OpenAI said on Friday it cannot rule out that its upcoming AI model, Astra, has "critical" cybersecurity capabilities, prompting the startup to pause some internal development and trigger safety protocols. Under OpenAI's safety guidelines, a model reaches the "critical" threshold if it can autonomously identify and exploit severe, real-world software vulnerabilities, known as zero-day exploits, or execute complex cyberattacks against highly secure targets without human intervention. Preliminary evaluations over the past several days, along with outside expert assessments, indicated Astra may be capable of performing increasingly sophisticated cyber tasks autonomously. In response, OpenAI scaled up security controls and paused internal activities involving Astra that do not meet its newly strengthened security requirements. Astra's development will be moved into isolated testing environments with restricted network access and sandboxed execution. CEO Sam Altman said on X OpenAI is working to make Astra generally available, as the company does "not think it is a good strategy to keep powerful models to a chosen few." OpenAI also clarified that Astra was not involved in the hack targeting the AI platform Hugging Face. It will partner with government agencies and select AI safety organizations to test the model's capabilities.