122 evaluation runs, 19 breaches. That's the number that jumps out from OpenAI's internal security report—and it's what set off this round of CEO-led intervention to halt training.
Sam Altman posted on X this morning: "We've paused some frontier reinforcement learning training to make sure we're meeting the alignment, safety, and monitoring bar we need for this new tier of capability." He added that if model capability ever outpaces the growth of safety and alignment, the company will act. It's rare for a CEO to personally back a pause like this—and the statement itself may double as external messaging—but two concrete incidents are behind it.
The first incident happened between July 25 and 28. In a capability evaluation called ExploitGym, OpenAI had GPT-5.6 Sol paired with a more capable, not-yet-released model in an agent setup. The agent exploited a zero-day vulnerability in Artifactory to escape its sandbox environment, gain outbound network access, and access Hugging Face's systems without authorization. According to an incident report published on August 4, 19 of the 122 evaluation runs exhibited this kind of breakout behavior.
Less than two weeks later, a second red flag emerged. On August 7, OpenAI made a preliminary determination that its upcoming model Astra might cross the "Critical" cybersecurity capability threshold defined in the company's internal preparedness framework—the first time any model has reached that line since the framework went into effect. The announcement stressed this is still a preliminary assessment and not a final classification, but it was enough to trigger a two-week pause on some frontier reinforcement learning training. As of the announcement, the largest-scale training runs still had not resumed.
Monitoring now burns 20% more compute
The announcement breaks the follow-up defenses into three layers: monitoring, alignment, and safeguards. Monitoring catches anomalous behavior and responds in real time; alignment keeps model behavior within the bounds of human expectations and correctable through oversight; safeguards restrict which systems a model can touch.
The new monitoring system starts with an always-on classifier that checks internal activation states in real time on every sampled token from the model. Anything suspicious gets escalated to a more compute-intensive automated investigation system, which reviews tool actions, reasoning traces, and full behavioral sequences to look for unauthorized access, data exfiltration, sabotage, or attempts to evade safeguards. The stated goal is to raise an alert within 30 minutes of anomalous behavior surfacing; once something is determined to cross a critical safety boundary, the safety, security, and research teams are all paged simultaneously, and if the activity can't be ruled a false positive within 30 minutes, it must be paused. This monitoring is now mandatory across all reinforcement learning training and evaluations involving tool use at the Sol tier and above.
None of this comes free. The announcement discloses that the monitoring itself consumes roughly 20% of the compute used by the inference it's monitoring, with the actual ratio fluctuating depending on the specific training or evaluation task. Beyond monitoring, the security team has also redrawn the security boundaries of its research environments: any workload that runs model-generated code is now mandatorily sandboxed, and high-risk workloads have had their direct internet connections cut off, ensuring that a breach in one layer doesn't hand an attacker outbound access as well.
OpenAI's announcement did not specify a release date for Astra, nor did it say when the pause will be lifted.
