"Pacing model development in an era of cyber-critical capabilities" is a publication by OpenAI dated August 18, 2026. It sets out the changes the company made to its research processes and infrastructure after two developments: the OpenAI–Hugging Face incident, and preliminary evidence that its upcoming Astra model "may meet the Critical cybersecurity capability threshold" under the Preparedness Framework (Source: openai.com). It is a first-party account by the company whose practices it describes; the underlying evaluation results are not published, and OpenAI states that a technical report of its learnings from the incident will follow.
The stated slowdown
OpenAI writes that "we temporarily slowed the pace of scaling." The measures named are a two-week pause in reinforcement-learning training on "our latest models intended for deployment" while the company "further hardened and red-teamed our research environments and expanded the coverage of our monitoring systems," and a continuing hold on the largest planned frontier RL run "while we conduct smaller-scale training and evaluations to assess model behavior, validate our safeguards, and establish more evidence of alignment before proceeding."
The publication describes the models involved only as "our latest models intended for deployment." TIME reported the same day, citing executives, that the paused runs were those codenamed Astra, and that company leaders said the evidence behind Astra's risk classification would likely not be available until the model's technical report is published (Source: time.com). The publication was also carried by Axios (Source: axios.com).
Three reinforcing safeguards
OpenAI frames its approach around three safeguards applied across research and deployment and adapted to each model's capabilities, operating environment, and level of risk: monitoring, "which detects and allows us to respond to concerning behavior"; alignment, "which reduces the likelihood of harmful or unauthorized actions"; and security measures, "which limit what AI systems can access or affect." The company states that it expects models "to soon drive most security work, including defending against other models," which it presents as the mechanism by which all three safeguards scale with capability.
Research-environment security
Immediately after the Hugging Face incident, OpenAI paused frontier-model inference in research clusters for runs that could execute code or use tools able to reach the internet, restored "a more limited and secure path for code execution fairly quickly," then assessed each workload individually. The company states that meeting the new standards "has required substantial engineering work and has incurred great cost and delays to frontier research."
Three requirement categories are named:
- Workload isolation — stronger sandboxing for workloads executing model-generated or otherwise untrusted code, extended to software that could be compromised while processing model outputs.
- Network isolation — controls designed "so that a single compromise of a workload or supporting service does not, by itself, allow for unauthorized access to the internet or other internal networks."
- Continuous security testing — removal of potentially vulnerable shared services, reduction of standing privileges, improved trust boundaries and security logging, and automation using OpenAI's own models to test those boundaries against simulated attacks.
The strictest level of safeguards applies to workloads involving Astra or cyber models, "since we have determined that Astra models may have a critical level of cyber capability," and to all other cyber-related workloads. OpenAI states that while some Astra training and evaluations meet the requirements, "a significant number of workloads remain paused" pending migration, with safety and alignment workloads prioritized.
Chain-of-thought monitoring
The publication describes a revised monitoring system and states what the prior arrangement did not cover: monitoring had been focused on internal deployments of frontier models and frontier RL training runs, and "was not applied to all inference and training runs using tools."
The new setup is multistage. It begins with activation classifiers — "detectors that inspect a model's internal activity" — running at every sampled token, escalating to "increasingly sophisticated and high-compute automated investigators" that examine tool actions, available reasoning, and the full sequence of activity for unauthorized access, data theft, destructive behavior, and attempts to defeat safeguards. OpenAI states an aim to issue an alert within 30 minutes of concerning activity being surfaced. A likely violation of a critical security boundary generates a highest-priority alert paging the safety, security, and research teams, who "are expected to pause the activity" if they cannot conclusively determine within 30 minutes that the flag is a false positive.
The monitoring is required for all RL training and tool-involving evaluations on models of Sol capability or higher — Sol being the top tier of the GPT-5.6 family. After the August 7 determination that Astra may have critical cyber capabilities, OpenAI added a requirement covering all inference of Astra with tools, not only RL training and evaluations.
OpenAI puts the cost at "roughly 20% of the inference compute being monitored," noting that it "varies substantially across training and evaluation workloads," and says it will publish more detail on the system. See Monitorability Tax.
Alignment measures
For RL runs on the most capable models, OpenAI states that it now applies "core alignment techniques across more stages of the training process": improving reward models to detect and discourage unsafe behavior across tasks and environments; training models "to be more honest about their actions, capabilities, and limitations"; and reducing behaviors that exploit weaknesses in rewards, graders, tools, or oversight. It names reward hacking — defined in the text as "finding ways to receive high rewards in training without actually achieving the intended outcome" — deception, and unauthorized access as the misaligned behaviors that grow more serious as models gain capabilities such as the ability to cyberattack. The company states that it now requires "stronger evidence of aligned behavior throughout all of training."
Stated direction
OpenAI writes that it will "evolve our Preparedness Framework to bring these safeguards together across training and deployment, and to better reflect the capabilities of future models and the environments in which they operate," and that "the signals we are seeing from upcoming model progress make clear that we need a broader approach — one that builds on and extends beyond the current Preparedness Framework." It states an intention to involve external organizations and to share more as the approach develops. A footnote records that a technical report of the company's learnings from the Hugging Face incident will be published "in the coming weeks."
Provenance
Published August 18, 2026 at openai.com/index/pacing-model-development-cyber-capabilities/, the company's own site, and retrieved from that canonical URL on August 19, 2026. Corroborated the same day by Axios and TIME, both of which report the publication and add executive attribution not present in the text.
Relationships
- related: OpenAI — publisher.
- related: Astra — the model family whose capability determination triggered the measures.
- depends-on: OpenAI Preparedness Framework V.2 — the framework under which the Critical cybersecurity threshold is defined, and which the publication states will be revised.
- related: Hugging Face — the incident that prompted the research-environment changes.
- supports: Monitorability Tax — supplies a first-party figure for monitoring overhead.
- related: Post-Deployment AI System Monitoring, AI and Cybersecurity, Autonomous cyber-agents, AI Scheming.
- related: The Defender's Window (Brockman, 2026) — an essay by the company's president two days earlier on the same incident, addressed to external defenders rather than to internal process.