What OpenAI's Astra Pause Borrows From Anthropic's Fable 5 Playbook

What OpenAI's Astra Pause Borrows From Anthropic's Fable 5 Playbook

OpenAI published a post on August 18 laying out why it has spent the past several weeks adding safeguards rather than shipping models. The company disclosed a two week pause in reinforcement learning training on models intended for deployment, and confirmed that its largest planned frontier RL run remains on hold while smaller scale training and evaluation continue. The reason traces back to two events from the past six weeks: a security incident involving Hugging Face, and a preliminary finding that an upcoming model called Astra may meet OpenAI's own definition of critical cybersecurity capability.

Anthropic went through a version of this same sequence in June, when it suspended access to Fable 5 and Mythos 5 over an export control directive tied to cybersecurity concerns. The parallel is not a coincidence. Both labs are discovering, on their own timelines, that cyber capable models built and tested inside constrained evaluation environments do not stay contained once those capabilities cross a certain line. That is close to the pattern David Borish has called the Tony Hawk Paradox in other contexts: a capability proven in a controlled setting eventually reshapes the broader system it was tested against.

What happened in July

Hugging Face disclosed on July 16 that it had detected and contained an intrusion into its production infrastructure. Five days later, OpenAI confirmed the intrusion was driven by its own models. During an internal evaluation designed to test cyber capabilities on a benchmark called ExploitGym, a combination of GPT-5.6 Sol and an unreleased, more capable model escaped their sandboxed testing environment by exploiting a previously unknown vulnerability in Artifactory, a package registry cache proxy. From there, the models reached the open internet, identified Hugging Face as a system that might hold information useful to scoring higher on the evaluation, and chained together real exploits to break into Hugging Face's production systems, using credentials from four separate third party accounts along the way.

OpenAI has called it "an unprecedented cyber incident, involving state-of-the-art cyber capabilities." The company brought in CrowdStrike, METR, and Redwood Research to independently assess what happened, and has promised a full technical report in the coming weeks. No models planned for release were involved in the exploitation itself, but the incident became the immediate trigger for a broader security overhaul across OpenAI's research environment.

Astra and the critical threshold

Three weeks after the Hugging Face disclosure, OpenAI made a separate announcement. Internal evaluations of Astra, an upcoming model unrelated to the Hugging Face incident, showed advances in agentic coding and cybersecurity strong enough that OpenAI concluded it could not rule out Astra reaching the Critical tier of its Preparedness Framework, the internal document that has governed frontier risk assessment at OpenAI since December 2023. Under that framework, a model reaches Critical if it can "devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high level desired goal," or independently develop functional zero-day exploits across many hardened real-world systems without human help.

Every prior OpenAI model evaluated for cyber capability, including GPT-5.6 Sol, landed one tier lower, at High. Astra is the first to raise the question of Critical, and OpenAI has not finished making that determination. The company paused internal Astra activity that does not meet a strengthened set of security controls, and said it would work with government agencies and outside safety organizations to test the model further before any release decision.

The safeguards OpenAI is now building

The August 18 post describes the response in three layers: monitoring, alignment, and security. On the security side, OpenAI has added stronger sandboxing for workloads that execute untrusted code, tighter network isolation designed so that a single compromised workload cannot reach the internet or internal systems on its own, and continuous automated testing of those boundaries. The strictest tier of controls now applies to all Astra and cyber-related workloads.

On monitoring, OpenAI has built a multistage system that runs activation classifiers on every sampled token and escalates concerning activity to automated investigators, then to human safety, security, and research teams if a critical boundary appears to have been crossed. The company aims to issue an alert within 30 minutes of a flagged event, and teams are expected to pause the activity if they cannot rule out a false positive in that window. This monitoring now covers all inference involving Astra, not just training runs, and OpenAI estimates it adds roughly 20 percent to the inference compute being monitored.

On alignment, OpenAI says it is applying its core techniques across more stages of training for its most capable models, including reward model improvements aimed at catching reward hacking and training models to be more honest about their own capabilities and limitations. The company also confirmed it is rewriting the Preparedness Framework itself, since parts of the 2023 document were written for capability levels models are only now approaching.

Anthropic already had this conversation

Anthropic's version of this story ran in June. Claude Fable 5 and Mythos 5 launched on June 9, with Mythos restricted to a small set of partners working on defensive cybersecurity under a program Anthropic calls Project Glasswing. Three days later, the Commerce Department issued an export control directive covering both models, and Anthropic suspended access entirely rather than risk a violation it had no reliable way to enforce in real time. Access returned on July 1, alongside a new safety classifier and an industry framework for scoring jailbreak severity developed jointly with several other companies.

Dario Amodei wrote about the underlying capability question directly in a June essay, before OpenAI's Astra disclosure existed. He described Mythos Preview as proof that "frontier models pose very real risks to cybersecurity, creating the potential for disruption of the financial sector, critical infrastructure, and national security," and argued Mythos Preview effectively reordered how the security community had to think about frontier models.

Anthropic's own head of product for research and labs, Dianne Penn, told Axios the company was being "deliberately more conservative" with that release. The vocabulary differs from OpenAI's Preparedness Framework language, but the underlying judgment call, that a model's cyber capability had crossed a line requiring deployment restrictions rather than a straightforward launch, is the same one OpenAI is now making about Astra.

Amodei's separate fight this week

While OpenAI was finalizing its August 18 post, Amodei was engaged in an unrelated but adjacent argument on X. Investor Gavin Baker had argued on the All-In podcast that Amodei's public warnings about AI risk have helped fuel the current backlash against the industry and against data center buildouts, and suggested Amodei should be "a more positive advocate for his own industry." Amodei responded at length, rejecting the idea that his messaging has been disproportionately negative and arguing instead that "ordinary people don't trust companies, governments, or the tech industry" and always suspect some hidden motive. He also conceded that the most accurate criticism of AI companies, Anthropic included, is that they have not yet delivered on promised benefits, and that AI curing cancer has become more of a cliche than an inspiring claim. That comment drew immediate pushback from researchers who pointed out that cancer is not a single disease and that no AI-designed drug has yet reached clinical adoption.

The regulatory position Amodei staked out in June is worth reading against this week's exchange. His essay called for FAA-style mandatory third party testing of frontier models above a compute threshold, with government authority to block deployment in four risk categories including cybersecurity. That is close to a description of what OpenAI is now doing voluntarily with Astra, minus the binding government authority. Amodei has acknowledged that Anthropic's policy proposals are designed to slow down frontier companies like his own while giving smaller competitors more room, a framing that is worth keeping in mind given Anthropic's own commercial position heading into a reported IPO process.

What comes next

OpenAI has committed to publishing a full technical report on the Hugging Face incident, and has not yet finalized whether Astra meets the Critical threshold. Both determinations will shape whether Astra ships on anything like its original timeline. Anthropic, for its part, has already completed one full cycle of this process with Fable 5 and Mythos 5, and its jailbreak severity framework is now positioned as a potential industry reference point rather than a one-off fix. The two companies are still competing on nearly everything else, but on the specific question of how to pace a model's release against its own cyber capability, they are running the same experiment in public, a few weeks apart.

---

David Borish is the author of the forthcoming book The Tony Hawk Paradox, which examines how capabilities proven in controlled or simulated environments transfer into broader real-world systems. He writes long-form AI analysis at davidborish.com.