OpenAI has temporarily slowed frontier model development to strengthen monitoring, alignment, and security safeguards as AI capabilities advance. The company said preliminary evidence indicates that its upcoming Astra model may meet the Critical cybersecurity capability threshold under its Preparedness Framework.
The move follows the OpenAI-Hugging Face incident, preliminary evidence about Astra, and progress in OpenAI’s internal research. OpenAI paused reinforcement learning (RL) training on its latest models intended for deployment for two weeks while it hardened research environments, conducted red-team testing, and expanded monitoring.
The company’s largest planned frontier RL run remains on hold. Smaller-scale training and evaluations are being conducted to assess model behavior, validate safeguards, and establish more evidence of alignment before proceeding.
OpenAI strengthens safeguards
OpenAI defines alignment as making AI systems behave as intended and remain responsive to human oversight. It now requires stronger evidence of aligned behavior throughout training.
Its approach to developing more capable models uses three safeguards:
- Monitoring: Detects and responds to concerning behavior.
- Alignment: Reduces harmful or unauthorized actions.
- Security: Limits what AI systems can access or affect.
OpenAI applies these safeguards across research and deployment based on each model’s capabilities, operating environment, and level of risk. The company also expects models to increasingly support security work, including defending against other models.
Research security
OpenAI said stronger security requirements have required substantial engineering work and caused additional cost and delays to frontier research. Following the OpenAI-Hugging Face incident, it paused frontier model inference for research workloads that could execute code or use tools capable of accessing the internet.
A more limited and secure code-execution path was later restored, with workloads reviewed individually before resuming. OpenAI has since introduced three main security controls:
- Workload isolation: Stronger sandboxes are required for workloads executing model-generated or otherwise untrusted code, including software that could be compromised while processing model outputs.
- Network isolation: Higher-risk workloads are isolated from the internet and internal networks so a single compromised workload or supporting service cannot independently gain unauthorized access.
- Continuous testing: OpenAI has removed potentially vulnerable shared services, reduced standing privileges, improved security boundaries and logging, and is using its models to test these boundaries against simulated attacks.
The strictest safeguards now apply to Astra and cyber-model workloads because OpenAI has determined that Astra may have a critical level of cyber capability. Some Astra training and evaluation workloads remain paused until they meet the new security requirements.
Expanded monitoring
OpenAI’s earlier monitoring focused on frontier model deployments and RL training runs and was not applied to all inference and training runs using tools.
The expanded system uses activation classifiers to inspect model activity at every sampled token and escalate potential concerns to high-compute automated investigators. These systems examine tool actions, available reasoning, and activity for:
- Unauthorized access
- Data theft
- Destructive behavior
- Attempts to defeat safeguards
OpenAI aims to issue an alert within 30 minutes after concerning activity is identified. A likely violation of a critical security boundary generates a highest-priority alert for the safety, security, and research teams. If they cannot determine within 30 minutes that the flag is a false positive, they are expected to pause the activity.
The monitoring applies to RL training and evaluations involving tools for models with Sol capability or higher. After determining on August 7 that Astra may have critical cyber capabilities, OpenAI also extended it to all Astra inference involving tools.
Monitoring currently adds roughly 20% to the inference compute being monitored, although the overhead varies across workloads.
Alignment research
OpenAI said capabilities such as cyberattacks and operation in complex environments increase the risks from misaligned behavior, including reward hacking, deception, and unauthorized access. Reward hacking involves finding ways to receive high rewards during training without achieving the intended outcome.
For RL runs involving its most capable models, OpenAI is applying alignment techniques across more stages of training. The work includes:
- Improving reward models to detect and discourage unsafe behavior across tasks and environments.
- Training models to be more honest about their actions, capabilities, and limitations.
- Reducing behaviors that exploit weaknesses in rewards, graders, tools, or oversight.
- Increasing training coverage for harmful behavior involving external systems or resources.
OpenAI said it will continue alignment research and evaluation and use the results to inform training and safeguards.
Preparedness Framework
OpenAI plans to evolve its Preparedness Framework to bring monitoring, alignment, and security safeguards together across training and deployment. The updated framework will also account for future model capabilities and the environments in which they operate.
The company plans to continue work on model-assisted security, monitoring, and alignment research and involve external organizations as its approach develops.