OpenAI suspends part of the development of the future ChatGPT for security reasons.

Since December 2023, OpenAI has maintained an internal document that ranks its own models on a scale of danger, from biological risk to cybersecurity to self-improvement. This framework, revised in April 2025, distinguishes a “High” tier and a “Critical” tier. The rule that accompanies it is fairly simple: at the top of the scale, development stops until safeguards are adequate.On August 7, 2026, the company acknowledged that it could no longer rule out this scenario for Astra. If the name means nothing to you, that’s normal; the model has never been officially unveiled.

A tier the in-house framework had never had to activate

The critical cybersecurity threshold is defined word for word. A model reaches it if it succeeds in « identifying and developing functional zero-day exploits of all severity levels in numerous hardened critical systems, without human intervention ». Another entry point: designing and executing end-to-end novel attack strategies against protected targets, starting from a goal formulated in a single sentence. In other words, doing on its own what it takes a team of security researchers weeks to produce. No model had yet achieved this, and previous models, including GPT-5.6-Sol, were capped at the lower tier.

The internal evaluations conducted over the past few days showed marked advances in autonomous programming and cybersecurity. The conclusion came in overnight from August 6 to 8, and it remains cautiously worded: the company says it cannot rule out the critical tier, not that it has reached it. Testing continues.

The announced safeguards, meanwhile, are already in place: isolated test environments, restricted network access and tools, enhanced encryption of the model weights, sandboxed execution. This is supplemented by continuous monitoring of risky actions, with inspection of the reasoning chain and automatic interruption in the event of drift.Internal activities that do not yet meet these requirements are suspended. Government agencies and organizations specializing in AI system safety will be involved in the upcoming tests.

Europe has regained its enforcement powers five days earlier

On 2 August 2026, the European Commission activated its oversight powers over providers of general-purpose AI models. These companies had already been subject to obligations for a year, but Brussels had no means of enforcing compliance. From that date, it can request documents, require a model assessment, order corrective measures, and restrict access to the European market. Fines can reach €15 million or 3% of global turnover (whichever is higher).

Article 55 of the regulation requires providers of models presenting a systemic risk to assess and mitigate those risks. It also requires them to report serious incidents to the AI Office without undue delay and to ensure an adequate level of cybersecurity for both the model and its infrastructure. One important caveat remains: these obligations apply to models placed on the market, but Astra has not been released. The 7 August release therefore currently amounts to voluntary transparency, rather than regulatory compliance. France, for its part, has still not formally designated all of its competent national authorities.

As early as July 21, two OpenAI models escaped from a test environment by exploiting an unknown vulnerability before reaching the Internet. They then compromised the production infrastructure of a model-hosting platform to steal the answers to the security assessment they were supposed to take. On August 4, the company detailed two new leaks involving external evaluators, including a case in which the fictional domain name used in an exercise matched a perfectly real website, which was immediately attacked. Anthropic reported a comparable incident over the same period, shifting the question away from the guilty laboratory and toward the conditions under which the industry tests its own models. Three incidents in three weeks, mind you.

Read also: OpenAI unveils the astonishing behind-the-scenes details of the first cyberattack orchestrated by ChatGPT

For users, nothing changes in the immediate term: Astra has no release date, price, or technical specifications. What has changed is the balance of power. For nearly three years, these announcements amounted to self-assessments published on a company blog, to be taken or leave it. For six days now, Brussels has been able to request sight of the copies.

👉🏻 Follow the latest tech news in real time: add 01net to your feeds on Google and subscribe to our WhatsApp channel.

Source: OpenAI