Astra Cyber Risk Prompts a Slowdown in Frontier AI Training

Two recent warning signs have pushed the organization to reconsider how quickly it develops its most capable AI systems. One was the OpenAI–Hugging Face incident; the other was early evidence that an upcoming model called Astra could cross the “Critical” cybersecurity threshold in the organization’s Preparedness Framework. In simple terms, this means the model may become capable enough in cybersecurity that testing it inside ordinary research infrastructure would create serious risks. The organization therefore decided that its safety systems must improve before its largest experiments can continue.

The immediate response was to slow down model scaling and pause reinforcement-learning training for deployment-focused frontier models for two weeks. Reinforcement learning is the stage in which a model is repeatedly tested and adjusted to encourage useful behavior and discourage undesirable responses. The largest planned frontier reinforcement-learning run remains suspended. Instead, researchers are conducting smaller training runs and evaluations to study model behavior, test protective measures, and gather stronger evidence that the system will remain responsive to human control.

The revised approach is built around three safeguards that are meant to support one another. Monitoring should identify suspicious or dangerous behavior early enough for people to respond. Alignment work should reduce the chance that a model performs harmful, unintended, or unauthorized actions. Security controls should restrict what the model can reach, execute, or change. The central idea is that more capable models cannot simply be placed inside the same environments used for weaker systems; the surrounding controls must become stronger at least as quickly as the models do.

Following the OpenAI–Hugging Face incident, frontier-model inference was paused in research clusters whenever a workload could execute code or use tools with internet access. A narrower and more secure route for code execution was restored relatively quickly, but workloads were then reviewed individually. Some could resume under the new rules, while others needed further engineering changes. The organization says this work has been expensive and has delayed frontier research, but considers those costs necessary as cyber capabilities increase.

The new requirements include stronger sandboxing for model-generated or otherwise untrusted code. Sandboxes are isolated environments designed to prevent a faulty or hostile program from reaching the rest of a system. Higher-risk workloads are also being separated from the internet through multiple layers of network controls, so compromising one workload or supporting service should not automatically provide access to external or internal networks.

Shared services that could create common points of failure are being removed or reconfigured, permanent privileges are being reduced, and boundaries between trusted and untrusted systems are being strengthened. Security logging and monitoring are also being expanded. The organization plans to use its own models to test these boundaries continuously with simulated attacks, reflecting its expectation that AI systems will eventually perform much of both offensive security testing and defensive work. Astra and other cyber-related workloads now receive the strictest protections because Astra may already possess critical-level cyber capabilities. Some Astra training and evaluation tasks satisfy these standards, but the source indicates that many workloads still require additional changes.