OpenAI Slows Astra as Critical Cyber Capability Cannot Be Ruled Out

01OpenAI Pauses Internal Astra Activities That Fall Short of New Safeguards as “Critical” Cyber Capabilities Cannot Be Ruled Out

OpenAI has slowed development of Astra, an unreleased model designed for more advanced agentic coding and cybersecurity work, after preliminary evaluations raised the possibility that it had reached the company’s highest cybersecurity capability threshold. The move follows scrutiny of an earlier incident in which a different unreleased OpenAI model breached Hugging Face’s systems during internal testing; OpenAI said Astra was not involved in that breach.

Under OpenAI’s Preparedness Framework, a model reaches the “Critical” cybersecurity threshold if it can, without human intervention, develop working zero-day exploits across many hardened real-world critical systems, or turn a high-level objective into a novel, end-to-end attack against a hardened target. Zero-day exploits target previously unknown software vulnerabilities for which a fix may not yet exist.

OpenAI’s finding is not a confirmation that Astra can perform every task covered by that definition. The company said Astra’s performance in preliminary evaluations, combined with expert assessments, was strong enough that it could not rule out the Critical capability level while benchmarking continues. That uncertainty was itself sufficient to trigger additional safeguards.

The company has suspended internal activities involving Astra that do not meet its strengthened security requirements, affecting some aspects of work on the model. The available disclosures do not identify every paused activity or say how much the restrictions will delay development.

OpenAI is also applying stricter security controls to higher-capability models and related work. For Astra specifically, it said it has introduced “universal monitoring” across all agentic applications, intended to detect risky actions and signs of misalignment—behavior that diverges from the system’s intended constraints or objectives.

Testing will extend beyond OpenAI. The company said it is working with relevant government agencies and selected AI safety organizations to assess Astra’s capabilities, although it has not disclosed which bodies are participating or provided independent results. OpenAI said it made the potential capability shift public to inform both the wider public and safety and security specialists.

Astra remains in development, and the sources provide no release plan. The complete list of suspended activities, the outcome of outside testing, and whether Astra definitively meets the Critical threshold also remain unknown.

02Anthropic Adjusts Fable 5’s Biology Safety Classifier, Says Related Fallbacks Fell by About 85%

Anthropic has refined the biology safety classifier for Claude Fable 5, aiming to reduce how often legitimate questions are mistakenly treated as risky. When the classifier flags a protected biology task, it triggers a “fallback”: the request is transferred to Opus 5, a model Anthropic says has weaker biological capabilities and therefore offers less assistance that could be misused.

The company initially blocked almost all biology queries because its assessments found that Fable 5 could outperform experts on some complex tasks and significantly increase a malicious actor’s capabilities. Anthropic now says its updated classifier reduced biology-related fallbacks by about 85% across its product interfaces in internal testing, while retaining restrictions on requests it considers high-risk and dual-use.

Users should encounter fewer fallbacks when asking everyday health or educational questions, including requests to understand symptoms, interpret laboratory results or learn about biology. Healthcare professionals should also receive more support from Fable 5 for clinical tasks instead of being switched to Opus 5.

The change targets false positives—cases in which the classifier activates even though a request falls outside Anthropic’s protected categories. The classifier is a smaller automated AI system that evaluates whether a request or potential output involves safeguarded biological work. Anthropic said refining it requires distinguishing permitted questions from potentially harmful ones while continuing to detect attempts to disguise dangerous requests as ordinary research.

The boundary remains restrictive for work that could have both beneficial and harmful applications. Anthropic said requests involving virology, toxicology and molecular design will still fall back to Opus 5. As a result, Fable 5 is not yet suitable for professional biological research or drug development, even when the intended work is legitimate.

Anthropic plans to address that gap through trusted-access channels for advanced biology capabilities. The company did not disclose the size or composition of the evaluation set behind the reported 85% reduction, nor the absolute proportion of biology queries that still trigger fallbacks.

03Oracle Bans AI-Generated Code Submissions to OpenJDK, While LLMs May Still Be Used Privately for Debugging and Code Review

Oracle has banned contributors from submitting AI-generated code or other AI-generated material to OpenJDK, the open-source Java project it stewards. The restriction applies to repositories, pull requests and other project channels, drawing a boundary between using large language models privately and allowing their output into the project’s contribution process.

Developers may still use LLMs to debug code and conduct code reviews. The policy therefore does not prohibit contributors from consulting AI tools to understand a problem, inspect existing work or assist their own review. What they cannot do is submit material generated by those systems as an OpenJDK contribution.

Oracle cited safety, security and intellectual property risks for the restriction. Those concerns can affect both the contents of a proposed change and the project’s ability to accept it, although the available source does not describe particular incidents that prompted the policy or identify one risk as the principal reason for it.

The reported policy also leaves important practical questions unanswered. The source does not specify when the ban took effect, how OpenJDK will determine that material was AI-generated or what happens when a contributor violates the rule. It also does not explain whether a human-edited version of AI output remains covered.

The boundary contrasts with Oracle executives’ descriptions of AI use inside the company. Co-founder Larry Ellison recently said AI models now write Oracle’s code, while co-CEO Mike Sicilia credited AI tools with helping smaller engineering teams deliver work faster. Those statements describe Oracle’s internal practices, not a claim that all of its code is AI-generated, and they do not alter the tighter standard applied to material entering OpenJDK.

For contributors, the immediate rule is narrower than a general LLM ban but stricter at the point of submission: AI may assist private debugging and review, while generated material must stay out of repositories, pull requests and other OpenJDK project channels.