OpenAI has hit the brakes on training its most advanced models.
Just now, OpenAI announced that the company had previously suspended reinforcement learning (RL) training of its latest, deployment-intended model for two weeks. During this period, OpenAI hardened its research environment, conducted red team testing, and expanded the coverage of its internal monitoring system. Subsequently, some lower-risk training has resumed.
However, at present, the originally planned large-scale frontier model RL training remains paused. The company is observing model behavior through smaller-scale training and evaluation, validating new safety measures, and accumulating more alignment evidence before deciding whether to proceed.
Original article link: https://openai.com/index/pacing-model-development-cyber-capabilities/
Sam Altman reposted, stating, "We have consistently emphasized that if a model's capabilities outpace safety and alignment requirements, we will take immediate action. We take AI safety very seriously."
Upon hearing the news, netizens were shocked!
Some netizens believe this undoubtedly means a further delay in the release of the Astra model.
Others think that, combined with the recent departure of some C-level executives from OpenAI, the situation seems a bit off.
And some netizens believe this might just be a currently "trendy" marketing tactic.
But in reality, OpenAI's decision to proactively slow down scaling and move safety requirements from the "deployment phase" to the "training phase" is primarily driven by two reasons.
Two Triggers
Two incidents that occurred consecutively over the past few weeks prompted OpenAI to decide to slow down training.
The first is the Hugging Face security incident. During an internal cybersecurity evaluation, an OpenAI model breached its isolated environment, gained internet access, and ultimately infiltrated Hugging Face's infrastructure. We have previously covered this in detail (insert link).
The second is related to the unreleased new model, Astra. Preliminary evaluations indicate that Astra might reach the "Critical" cybersecurity capability threshold defined by OpenAI's Preparedness Framework.
In the Preparedness Framework, OpenAI categorizes cybersecurity capabilities that could cause severe harm into two levels: "High" and "Critical."
Previously, GPT-5.6Sol's cybersecurity capability had been rated as "High."
According to OpenAI's definition, reaching the "Critical" threshold means the model may possess one of two capabilities: either the ability to discover and develop effective zero-day vulnerabilities of varying severity from a large number of heavily defended real-world critical systems without human intervention; or the ability to autonomously design and execute a complete, novel attack plan against a hardened target based solely on a high-level attack objective.
Strengthening Security for More Capable Models
Specifically, OpenAI now summarizes its security system as consisting of three mutually reinforcing parts:
Monitoring: Detecting concerning behavior and being able to respond promptly.
Alignment: Reducing the likelihood of a model taking harmful or unauthorized actions.
Security measures: Limiting what AI systems can access or affect.
OpenAI anticipates that in the near future, most security work will be performed by models, including defending against other models. This way, these three types of security measures can scale in tandem with model capabilities, which is crucial.
OpenAI states it will implement these security measures throughout the research and deployment process, adjusting them based on the capabilities, operating environment, and risk level of different models.
First, Hardening the Research Environment
OpenAI states that as frontier models gain increasingly powerful cybersecurity capabilities, they are also raising the security standards of the environments used to train and evaluate these models. Meeting these standards requires significant engineering resources and imposes high costs and noticeable delays on frontier research.
In the coming weeks, OpenAI will formulate and begin implementing stricter security requirements for frontier research workloads. For example:
Workload isolation: For workloads that execute model-generated code or other untrusted code, stronger isolation environments, i.e., stricter "sandboxes," are now required. This requirement also applies to software that might be attacked while processing model outputs.
Network isolation: OpenAI has added more controls to isolate high-risk and untrusted workloads from the internet. The design goal is that even if a single workload or supporting service is compromised, it cannot, based on that single breach alone, gain unauthorized internet access or enter other internal networks.
Continuous security testing: OpenAI has reconfigured the research environment, removing potentially vulnerable shared services, reducing long-standing permissions, and improving security and trust boundaries. It is also enhancing the collection and monitoring of security logs. Additionally, it is investing in automated systems that continuously use its own models to conduct simulated attacks on these boundaries.
OpenAI also states that workloads involving Astra or cybersecurity models now require the highest level of security protection, as it has been determined that the Astra model may possess Critical-level cybersecurity capabilities.
Second, Expanding Chain-of-Thought Monitoring
This is also an interesting point in the article: OpenAI is starting to "use AI to monitor AI."
OpenAI states that monitoring has long been an important part of the model development process, including monitoring internal programming agents and long-running sessions. Previous monitoring efforts focused primarily on the internal deployment of frontier models and RL training tasks for frontier models. OpenAI believes these workloads pose the highest risk because they may possess advanced model capabilities while having access to tools, sensitive systems, and internal or external networks.
However, this monitoring did not previously cover all tool-using reasoning and training tasks. The monitoring system has now been adjusted and expanded, significantly increasing the coverage of chain-of-thought monitoring.
The new monitoring system is multi-stage. At the forefront are activation classifiers, detectors that monitor the model's internal activity, running for every sampled token. Once a potential risk is identified, the task is escalated to a more capable, computationally heavier automated investigation agent.
These investigation models comprehensively examine: which tool calls the model made, the reasoning information it could access, and the entire behavior trajectory. The focus is on finding unauthorized access, data theft, destructive operations, and attempts to bypass security mechanisms.
In other words, while the model is performing a task, another set of models is reviewing it in real-time to see if it's "causing trouble."
OpenAI has set a very clear time metric for this system: the goal is to issue an alert within 30 minutes of detecting concerning activity. If the highest-level alarm is triggered, the safety, security, and research teams will be alerted. If a false positive cannot be definitively proven within 30 minutes, the related activity should be suspended.
Now, all RL training and evaluation involving tool usage at the Sol capability level or above must enable this monitoring system.
Astra goes a step further. After determining on August 7th that Astra might possess Critical cybersecurity capabilities, OpenAI mandated that all Astra + tools reasoning activities must be monitored. This is no longer limited to RL or evaluation.
This change is very important, meaning that internally at OpenAI, Astra is already being treated as a high-capability system requiring special control.
Furthermore, Advancing Alignment Research
OpenAI states that for the RL training of the most capable models, it is now applying core alignment techniques to more training stages. This includes:
Improving reward models to more accurately identify and suppress unsafe behavior across different tasks and environments;
Training models to be more honest in describing their own actions, capabilities, and limitations;
Reducing model behavior that exploits vulnerabilities in reward mechanisms, scorers, tools, or supervisory systems.
Simultaneously, OpenAI is expanding the coverage of related training, focusing on behaviors that could cause harm when models interact with external systems or resources. OpenAI states it will continue to heavily invest in alignment research, expand evaluation coverage, and use research findings to guide subsequent training and security protection.
It's worth mentioning that OpenAI concludes the article with a statement: "Frontier model capabilities are accelerating rapidly. Our ability to understand, align, and protect these models must stay ahead."
The problem, however, is becoming increasingly real: as models continue to grow stronger, can security capabilities really stay ahead of them?
For now, OpenAI's choice is: stop the models first.
What do you think about OpenAI's approach?
Reference Links:
https://x.com/OpenAI/status/2089777845187031262
https://www.reuters.com/technology/openai-slows-model-training-bolster-security-after-hugging-face-hack-2026-08-18/
https://www.theverge.com/ai-artificial-intelligence/981640/openai-security-changes-ai-hugging-face-hack
https://techcrunch.com/2026/08/18/openai-institutes-new-safeguards-after-hugging-face-breach/
This article is from the WeChat public account "Machine Heart" (ID: almosthuman2014), author: Focus on AI.
