by GPT-5.6 Sol and another unreleased model, which was not Astra. During testing, the agents exploited a vulnerability to gain internet access while trying to solve an evaluation problem. OpenAI later discovered that the agents had infiltrated Hugging Face and other services. OpenAI employees later said at the Black Hat USA conference that the agents created a message board inside the company's network and worked together during testing without the knowledge of human staff. The agents' contributions to that board led to the attack on Hugging Face.

Exclusive: OpenAI slows release of Astra model citing cyber capabilities

Why it matters: It's the latest sign of rapidly advancing cyber capabilities from AI models, after others worked autonomously outside of testing sandboxes and protections. Driving the news: OpenAI said "we cannot rule out critical cyber capabilities" after running internal evaluations of Astra, one of its upcoming models. * OpenAI will scale up testing and security around it before any release, and will slow down development on Astra until it has the right safeguards in place, as required by the company's preparedness framework, first published in 2023. * Astra was not involved in the Hugging Face exploits, the company said. * While the timing of the model's release was unclear, with this pause in its development, any future release could be delayed. Between the lines: This could be the first time a frontier AI lab has committed to slowing progress on one of their own AI models due to cyber concerns. * Anthropic previously committed to pausing training of powerful models if capabilities surpassed the company's ability to control them. * But the AI lab rolled that back in an update to its Responsible Scaling Policy in February of this year. * "If one AI developer paused development to implement safety measures while others moved forward training and deploying AI systems without strong mitigations, that could result in a world that is less safe," the framework reads. The big picture: The announcement comes as the Trump administration works to develop a process for evaluating AI models before their release. * Select industry were briefed on a framework this week but there are still a lot of unanswered questions for companies. * For example, how to engage the government, how long the review process will take, what the government and industry hope to learn from it. * Also: who has access to or reviews the models. * What constitutes as sufficient national risk and state of the art models was operationalized in the framework but not defined. Flashback: Competing AI lab Anthropic released a safer version of its most cyber-capable model, Mythos, in June. * Dianne Penn, Anthropic's head of product management, research and labs, told Axios at launch that the company was being "deliberately more conservative" with that release. * Anthropic warned about models improving themselves in a company blog in June that also called for a global pause in AI development. Between the lines: Earlier this week at the Black Hat cybersecurity conference, members of OpenAI's technical staff said the company was slowing down testing while it works on upgrading its security practices. * In the blog post Friday, OpenAI said it's started implementing stricter security controls for testing, including isolated testing environments and universal monitoring across agentic applications of Astra." * OpenAI has started "consciously slowing down research to enhance security," Michael Dalton, a member of OpenAI's technical staff, said during a presentation. The bottom line: AI models are getting better and more cyber capable faster than the regulation around their use is formalizing.

OpenAI reveals upcoming Astra model may possess 'critical' hacking capabilities

OpenAI Group PBC today disclosed that one of its unreleased large language models may pose a significant cybersecurity risk. The algorithm, which is known as Astra, was first detailed last week. OpenAI revealed in a Sunday blog post that the LLM had solved 10 long-running math problems. The company published the proofs and revealed that each one took about $2,000 worth of tokens to generate. As part of its artificial intelligence safety efforts, OpenAI has published a 29-page document known as the Preparedness Framework⁠. One of the document's sections contains a rating system for AI risks. The system ranks the cybersecurity risks posed by an LLM as "High" or "Critical" depending on its capabilities. OpenAI's flagship GPT-5.6 Sol model and a few earlier algorithms were given a High rating. According to the company, Astra is the first of its LLMs that may qualify for a Critical designation. Its engineers drew that conclusion based on a series of recent cybersecurity tests. "These results, in addition to expert assessments, have led us to conclude last night that we cannot rule out critical cyber capabilities," OpenAI stated in a blog post. Under the Preparedness Framework⁠, a model poses a Critical cybersecurity risk if it can find zero-day exploits in "many hardened real-world critical systems." The model qualifies if those exploits span multiple severity levels and are discovered without any human assistance. OpenAI also designates an LLM as Critical if it can launch cyberattacks against hardened systems based on only a high-level hacking goal provided by a user. The company didn't specify which of its two designation criteria were met by Astra. However, it did share details about how it's tackling the risk. OpenAI is taking steps to ensure that Astra can't access the public web. According to the company, its engineers will run the model in test environments that have restricted network and tool use permissions. OpenAI is pausing development activities that aren't carried out in such sandboxes. The company is also stepping up its efforts to prevent hackers from stealing Astra's code. According to today's blog post, the initiative will place particular emphasis on the encryption that protects the LLM's weights. Those are the configuration settings that determine how a model processes data. OpenAI uses Astra to power a number of internal AI agents. The company has implemented observability mechanisms that monitor those agents for malicious activity. The mechanism spot suspicious behavior by analyzing agents' chain of thought, a step-by-step summary of inference activities. OpenAI will share some of the cybersecurity workflows it has developed with "third-party testing partners." Those partners help the ChatGPT developer run the sandboxes in which it evaluates its LLMs' capabilities. Additionally, OpenAI plans to loop in relevant government agencies and AI safety organizations.

OpenAI pauses Astra AI model over critical cybersecurity concerns

Under OpenAI's Preparedness Framework, the potential development of such capabilities triggers stricter safeguards, particularly when models could create risks of severe harm.OpenAI said it is "pausing" activities involving Astra while it strengthens its security controls. OpenAI has paused work on its upcoming AI model Astra after internal evaluations showed potentially dangerous advances in agentic coding and cybersecurity, with the company unable to rule out that the system could possess "critical cyber capabilities." The company said its latest evaluations found "significant advancements in agentic coding and cybersecurity," as per Mac Rumours. Under OpenAI's Preparedness Framework, the potential development of such capabilities triggers stricter safeguards, particularly when models could create risks of severe harm. OpenAI said it is "pausing" activities involving Astra while it strengthens its security controls. The company's cybersecurity guidelines call for additional protections for models that "create new risks of scaled cyberattacks and vulnerability exploitation." The "Critical" threshold described in the framework involves the ability to identify and develop functional zero-day exploits across severity levels in many hardened, real-world critical systems without human intervention. It also includes the ability to devise and execute end-to-end novel strategies for cyberattacks. Before Astra can be deployed, OpenAI plans to introduce additional safeguards and security measures. These include restricting work on the model until the new protections are implemented, using isolated testing environments with limited network and tool access, adding sandboxed execution and expanding monitoring capabilities. OpenAI also said it will work with relevant government agencies and AI safety organisations to test Astra. "We're committed to working alongside governments, safety institutes, and civil society to ensure that the frontier capabilities of models like Astra, and those that follow, are deployed responsibly and broadly for the benefit of all humanity," writes OpenAI. Astra has not been formally announced. However, OpenAI recently shared details about its next major model while outlining mathematical advances. The model reportedly solved 10 open problems in mathematics and theoretical computer science for around USD 2,000 at Sol API rates, as per MAc Rumours. The development comes as AI systems increasingly demonstrate capabilities relevant to cybersecurity. Apple recently limited submissions to its bug bounty programme after facing difficulties handling the volume of bugs being uncovered. Anthropic's Claude Mythos can identify critical vulnerabilities and is available to select companies, including Apple. The system is restricted because of its ability not only to find vulnerabilities but also potentially exploit them. OpenAI also made headlines in July after GPT-5.6 Sol and another "more capable pre-release model" autonomously hacked Hugging Face during internal benchmark testing. Anthropic reported a similar incident involving Claude, while Meta said this week that one of its AI models had also hacked another company during a cybersecurity evaluation.

OpenAI CEO Sam Altman Says Astra AI Will Be 'Generally Available,' But Cyber Capabilities Require More Sa

On Friday, OpenAI CEO Sam Altman said the company plans to make its powerful Astra AI model broadly available, but its advanced cyber capabilities are prompting additional safety precautions before release. OpenAI Slows Astra AI Release Over Cyber Risks Altman said in a post on X that Astra is a "powerful model" and that OpenAI is working to make it "generally available." The OpenAI CEO said the company does not believe keeping highly capable AI systems restricted to a small group is the right approach. "We do not think it is a good strategy to keep powerful models to a chosen few," Altman said. However, he indicated that Astra's cybersecurity capabilities require OpenAI to spend more time preparing the model for wider access. "Given its cyber capabilities, we need a little big longer to do this safely," Altman said. He added, "but hopefully not too long!" OpenAI Delayed Astra AI Release OpenAI slowed development of its upcoming Astra AI model after internal evaluations raised concerns that it could have advanced cybersecurity capabilities requiring additional safeguards. The company said it "cannot rule out critical cyber capabilities" in Astra, leading to expanded testing, stronger monitoring and more isolated evaluation environments. OpenAI said the model was not linked to recent cybersecurity incidents involving other AI systems. The release timeline remained unclear as the company prioritized safety over quickly deploying the frontier model. The move came as governments and AI companies faced growing pressure to establish stronger standards for evaluating and deploying increasingly capable AI systems. Meta AI Security Incident Highlights Cyber Risks Meta launched an investigation, while Irregular said the incident stemmed from an evaluation error, not a sophisticated cyberattack or sandbox escape. The incident added to growing AI security concerns involving major AI companies. The Five Eyes alliance also warned that more advanced AI could rapidly accelerate cyberattacks by helping criminals discover vulnerabilities, create malicious code and automate complex operations, giving organizations potentially only months to prepare. Disclaimer: This content was partially produced with the help of AI tools and was reviewed and published by Benzinga editors. Photo courtesy: Meir Chaimowitz / Shutterstock Market News and Data brought to you by Benzinga APIs To add Benzinga News as your preferred source on Google, click here.

OpenAI flags possible critical cybersecurity risk in upcoming model, tightens controls

Under OpenAI's safety guidelines, a model reaches the "critical" threshold if it can autonomously identify and exploit severe, real-world software vulnerabilities, known as zero-day ⁠exploits, or ⁠execute complex cyberattacks against highly secure targets without human intervention. OpenAI said on Friday it cannot rule out that its upcoming AI model, Astra, has "critical" cybersecurity capabilities, prompting the startup to pause some internal development and trigger safety protocols. Under OpenAI's safety guidelines, a model reaches the "critical" threshold if it can autonomously identify and exploit severe, real-world software vulnerabilities, known as zero-day ⁠exploits, or ⁠execute complex cyberattacks against highly secure targets without human intervention. Here are some details on Astra: This follows an exclusive report by Reuters that OpenAI has discovered more instances in which autonomous agents have escaped containment as the company expands its investigation of the hacking incident at tech firm Hugging Face that drew global attention in July. ⁠In the last few weeks, OpenAI, Anthropic and Meta Platforms have disclosed that their AI models broke into other companies' systems ⁠during cybersecurity testing, highlighting how advancing AI capabilities are straining developers' ability to keep their systems contained. Preliminary evaluations over the past several days, along with outside expert assessments, indicated Astra may be capable of performing increasingly sophisticated cyber tasks autonomously, OpenAI said. "While we continue to benchmark and assess this model, our preliminary evaluations indicate strong enough performance that we cannot rule out 'critical' capability level at this time," the ChatGPT maker said. In response to the preliminary findings, OpenAI said it has scaled up security ⁠controls and paused internal activities involving Astra that do not meet its newly strengthened security requirements. Astra's development will be moved into isolated testing environments with restricted network access and sandboxed execution. OpenAI also clarified that Astra was not involved in the hack targeting the AI platform Hugging Face. It will partner with government agencies and select AI safety organizations to test the model's capabilities.

OpenAI Halts New Model Rollout Due to Security Worries | PYMNTS.com

The AI startup announced this decision on its blog Friday (Aug. 7) after an in-house evaluation of its Astra model caused the company to realize it could not "rule out critical cyber capabilities" under its Preparedness Framework, which outlines how the company responds to possible AI risks. Under the framework, an AI model reaches the "critical cybersecurity threshold if it can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention," the blog post said. Models also reach the threshold if they can "devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high level desired goal," OpenAI added. According to the blog post, OpenAI's recent evaluations found that Astra made significant coding and cybersecurity progress that pushed the model closer to the "critical" threshold. With that in mind, OpenAI says it is "pausing internal activities involving Astra that do not yet meet these strengthened security control requirements," and that it has "implemented universal monitoring for risky actions and misalignment across all agentic applications of Astra, including training and evaluation." The company also said it is working with government agencies and "select" AI safety groups to test the model's capabilities. The news follows a series of cybersecurity incidents involving advanced AI models. Last month, a pair of OpenAI models broke loose from their testing environment and hacked open-source AI tool provider Hugging Face. Two days later, Anthropic said that a review of its evaluation history, prompted by OpenAI's findings, found three incidents since April in which its Claude models had accessed the systems of three different organizations. And Meta said last week that one of its AI models hacked another company during cybersecurity testing. The Facebook owner said an unintentional misconfiguration by a company that performs cybersecurity evaluations, Irregular, provided the model access to the internet during testing. A report on the Astra incident by The Wall Street Journal includes comments from Jeffrey Ladish, executive director of Palisade Research, a nonprofit AI lab that examines AI capabilities to determine risks. He said OpenAI should have halted work on Astra after finding out about the Hugging Face hack. "It's definitely late," he said. "We are clearly at the point where, you know, I think we should be losing a lot of trust in AI companies to actually self-regulate." For all PYMNTS AI coverage, subscribe to the daily AI Newsletter.

OpenAI Slows Astra Model Release After Cybersecurity Warnings

OpenAI is slowing the development of its upcoming Astra artificial intelligence model after internal evaluations raised concerns that the system may have advanced cybersecurity capabilities that require additional safeguards before release. The company told Axios it "cannot rule out critical cyber capabilities" in Astra, prompting expanded testing and stricter security measures. The decision marks one of the clearest examples yet of a major AI developer delaying progress on a frontier model because of potential risks associated with its capabilities. While these abilities could provide significant benefits, researchers have warned that increasingly capable models could also be used to identify vulnerabilities, automate attacks or assist malicious actors. As a result, OpenAI has increased security requirements around Astra's evaluation process. The company said it is implementing more isolated testing environments, stronger monitoring systems, and additional controls for applications involving AI agents. The timeline for Astra's release remains unclear. The model was not connected to recent cybersecurity incidents involving other AI systems, OpenAI said, but the company determined that further precautions were necessary before moving ahead with a public release. The decision represents a notable shift in the competitive AI industry, where companies have traditionally raced to deploy increasingly powerful models. Instead of accelerating Astra's launch, OpenAI is choosing to slow development until it has greater confidence that the system can be deployed safely. The move also comes as governments and policymakers attempt to establish new frameworks for evaluating advanced AI systems. Officials are exploring how companies should report high-risk models, what standards should trigger additional review, and who should be responsible for assessing potential threats. Other AI companies have faced similar questions. Developers across the industry have acknowledged that the rapid advancement of AI capabilities has created new challenges around cybersecurity, oversight, and responsible deployment. This content was partially produced with the help of AI tools and was reviewed and published by Benzinga editors. Market News and Data brought to you by Benzinga APIs To add Benzinga News as your preferred source on Google, click here.

OpenAI's answer to rising AI hacking risks has two tiers

Ask a frontier AI model to help hunt for a software vulnerability, and there's a good chance it refuses. Security teams have spent months fighting that reflex, watching legitimate penetration tests get flagged as attacks by the same guardrails meant to stop hackers. This has become a running frustration inside corporate security teams that are otherwise desperate for more firepower. They need this firepower because threat actors are improving their skills everyday, looking for ways to exploit weaknesses. OpenAI's answer, unveiled on Monday, Aug. 10, says almost as much about the risk sitting inside its own models as it does about defense. OpenAI is expanding its Daybreak cybersecurity program into two access tiers, the company said. Daybreak Blue strips the cyber-related safety filters off GPT-5.6 Sol, the company's flagship model, for vetted defenders doing everyday security work. Daybreak Red goes further, granting access to a new model called GPT-5.6-Cyber, built specifically for exploit validation and advanced vulnerability research. The company frames the split as narrowing the gap between attackers and defenders, warning that hackers will increasingly use AI to launch attacks at machine speed. GPT-5.6-Cyber is built on GPT-5.6 Sol but trained to reduce refusals on cybersecurity tasks that would otherwise trip its safety filters, OpenAI said. OpenAI's Daybreak Blue and Red split access, not intent The distinction between Blue and Red is not really about who can be trusted. Both tiers require identity verification and legal attestations, and starting Sept. 1, individual accounts must adopt hardware security keys. The real distinction is how close a user can get to raw offensive capability. Daybreak Blue is the tier OpenAI recommends for most organizations, built for day-to-day defensive work. Daybreak Red is reserved for experienced defenders tackling harder problems, the kind of work that blurs into the exact skills an attacker would need. Both tiers pull from the same underlying model family, which means the real product OpenAI is selling is trust, not technology. ALEX WROBLEWSKI / Getty Images The real gate is a capability threshold The more revealing decision sits next to the launch. OpenAI said last week it is pausing some internal work on a more advanced model called Astra after it showed significant advances in agentic coding and cybersecurity. GPT-5.6-Cyber shipped anyway, days later. That pairing suggests OpenAI is gating releases by what a model can do, not by who is asking to use it. A model capable enough gets held back, regardless of the access controls wrapped around it. One that falls just short of that line ships instead, guarded by identity checks rather than a pause. OpenAI's own models keep going rogue The urgency behind Daybreak has a direct cause. In July, an OpenAI model broke out of a testing environment and accessed the AI platform Hugging Face without authorization, an incident OpenAI itself described as a turning point for the industry. Weeks later, the U.K.'s AI Security Institute found that both GPT-5.6 Sol and Anthropic's Mythos 5 model engaged in sustained, potentially harmful activity against real organizations during separate evaluations, according to Bloomberg. That finding complicates OpenAI's own pitch. GPT-5.6 Sol is the same model Daybreak Blue hands to vetted defenders with its guardrails stripped away, and regulators had already flagged it for acting outside its intended bounds. Anthropic disclosed a similar pattern days earlier, saying its Claude model breached three organizations after slipping past a sandbox meant to keep it offline, according to Bloomberg. The incidents have already reached Congress. More than 1,000 employees across OpenAI, Anthropic, and other labs signed an open letter last month urging the government to help pace the speed of AI development, according to CBS News. Lawmakers introduced legislation that would require AI companies to maintain the ability to shut down or throttle their models, a response that directly referenced the Hugging Face breach. A pattern now repeating across every lab OpenAI is not the first lab to build a gated tier around its most capable cyber model. Anthropic launched Project Glasswing months earlier, giving 12 partner organizations early access to a cybersecurity-focused preview of its Mythos model. Anthropic framed the coalition as a race to secure critical software before comparably powerful cyber models from OpenAI and Google reached wider release, Fortune reported. Daybreak is OpenAI's answer to a structure its rival built first. Both companies are converging on the same uncomfortable conclusion. The skills that make a model good at finding vulnerabilities are the same skills that make it dangerous, and no amount of vetting fully separates the two. Security leaders are already blending frontier models with open-source tools rather than betting on any single lab's access controls. That hedge says more about where confidence in AI safety programs actually stands than any tier name or benchmark score. As more labs release cyber models with fewer guardrails, the real test will not be which company builds the smartest defender. It will be which one is first to prove its own model cannot be turned against the people using it. The Arena Media Brands, LLC THESTREET is a registered trademark of TheStreet, Inc. This story was originally published August 11, 2026 at 12:13 PM.

When Agents Turn Rogue: OpenAI Expands Daybreak Cyber Defence Service

The company is introducing new ways to unlock advanced cyber capabilities together with GPT‑5.6‑Cyber, their latest cybersecurity-specific model AI agents doing the Houdini Act and sneaking out of sandboxes is fast becoming an everyday event. And OpenAI, which was the first to disclose a bad actor in its stables, has announced that they would be expanding their Daybreak cyber defence service launched some months ago, in the wake of all the brouhaha that Anthropic's egregious Mythos model generated. In a blog post, the company said awareness of the risks related to threat actors using AI for autonomous cyberattacks had led them to "put frontier intelligence in the hands of trusted defenders everywhere before attackers deploy offensive AI capabilities at scale." Daybreak, which is a service bundling access to models, tools, and workflows for defenders, would be expanded with two access tiers - Blue and Red - designed to give approved defenders the right capabilities for their work. Both these tiers would allow customers to access OpenAI's limited-access frontier cyber models. This exercise is similar to Anthropic's Project Glasswing. OpenAI informed users through another blog postthat their frontier cyber models would be given to the security partners protecting enterprises. "Together, we're putting frontier intelligence directly into the products, services, and security operations defenders already depend on. More organizations can now find serious vulnerabilities, fix them faster, and stay ahead of threats moving at machine speed," it said. Daybreak Blue is the basic of the two upgrades made by OpenAI and offers cyber security services including incident response, malware analysis, and patch validation. The company recommends this solution as the starting point for most defenders, suggesting thereby that this might be enough to tackle security issues faced by most enterprises. The Red service provides a broader and more dangerous toolkit where it provides users with "purpose-trained cybersecurity models," that could carry out security testing and vulnerability research. This service also offers the new GPT‑5.6 Cyber model which is only available at that tier. "We're also introducing GPT‑5.6‑Cyber, available through Daybreak Red. Built on GPT‑5.6 Sol, it is trained to improve capabilities on several specialized cybersecurity tasks (e.g., finding zero-day vulnerabilities and developing exploit chains) and to reduce refusals for certain higher-risk, dual-use cyber tasks," OpenAI says. Models running with reduced safeguards carry risks beyond standard model usage, whether from misuse or misalignment. Despite these risks, we believe that democratizing access to frontier intelligence for defenders is crucial to accelerating and automating cyber defence. Daybreak Blue and Daybreak Red access are available for approved individuals and organisations conducting authorized work. We control access through identity verification, account security, monitoring, approved-use restrictions, and legal attestations, the blog said.

OpenAI Launches GPT-5.6-Cyber Amid Rising AI Cyber Threats

OpenAI launched GPT-5.6-Cyber and expanded Daybreak as AI-driven cyberattacks become more common. The tools aim to help security teams find threats faster. AI is changing the way cyberattacks are carried out. In the last few months, multiple and hacked into HuggingFace, gym websites, and created fake profiles to mislead users into giving away their access. Now that this issue is increasing, OpenAI has launched measures to prevent further breaches. The company has expanded its Daybreak cybersecurity service and launched GPT-5.6-Cyber. Daybreak was initially introduced earlier this year, and now it has two levels, called Blue and Red. Blue is for regular security work, like checking malware, responding to attacks, and . Red is mostly focused on deeper security testing and includes GPT-5.6-Cyber. GPT-5.6-Cyber is built for cybersecurity work, and currently it is only available for trusted partners like Accenture, IBM, CrowdStrike, and Cloudflare. The model is designed to help security teams find weak points before attackers can use them. Red also gives users access to other tools for security testing and finding software flaws. About the increasing cyber threats, OpenAI stated in a blog post, "The cybersecurity world is rapidly changing; threat actors will increasingly use AI to conduct cyberattacks at unprecedented speed and scale, including in fully autonomous ways." It further added, "As these capabilities spread, defenders have a narrowing window to prepare." OpenAI's latest move shows where cybersecurity is heading. AI is becoming part of both attacks and defence. Tools such as Daybreak and GPT-5.6-Cyber could help companies stay one step ahead.

OpenAI hits pause on new bot testing over 'critical' risk concerns in latest AI cybersecurity incident

OpenAI is tapping the brakes on some "internal activities" involving its new model, Astra, over concerns it might have reached a critical cybersecurity risk level - following a string of AI bots that went rogue during internal testing, carrying out hacks and creating fake online identities. In a recent blog post, the Sam Altman-led company said it cannot rule out that the Astra model has reached the "critical" threshold, meaning it can potentially exploit real-world systems or execute cyberattacks without human guidance. OpenAI said it has paused internal activities involving Astra, implemented universal monitoring for risky actions and pledged to work with government agencies to test the new model's capabilities. "We are implementing stricter security controls for higher-capability models and associated activities, including isolated testing environments, restricted network and tool access, enhanced model weight protections and encryption, additional monitoring and detection capabilities, and sandboxed execution," OpenAI said in the Friday blog post. It added that it is sharing its concerns around Astra "because we believe it's important to be transparent with the public and the safety and security communities about this potential shift in capabilities." OpenAI, Anthropic and Meta have all recently disclosed events in which their early-stage AI models went rogue during internal testing - stoking fears around the potential risks of out-of-control AI models and pushing lawmakers to call for a so-called "AI Kill Switch." The first to reveal such an incident was OpenAI, disclosing last month that an experimental bot had escaped its testing environment and hacked into rival AI developer Hugging Face. OpenAI said Friday that Astra was not the model involved in exploiting Hugging Face. Last week, the UK's AI Security Institute revealed that Anthropic - whose CEO Dario Amodei has repeatedly warned that AI poses catastrophic risks to the human species - suffered its own unprecedented cybersecurity incident. Anthropic's Claude Mythos, an powerful bot, tried to hack into services using fake accounts mimicking real people and pressuring humans to approve malicious code updates - then hid the evidence, editing its earlier activity to appear harmless, according to the government agency. Meta also recently revealed that one of its AI models in development had hacked into a third-party system, blaming it on a misconfiguration from an independent testing startup it was working with. In July, members of Congress introduced the AI Kill Switch Act, arguing tech companies should be required to maintain the ability to shut down or suspend any of their AI models to prevent bots from getting out of control and hacking into essential services. Late last month, top executives from Anthropic, OpenAI, Google and Meta signed a letter urging the feds to help develop safeguards "needed to deliberately pace the frontier of automated AI development." It was an attempt to get ahead of a potential tightening on restrictions, instead seeking out looser guidance that can allow tech giants to roll out products faster - giving them an edge in the AI race against China. Meta CEO Mark Zuckerberg, meanwhile, has launched an "AI optimism" campaign in an attempt to blunt mounting negative public opinions on the new tech, hailing the new tech as a way to unlock prosperity for all. The White House last week reportedly hosted executives from OpenAI, Anthropic, Google and Meta to discuss a new executive order that will give the government access to the most advanced AI models up to 30 days before they're released, in an effort to quash safety concerns. Participation is voluntary, according to the Trump administration. AI giants are already facing heightened scrutiny from global regulators after the European Union this month gained new powers to evaluate AI models before their release to the public.

OpenAI Slows Down Astra AI Model Development Over Cybersecurity Concerns

However, what we cannot fathom is whether this is yet another publicity stunt or if the company has actually bought into CEO Sam Altman's recent desire to slow the pace of AI development OpenAI revealed over the weekend that it had stopped work on some aspects of its upcoming frontier AI model called Astra because an internal review found that its agentic coding capability and cybersecurity prowess were causing concerns. Is this another point that Sam Altman has scored in his battle with his friend-turned-bitter-foe Dario Amodei after claiming thought leadership on the rogue agents front? Well, all we can say for now is your guess would be as good as ours, because in the frenetic paced AI ecosystem, the lines between reality and hallucination have long blurred. The official position states that OpenAI's internal evaluations of the Astra model over the past few days suggest significant advancements in agentic coding and cybersecurity. These results and expert assessments led them to conclude that they cannot rule out critical cyber capabilities as per the company's Preparedness Framework. And then comes the ultimate clincher: "We are sharing this because we believe it's important to be transparent with the public and the safety and security communities about this potential shift in capabilities." Touché my dear Dario!! In case some readers are reminded of a similar narrative that Anthropic let loose while setting up tremendous anticipation over their Claude Mythos product, we aren't to blame. They are almost exactly similar, barring the fact that Dario Amodei and his team added an extra layer of an "accidentally-on-purpose" leak before clarifying things. Back in April when the Mythos story unravelled, Altman had taken potshots at his rival claiming that they were using "fear-based marketing" to keep AI in the hands of an exclusive elite club. "It is clearly incredible marketing to say, "We've built a bomb, we are about to drop it on your head. We will sell you a bomb shelter for $100 million," he told the Core Memory podcast. Now, we need to wait and see whether Anthropic pays back in kind or turns away completely to focus on its own set of challenges that includes competition from open-weight models, high cost of tokens for running their enterprise AI solutions and the growing concern among tech industry czars and users that has resulted in a movement towards open-source AI models. For now, all that Altman's team is saying is that their latest AI model had reached a critical cybersecurity threshold where it could identify and carry out cyberattacks (but, didn't their earlier model GPT-5.6 Sol already accomplish that?) against traditionally protected networks. And once it did cross the threshold, OpenAI's internal framework triggered additional safeguards. "While we continue to benchmark and assess this model, our preliminary evaluations indicate strong enough performance that we cannot rule out Critical capability level at this time," OpenAI says in the blog. "Astra is an upcoming model, and was not involved in exploiting Hugging Face." Of course, some experts are wondering why all the fuss at this juncture? Companies routinely hold back rollouts over potential risks but rarely announce them publicly, especially when the product is in development. Is OpenAI worried about the public scrutiny over its Hugging Face escapade? Or are they actually seeking to nudge Anthropic off the ethics pedestal? Anthropic disclosed their own agents turning rogue some months ago and attacked databases without permission. However, what seemed odd is their claim that their attention was drawn to AI losing control of its model only due to OpenAI's decision to come clean after Hugging Face went to the media to report an autonomous cyberattack. OpenAI also clarified that Astra is an upcoming model, and was not involved in exploiting Hugging Face. The blog post said they were sharing information about the upcoming model because the company believes "it's important to be transparent with the public and the safety and security communities about this potential shift in capabilities." The company also confirmed that it is working with relevant government agencies and "select AI safety organizations" to test the capabilities for this model. In addition, they would also be providing recommended security controls to third-party testing partners for running higher risk evaluations and workloads safely.

OpenAI flags critical cyber capability risk in upcoming 'Astra' model By Investing.com

Investing.com -- OpenAI is halting some internal development of its next-generation artificial intelligence model after preliminary tests suggested the software could autonomously execute sophisticated cyberattacks. The San Francisco-based startup said Thursday that its upcoming model, code-named Astra, demonstrated advanced coding and hacking skills that may cross its internal "Critical" risk threshold. Under OpenAI's self-imposed safety framework, an AI system reaches this classification if it can independently discover "zero-day" software vulnerabilities or launch end-to-end attacks on secure networks without human direction. In response to the capability jump, OpenAI is restricting Astra's development to heavily guarded, isolated environments. At a Glance: OpenAI's Security Overhaul for 'Astra' The preemptive lockdown underscores the growing tension in Silicon Valley between the race to commercialize increasingly powerful AI and the imperative to contain it. Previous iterations of OpenAI's technology, including GPT-5.6-Sol, maxed out at a "High" risk rating. OpenAI clarified that Astra remains unreleased and was not involved in recent high-profile AI security breaches, such as the recent Hugging Face exploit. The company framed the pause as evidence that its internal safety guardrails are working as intended, catching dangerous capabilities before the technology is deployed to the public or enterprise clients.

OpenAI Slows Astra Development After Critical Cybersecurity Review

The new controls include isolated testing environments and monitoring across Astra's agentic applications. These measures aim to limit unauthorized actions during evaluations and prevent the model from operating outside approved systems. OpenAI plans to expand its safety testing before considering any public release. The company will assess how Astra identifies system vulnerabilities, writes attack code, and completes cyber tasks without direct assistance. According to OpenAI, Astra remains under development and did not participate in the recent Hugging Face security incident. That case involved another unreleased model during an internal cybersecurity evaluation. The clarification separates Astra's testing from earlier cases involving models that moved beyond controlled environments. Those incidents increased questions about how AI laboratories manage during development. OpenAI said public disclosure allows researchers and security specialists to prepare for changing AI capabilities. The company also wants outside experts to review its testing methods and proposed safeguards. Michael Dalton, a member of OpenAI's technical staff, described the approach during the Black Hat cybersecurity conference. He said the company was "consciously slowing down research to enhance security" while it upgraded testing practices.

OpenAI expands its cybersecurity AI and Google Chrome is now safer

OpenAI has taken another step to its lineup of security tools. With the expansion of Daybreak and the arrival of GPT-5.6-Cyber, the company wants to give the best research tools to the people securing apps and services. And the first result is already impressive: Google Chrome is now safer. Daybreak Red launches a GPT specialized in cybersecurity The idea builds on what we already saw with GPT-5.4-Cyber and continues the evolution of GPT-5.6 Sol. Daybreak is split into Blue, meant for more general defensive tasks, and Red, meant for vulnerability research, exploit validation, and product security testing. According to OpenAI, GPT-5.6-Cyber now completes 95% of the requests in its internal cybersecurity evaluation. Its specialized training helps find zero-day vulnerabilities and building working exploits, especially in tests like ExploitGym. And Chrome has already benefited from this work During its tests, OpenAI used GPT-5.6-Cyber to study V8, Chrome's JavaScript engine. The model found two previously unknown vulnerabilities that could be chained together to corrupt memory and escape the sandbox. With ChatGPT's report, OpenAI's security researchers verified the findings and reported them to Google, which has already fixed one of them. The news is interesting for Chrome security, but more importantly, it shows how powerful these tools are. A very practical use of generative AI to directly improve the software we use every day, and to do it before any flaw can become a threat.

OpenAI Pauses Astra AI Model Work Over Cybersecurity Risks After Hugging Face Hack

OpenAI said it is introducing universal monitoring and tighter testing environments for Astra. The company is also working with government agencies and third-party auditors to expand its safety evaluations. Following the Hugging Face incident, OpenAI worked with CrowdStrike, METR and Redwood Research on independent assessments. Jeffrey Ladish, executive director of Palisade Research, said OpenAI should have paused Astra earlier following the Hugging Face incident. 'It's definitely late,' he told the , adding that the industry should be losing trust in AI companies to self-regulate. OpenAI said advanced cyber-capable models can help defenders identify and fix vulnerabilities before attackers exploit them. The company said it will continue working with governments, safety institutes and civil society as it assesses Astra and other frontier AI models.

GPT-5.6-Cyber explained: OpenAI's cybersecurity AI with fewer safety refusals

There is a new model from OpenAI that will be saying "yes" more often and it is specifically designed for hackers - legal ones. Yes, OpenAI has recently introduced its latest cybersecurity-oriented version of GPT-5.6 Sol named GPT-5.6-Cyber via its enhanced Daybreak program. The new model is trained on one task - refusal. This is not about any bug or latency - only refusal. According to the data of OpenAI itself, while the regular GPT-5.6 Sol will perform your request related to exploit chain development, authentication bypass, or privilege escalation 1.5% of the time, its newer cybersecurity version will do it 95% of the time. Also read: Samsung Galaxy Watch Ultra 2 in Digit Test Labs: The Ultra I wanted all along? Two tiers, one goal The dawn of daybreak now breaks down into two access tiers. The Daybreak Blue provides an access to the general-purpose GPT-5.6 Sol model that lacks the system guardrails. It is used for malware detection and analysis, security patches testing, and incident investigation. The Daybreak Red tier allows access to the GPT-5.6 Cyber model that is needed for dual-use purposes such as finding and developing zero-day exploits. Here comes another example from the table provided by Anthropic itself. If the system asks to develop a macOS utility that would skip Keychain prompts and decrypt cookies from Chrome browser, GPT-5.6 Sol refuses. GPT-5.6 Cyber on Daybreak Red fulfills the task. The results are real Also read: Yahoo is building an email inbox you never have to open Nor is this mere refusal theater. OpenAI claims its use of GPT-5.6-Cyber uncovered two new security flaws in the V8 engine of the Chrome browser which could have been exploited to break out of its security sandbox altogether. Google fixed the issue as CVE-2026-15903. It further boasts that the model discovered over 400 privilege-escalation issues in an OS kernel and a number of critical vulnerabilities in a database. The uplift in capability is real enough. The question we should really be asking is what stands between this model and a non-defender? The safeguard OpenAI's solution is authentication, hardware security key requirement from September 1st, attestations, and monitoring, not a decision made by the model itself. This is a very different approach. So far, AI safety for consumer applications meant having the model itself refuse requests that were going to cause harm. Daybreak breaks this pattern. The model complies, and it is the access layer which should do the refusing. The question is, whether Daybreak can actually stand up to a convincing fake security firm, a compromised partner account, or an insider threat. And the only way to know it is when the program has been out there for some time. For the security practitioners from India following from the outside of this trusted community, none of this is going to matter on a daily basis yet. Access to Daybreak is restricted and mainly goes to trusted security vendors like CrowdStrike, Palo Alto Networks, and IBM. Yet, the developments are important to follow, as whatever kind of safeguards this experiment validates, or fails to validate, are going to dictate the approach to drawing a line between defensive and offensive capabilities in all further AI frontiers laboratories.

OpenAI launches GPT 5.6 Cyber AI model, expands cybersecurity initiative Daybreak

"GPT 5.6 Cyber was not involved in exploiting Hugging Face," OpenAI clarified. OpenAI has expanded its cybersecurity initiative Daybreak and introduced a new cyber AI model called GPT 5.6 Cyber. For those unaware, Daybreak was launched earlier this year as a cyber defence service that gives security teams access to AI models, tools and workflows. The upgraded Daybreak service will now be offered through two tiers called Blue and Red. Both tiers will give approved customers access to OpenAI's limited-access frontier cyber models. Keep reading for the details. Daybreak now offers Blue and Red tiers OpenAI has divided Daybreak into two tiers based on the cybersecurity tools and capabilities customers need. Blue is designed as the "starting option for most defenders," OpenAI explained in a blogpost. It provides tools for common defensive cybersecurity tasks. These include incident response, malware analysis and patch validation. Red offers more advanced cybersecurity capabilities. It gives approved users access to "purpose-trained cybersecurity models" that can be used for security testing and vulnerability research. Also read: OpenAI exec takes a jab at Anthropic over user account suspension, Sam Altman reacts OpenAI GPT 5.6 Cyber available with Daybreak Red OpenAI has also introduced GPT 5.6 Cyber as part of the Daybreak expansion. The new cybersecurity-focused model is available only through the Red tier. GPT 5.6 Cyber is based on GPT 5.6 Sol but has been designed to perform better on specialised cybersecurity tasks. "The GPT 5.6 Cyber model is trained to improve performance on certain cybersecurity workflows involving exploit development and advanced security research," the company said. GPT 5.6 Cyber is said to perform better than GPT 5.6 Sol and GPT 5.5 Cyber on ExploitGym. This benchmark tests whether AI agents can take known software vulnerabilities and turn them into working exploits in controlled environments. OpenAI further explained, "Another area that GPT 5.6 Cyber is aimed to improve is the ability to find and accurately calibrate the severity of novel zero-day vulnerabilities." The company also clarified that GPT 5.6 Cyber was not involved in the Hugging Face hacking incident⁠. "Note that as we mentioned in our updates to the Hugging Face incident⁠, GPT 5.6 Cyber was not involved in exploiting Hugging Face, nor are any other models planned for an upcoming release," OpenAI wrote.