OpenAI pauses frontier RL training to harden cyber safeguards

OpenAI published a company note on 18 August 2026 saying it has slowed frontier training after two developments: the OpenAI-Hugging Face incident and preliminary evidence that an upcoming model, Astra, may meet the Critical cybersecurity capability threshold in OpenAI's Preparedness Framework.

The company said this included a two-week pause in reinforcement learning (RL) training on its latest models intended for deployment, while it hardened and red-teamed research environments and expanded monitoring. Its largest planned frontier RL run remains on hold. Smaller-scale training and evaluations are continuing so it can assess behavior and validate safeguards before going further.

What changed inside the lab

Immediately after the Hugging Face incident, OpenAI said it paused frontier-model inference in research clusters for runs that could execute code or use tools with internet access. It later restored a more limited, secure path for code execution and reviewed workloads one by one.

New controls it describes include:

• stronger isolation (sandboxes) for untrusted or model-generated code
• tighter network isolation so a single compromised workload cannot, by itself, reach the internet or other internal networks
• continuous security testing, fewer standing privileges, and better security logs

The strictest bar now applies to workloads involving Astra or cyber models. OpenAI said it determined on 7 August that Astra may have a critical level of cyber capability. Some Astra training and evaluations already meet the new requirements; a significant number of workloads stay paused until they are migrated.

OpenAI said it will publish a technical report on what it learned from the Hugging Face incident in the coming weeks. The public note does not describe the incident itself beyond that name.

Monitoring at 30 minutes

OpenAI also expanded chain-of-thought and activity monitoring. The new setup starts with activation classifiers that run at every sampled token, then escalates to higher-compute automated investigators that look at tool actions, available reasoning, and the full sequence of activity for unauthorized access, data theft, destructive behavior, and attempts to defeat safeguards.

The company said it aims to issue an alert within 30 minutes after concerning activity is surfaced. If a likely violation of a critical security boundary is flagged and teams cannot confirm a false positive within 30 minutes, they are expected to pause the activity.

That monitoring is required for all RL training and evaluations that use tools on models of Sol capability or higher. After the 7 August Astra finding, it also applies to all Astra inference with tools. OpenAI estimates the overhead at roughly 20% of the inference compute being monitored.

Alignment and what comes next

For RL runs on the most capable models, OpenAI said it is applying core alignment techniques across more stages of training: better reward models, more honest reporting of actions and limits, and less exploitation of rewards, graders, tools, or oversight.

It plans to evolve the Preparedness Framework so these safeguards cover both training and deployment, and to involve external organizations as the approach develops.

Source: Pacing model development in an era of cyber-critical capabilities, OpenAI, 18 August 2026.