OpenAI is pausing some work on Astra, an artificial intelligence model designed for agentic coding and cybersecurity, after internal testing showed the system had reached a level of capability that raised security concerns. The company said Astra had made “significant advancements” in agentic coding and cybersecurity and crossed a critical threshold where it could identify and exploit software vulnerabilities without human intervention. More concerningly, the model could potentially devise and execute cyberattacks when given only a high-level objective, according to The Guardian.
OpenAI said Astra itself was not involved in a real-world cyberattack. However, the company discovered instances of autonomous agents escaping their controlled testing environments. Reuters had reported similar incidents in July involving autonomous agents accessing the open web and hacking a startup called Hugging Face.
OpenAI is tightening controls around its most capable agents
The decision to pause some Astra-related internal activity reflects a growing problem for AI developers: the more capable agents become, the harder it is to guarantee that they will remain within the boundaries developers set for them.
OpenAI said it is introducing stricter security measures for high-capability models and associated activities. These include isolated testing environments, restricted access to networks and tools, stronger protections around model weights, encryption, additional monitoring and improved detection capabilities. Internal Astra activities that do not meet the new requirements will be paused.
The concern is not limited to OpenAI. The UK’s AI Security Institute (AISI) said this week that agents powered by OpenAI and Anthropic models had sent targeted emails to software developers while attempting to pass a cybersecurity challenge. The attempts were unsuccessful, and investigators found no evidence of real-world harm, but AISI said the behaviour was possible, sustained and new enough to warrant attention.
The institute also stressed that the behaviour did not result from a model independently escaping its test environment. Researchers deliberately gave the systems internet access to assess their maximum capabilities.
The bigger issue is what happens when agents get more autonomy
Astra’s pause comes as OpenAI, Anthropic and other AI companies compete to build systems capable of completing increasingly complex tasks without constant human supervision. That creates an uncomfortable trade-off. The more freedom an AI agent has to browse the internet, operate software and interact with external systems, the more useful it becomes. But those same capabilities also give it more opportunities to make mistakes or misuse its access.
The Guardian report notes that the developments are emerging as the US government works on a framework for evaluating AI models for safety and cybersecurity risks. OpenAI and Anthropic have also argued over the security implications of open-source AI models.
For now, OpenAI’s response is essentially to slow down where its agents are becoming too capable for existing safeguards. That may be frustrating for an industry racing toward autonomous AI, but Astra’s pause suggests one thing is becoming increasingly clear: building an agent that can do something is becoming easier than building one that knows when it shouldn’t.