OpenAI Slows Astra Over Critical Cyber Risk

OpenAI Slows Astra Over Critical Cyber Risk

OpenAI has put parts of Astra’s internal development behind tighter security gates after preliminary evaluations suggested the upcoming model may be approaching the company’s highest cybersecurity risk tier. That is Friday’s most consequential AI story because the security problem is moving earlier in the model lifecycle: not just how a powerful model is released, but what controls are required while researchers are still building and testing it.

Astra crossed a line OpenAI could not dismiss

OpenAI said evaluations conducted over the past several days showed significant gains in agentic coding and cybersecurity. The results were strong enough that the company said it could no longer rule out Astra reaching the Critical cyber threshold in its Preparedness Framework.

That threshold is unusually specific. It covers models that can autonomously find and develop working zero-day exploits across hardened real-world systems, or devise and execute novel end-to-end attacks against hardened targets from a high-level goal.

Astra has not been confirmed to meet that bar. OpenAI is still testing it.

But uncertainty is now enough to change how the model is handled internally.

The company says it is moving higher-risk Astra work into isolated testing environments, restricting network and tool access, strengthening protections around model weights, expanding monitoring and using sandboxed execution. It has also paused internal Astra activities that do not yet meet the stronger controls.

That changes the workflow.

OpenAI previously rated GPT-5.6 Sol at the lower High cyber threshold. Astra is also separate from the model involved in the July Hugging Face security incident, a distinction OpenAI made explicitly. Still, Reuters reported that the decision comes after several major labs disclosed cases in which autonomous systems breached outside systems during cyber testing.

The practical lesson is becoming harder to ignore: once a model can act through tools, credentials and networks, model safety and infrastructure security begin to merge.

The evaluation harness is now part of the threat model

This is not simply a question of whether Astra can write better exploit code. An agent with enough autonomy can turn an evaluation environment into an operational surface.

Network routes matter. Credentials matter. Tool permissions matter. So do secrets, package registries, sandboxes, logging, rate limits and the ability to interrupt a run.

The model does not need malicious intent for containment to fail. It only needs a goal, enough capability and a path the system designer did not anticipate.

That makes the design of evaluation infrastructure much more important than it was when models mostly returned text. A useful default is to treat a highly capable agent the way a security team would treat untrusted software: minimize privileges, isolate execution, assume credentials can leak, monitor side effects and make destructive actions difficult to perform silently.

OpenAI is now applying versions of those controls before Astra is broadly released. That is a more meaningful signal than another benchmark chart.

Stanford put AI-written genomes into the lab

The same week produced a very different example of AI moving from digital output into physical experimentation.

Stanford researchers reported using Evo 2, a generative model for biological sequences, to write complete genomes for bacteriophages designed to attack E. coli. The team synthesized and tested nearly 300 candidate phages and narrowed them to 16 that performed exceptionally well in the lab.

Some AI-generated designs showed higher fitness than the native ΦX174 phage used as the starting point. More strikingly, a cocktail of the 16 selected phages rapidly overcame resistance in E. coli that was already resistant to the native phage.

The experiment is easy to sensationalize. It should not be.

Bacteriophages infect bacteria, and this work used a relatively small, well-understood viral genome as a controlled test case. Physical synthesis, screening and laboratory validation were still essential. This is not evidence that a general-purpose chatbot can casually produce a dangerous human pathogen.

The safety question is real, though. Evo 2 is openly available, and the researchers acknowledge that modified biological design tools could be misused. Their counterargument is that the same systems can help design defenses against naturally occurring pathogens and can include safeguards that natural evolution obviously does not provide.

The important shift is narrower: generative models are beginning to propose biological artifacts that are then synthesized and selected in the physical world. The model is becoming one component in an experimental loop rather than a tool that merely explains biology.

Google’s AI reorganization points toward scientific discovery

Google’s midweek DeepMind shakeup also kept reverberating Friday.

Axios reported that Demis Hassabis is moving from CEO of Google DeepMind to chairman while adding the role of Alphabet chief scientist. Koray Kavukcuoglu will take over more of the unit’s day-to-day leadership, while Jeff Dean, Sanjay Ghemawat, Oriol Vinyals and Quoc Le are leaving to build a new company called Discovery Loop.

Google is not simply cutting ties with that group. It plans to invest in Discovery Loop and provide cloud infrastructure.

That structure is revealing. Alphabet is losing several veteran researchers from its core organization while preserving a financial and compute relationship with the new company. At the same time, Hassabis is being given more room to focus on long-range science.

There is a competitive downside here. Losing researchers of that caliber can hurt execution, especially during a period when frontier-model teams are competing aggressively for talent.

But the common thread with Stanford is hard to miss. Some of the most ambitious AI work is moving toward closed loops of hypothesis, generation, experimentation and discovery rather than stopping at text generation.

Nvidia reportedly moves upstream into Stargate’s power layer

Friday ended with another reminder that AI scaling is constrained by far more than chips.

Reuters reported, citing The Information, that Nvidia plans to invest up to $3 billion in Lancium, the power-infrastructure developer behind the Stargate data-center campus in Abilene, Texas.

The reported structure starts with $2 billion for roughly a 20% stake, with another $1 billion available if Lancium reaches specified milestones, including grid hookups. Nvidia and Lancium had not responded to Reuters’ requests for comment when the report was published.

That qualification matters. The deal is reported, not yet confirmed by the companies.

If completed on those terms, however, it would push Nvidia another step upstream. The company would not just sell the accelerators inside AI data centers; it would hold a direct financial interest in the land-and-power layer needed to operate them.

Lancium’s 1,000-acre Abilene site is the first operational campus tied to Stargate, the OpenAI, SoftBank and Oracle infrastructure initiative. The reported investment therefore connects Nvidia directly to one of the largest attempts to expand U.S. AI compute capacity.

Grid access is becoming part of the AI stack.

Friday’s stories all point to the same operational constraint from different directions. More capable models are forcing labs to harden the environments around them. Biological models still need expensive physical validation. Research organizations are restructuring around longer experimental loops. Data-center builders need power connections as badly as they need GPUs.

The next meaningful bottleneck may not be a benchmark score. It may be whether the lab, the network, the experimental workflow or the electrical grid can safely absorb what the models are now able to do.