In its pre-launch account of Astra development, OpenAI said it slowed frontier research after internal evaluations indicated that the model might meet the "critical cybersecurity capability" threshold outlined in its Preparedness Framework. Coupled with a recent internal security incident involving Hugging Face, the finding led the organization to enact a two-week pause on reinforcement learning (RL) training for models slated for deployment. At the time of that account, its largest planned frontier RL training run remained on hold while smaller runs evaluated model behavior and containment measures.

The slowdown reflects the practical friction labs encounter as pre-deployment capabilities approach safety tripwires. OpenAI stated that it halted frontier inference runs that could run code or access external networks through tools immediately following the Hugging Face event. While a more restricted execution path was quickly re-established, the company now requires strict workload and network sandboxing before research workloads can resume. Higher-risk workloads are isolated from the internet so that the compromise of a single task or service cannot expose internal networks. OpenAI reported that a significant number of Astra workloads remain paused pending migration into these secured environments, with priority given to safety and alignment jobs.

To watch for unauthorized behavior during execution, OpenAI implemented a multistage monitoring stack across research clusters. The pipeline is mandatory for all tool-assisted RL training and evaluations for models of Sol capability or higher, and was expanded on August 7 to cover all tool-enabled inference for Astra:

  • Token-level activation screening: Dedicated classifiers inspect the model's internal activity at every sampled token.
  • Automated escalation: If initial screening detects anomalies, higher-compute automated evaluators review tool actions, available reasoning traces, and broader execution sequences for destructive commands, data exfiltration, unauthorized network access, or attempts to bypass safeguards.
  • Operational response: If potential boundary violations surface, the system aims to alert staff within 30 minutes. Paged security, safety, and research teams are expected to pause the workload if they cannot confirm the flag is a false positive within that half-hour window.

The monitoring adds compute costs. OpenAI estimated that the monitoring setup introduces an overhead of roughly 20% on top of the monitored inference compute, though actual costs vary across workloads.

Alongside environmental sandboxing and monitoring, OpenAI stated it is widening alignment training during RL to suppress reward hacking, deceptive responses, and grader exploitation when models interact with external tools and systems.