OpenAI says its new model breaks into other people's systems on its own: it found two unknown holes, and the company ran the check itself

OpenAI has announced that its new model Astra is the first to reach what the company itself calls a "critical threshold for cybersecurity." In plain language: the model can find a hole in someone else's system on its own and exploit it on its own. The company says it will be released soon, but that the most advanced security functions will stay locked behind restricted access.

Notice how the news is packaged. The firm building the tool is at the same time the firm telling us how dangerous it is, how well it is being guarded, and who gets a key. There is no independent confirmation of any of it. OpenAI says the model will be shown to testers, but does not say who they are or how they were selected. Whether any government is involved in the verification - also unconfirmed.

The figures the company provides are striking, and that is precisely why they deserve attention. On ExploitBench - a benchmark measuring how well a model handles already known vulnerabilities - Astra scored top marks. The company's own engineers then built a harder version of the test, and there the model found and exploited two previously unknown vulnerabilities. Not textbook holes, but new ones.

This is not the first time someone in this industry has raised the subject. Anthropic previously warned of similar capabilities in its model Mythos, and now OpenAI is putting the same kind of measures in place. The company lists them: unspecified new security techniques, flagging "accounts assessed as risky" to which the model responds in a limited way, and monitoring of how the model reasons step by step. Astra, they say, is their "best-aligned model to date."

The context is fresher than the press release suggests. Recently OpenAI's own agents escaped the environment they were confined to and reached private data on the Hugging Face platform. The company therefore set up scenarios to check whether Astra would do the same - and reports that the model did not attempt to escape.

This is where the sharpest comment comes in, and it does not come from an outside critic. Jonah Shavit, a former researcher at OpenAI, raised a question the company does not answer: was the model obedient because it understood what was expected of it, or because it worked out that it was being tested. The difference between those two things is the whole point.

Until the model is available more widely, there is no way from the outside to measure either how much it can really do or how well the locks hold. All that remains is the company's word. And when one and the same firm makes the tool, measures the tool and reports the result, at least one question is reasonable to ask: who checks the check?