rack: frontier training · state: hold · released: none

OpenAI's Framework Lists One Action for Critical Cyber: Halt

It paused two weeks instead. The phrase that kept the clause shut.

On August 18, OpenAI published a post explaining that it had temporarily slowed the pace of scaling. The concrete version: a two week pause in reinforcement learning training on the latest models intended for deployment, and its largest planned frontier RL run left on hold while smaller runs and evaluations continue.

Coverage read that as a company hitting its own brakes. That reading is fair. It is also incomplete, because OpenAI's Preparedness Framework already specifies what to do when a model reaches Critical cybersecurity capability, and it is a stronger instruction than a two week pause. The framework's cell for that threshold contains a single guideline: until safeguards and security controls meeting a Critical standard have been specified, halt further development.

That clause did not fire. The reason is one sentence in the August 7 disclosure, and it is worth reading slowly.

Everything OpenAI did over the following eleven days was therefore discretionary rather than required. That is not the same as empty. Some of it is substantial, and one part of it runs in the opposite direction from the headline.

The pause covers post training, not pretraining. That distinction matters: reinforcement learning with tools is the stage where a model learns to act, call things, and chain steps, which is exactly the capability profile the cyber threshold describes. Pausing there is the targeted move, not the cosmetic one.

Alongside it, OpenAI hardened the research environment: stronger sandboxes for workloads running model generated or otherwise untrusted code, network controls designed so a single compromised workload cannot by itself reach the internet or other internal networks, removal of shared services that were potentially vulnerable, and reduced standing privileges. A significant number of Astra and cyber related workloads remain paused until they migrate to the new bar, with safety and alignment workloads migrating first.

Three details are absent from the post. There is no end date for the held run. There is no start date for the two week pause, so the disclosure is retrospective and the window cannot be located on a calendar. And no external body has verified the Astra assessment, which remains an internal preliminary read.

The framework defines the Critical cyber threshold precisely. A tool augmented model reaches it if it can identify and develop functional zero day exploits of all severity levels in many hardened real world critical systems without human intervention, or if it can devise and execute end to end novel strategies for cyberattacks against hardened targets given a high level goal alone.

Notice how much load the qualifiers carry. All severity levels. Many hardened systems. Without human intervention. A model can be extremely dangerous and still fail that definition on a technicality of scope. This is why the August 7 post says OpenAI cannot rule out the level rather than saying the level was reached: the preliminary evaluations were strong enough that the negative could not be established, which is a different claim from the positive.

Two clauses cut in OpenAI's favour here, and both deserve stating. Section 4.1 says that if a covered system appears likely to cross a threshold, work on safeguards starts even without a formal determination. That is exactly what happened, so the response is aligned with the document even though the halt bullet stayed shut. And section 4.4 anticipated this moment in writing: it records that OpenAI possesses no Critical model and expects to update the framework before any model reaches that level.

Which is what is happening. Axios reported the same day that OpenAI is rewriting the Preparedness Framework, and the August 18 post says the framework will evolve to bring safeguards together across training and deployment. Chief scientist Jakob Pachocki told reporters at a briefing that the sense of urgency inside the company is very high, both to advance the field and to prepare for the same progress happening elsewhere. The uncomfortable structural fact underneath: the standard is being rewritten by the party it binds, while the party approaches the threshold it defines.

Three days after concluding it could not rule out Critical cyber capability, OpenAI expanded Daybreak and introduced GPT-5.6-Cyber, a model built on GPT-5.6 Sol and trained to reduce refusals on higher risk dual use cyber tasks.

The number OpenAI published to measure that is the part worth sitting with. An internal evaluation called Advanced Cybersecurity Completion Rate measures how often a model responds to requests covering exploit chain development, authentication bypass, and privilege escalation. Sol with production safeguards completes 1.5 percent of them. GPT-5.6-Cyber completes 95.0 percent.

What that access produced is genuine defensive work, and it should be counted. Using GPT-5.6-Cyber, OpenAI found two previously unknown vulnerabilities in V8 that chain to corrupt memory and escape the heap sandbox, disclosed them to Google, and one was fixed as CVE-2026-15903. Beyond that: at least five vulnerabilities in a widely used mobile operating system, three critical issues in a widely used database, and over 400 privilege escalation vulnerabilities in a widely used operating system kernel.

Access is also gated in ways worth naming. Identity verification, approved use restrictions, legal attestations, monitoring, and for individual Daybreak accounts a hardware security key requirement starting September 1, 2026. Partners hold the model access; it is not passed through to their customers.

One result in that same post cuts against the marketing, and OpenAI printed it anyway. On its internal Vulnerability Discovery and Report Writing evaluation, GPT-5.6-Cyber scores worse than plain Sol, which OpenAI attributes to the specialised model producing shorter, less detailed reports. On ExploitBench at the standard 300 turn limit, Sol through Daybreak Blue is both more token efficient and better; the gap narrows at 600 turns. Specialising for exploitation did not uniformly add capability. What it added was compliance.

The most transferable part of the August 18 post is the monitoring design, because it is the first time a lab has published both the architecture and the bill.

It is multistage. Activation classifiers, meaning detectors that inspect the model's internal activity rather than its text, run at every sampled token. Anything they flag escalates to progressively more expensive automated investigators that examine tool actions, available reasoning, and the full sequence of activity, looking for unauthorised access, data theft, destructive behaviour, and attempts to defeat safeguards.

Then comes the part most teams get wrong. The escalation rule is not a threshold, it is a timer with a default. A likely violation of a critical security boundary pages safety, security and research teams. If they cannot conclusively establish within 30 minutes that the flag is a false positive, they are expected to pause the activity. Uncertainty resolves toward stopping, rather than toward continuing while someone investigates.

The price OpenAI puts on this is roughly 20 percent of the inference compute being monitored, varying substantially by workload. That figure is the single most useful line in the post for anyone budgeting an agent platform. Continuous oversight of a tool using agent is not a rounding error on your inference bill, it is a fifth of it, and this is a lab with unusually good reasons to make the number look small.

Section 4.3 of the framework is titled Marginal risk, and it is the clause to watch for the rest of this year. It says that if another frontier developer releases a system with High or Critical capability without comparable safeguards, OpenAI may adjust its own required safeguards downward. Three conditions attach: the adjustment must not meaningfully increase overall risk, OpenAI must publicly acknowledge that it is adjusting, and it must stay more protective than the other developer and share information validating that claim.

That clause has sat unused since April 2025. On August 17, Greg Brockman wrote that open weight models with cyber capabilities are landing a few months behind the frontier, and that the most recent of them appears slated for release at the end of August and seems likely to significantly accelerate the threat landscape. His link points at the GLM-5.3 announcement.

Readers who saw our GLM-5.3 issue last week will recognise the date. Z.ai held those weights back for roughly two weeks of safety evaluation, which put the release near the end of August. So the president of OpenAI has publicly named a specific competitor release, on a specific date, as the event that accelerates the threat landscape, in the same week his company disclosed that it slowed its own training.

A pause that was not required is still a pause, and voluntary disclosure of an internal capability read is rare enough that it should not be punished with cynicism. The fair version of this story has both columns in it.

One more piece of framing from the briefing itself. OpenAI told reporters the new safeguards were not a direct reaction to Hugging Face specifically. Taken at face value that is a stronger claim than the alternative, because it means the tightening comes from where capability is heading rather than from one bad week.

Budget the oversight, not the model. If a frontier lab pays roughly 20 percent of inference compute to watch its own agents, a production agent platform with real tool access should assume a similar order of magnitude and plan for it, rather than discovering it after the first incident review.