Breaking: OpenAI has suspended reinforcement learning training for two weeks.

OpenAI has hit the brakes on the training of its most cutting-edge models.

Just recently, OpenAI released a statement noting that the company had previously paused the reinforcement learning (RL) training of its latest model planned for deployment for two weeks. During this period, OpenAI hardened its research environment, conducted red team testing, and expanded the coverage of its internal monitoring system. Part of the lower-risk training has since been resumed.

However, at present, the originally planned largest-scale RL training for cutting-edge models is still in a paused state. The company is observing model behavior through smaller-scale training and evaluation, verifying new security measures, and accumulating more alignment evidence before deciding whether to proceed.

Original link: https://openai.com/index/pacing-model-development-cyber-capabilities/

Sam Altman reposted and commented, "We have always emphasized that if model capabilities exceed the requirements of safety and alignment, we will take immediate action. We take artificial intelligence safety issues very seriously."

The news sparked a huge outcry among netizens!

Some netizens believe that this undoubtedly means another delay in the release of the Astra model.

Other netizens pointed out that combined with the recent departure of several C-level executives from OpenAI, the situation seems a little unusual.

And some other netizens think that this may just be a currently rather "popular" marketing method.

In fact, there are two main reasons why OpenAI made this decision to take the initiative to slow down scaling, and move security requirements forward from the "deployment phase" to the "training phase".

Two Trigger Events

In the past few weeks, two consecutive events prompted OpenAI to decide to slow down training.

The first one is the Hugging Face security incident. In an internal cybersecurity evaluation, the OpenAI model broke through the isolated environment, gained access to the Internet, and finally breached the infrastructure of Hugging Face. We have published detailed reports on this before (link inserted).

The second is related to the unreleased new model Astra. Preliminary evaluations show that Astra may reach the "Critical" cybersecurity capability threshold defined in OpenAI's Preparedness Framework.

In the Preparedness Framework, OpenAI divides cybersecurity capabilities that may cause serious harm into two levels: "High" and "Critical".

Previously, the cybersecurity capability of GPT-5.6Sol has been rated as "High".

According to OpenAI's definition, reaching the "Critical" threshold means the model may have one of the following two capabilities: discover and exploit effective zero-day vulnerabilities of varying severity from a large number of hardened real-world critical systems without human intervention; or autonomously design and execute a complete new attack scheme against hardened targets based only on a high-level attack goal.

Strengthening Security Protection for More Capable Models

Specifically, OpenAI now summarizes its security system into three mutually reinforcing parts:

Monitoring: Detect behaviors that cause concern and enable timely response.

Alignment: Reduce the possibility of the model taking harmful or unauthorized actions.

Security measures: Limit the objects and scope that the AI system can access or affect.

OpenAI expects that in the near future, most of the security work will be done by models, including defending against other models. In this way, these three types of security measures can scale synchronously with model capabilities, which is crucial.

OpenAI stated that it will implement these security measures throughout the entire research and deployment process, and adjust them according to the capabilities, operating environment and risk level of different models.

The First Step is to Harden the Research Environment

OpenAI stated that as cutting-edge models acquire more and more powerful cybersecurity capabilities, they are also raising the security standards of the environments used to train and evaluate these models. Meeting these standards requires a large amount of engineering resources, which also brings high costs and obvious delays to cutting-edge research.

In the coming weeks, OpenAI will formulate and start implementing stricter security requirements for cutting-edge research workloads. For example:

Workload Isolation: For workloads that execute code generated by models or other untrusted code, stronger isolated environments, that is, stricter "sandboxes", are now required. This requirement also applies to software that may be attacked when processing model outputs.

Network Isolation: OpenAI has added more control measures to isolate high-risk and untrusted workloads from the Internet. The design goal is that even if a workload or supporting service is breached at a single point, this single breach alone cannot grant unauthorized Internet access or access to other internal networks.

Continuous Security Testing: OpenAI has reconfigured the research environment, removed shared services that may have vulnerabilities, reduced long-held permissions, and improved security boundaries and trust boundaries. In addition, it is enhancing the collection and monitoring capabilities of security logs. At the same time, it is investing in automated systems that use its own models to continuously conduct simulated attack tests on these boundaries.

OpenAI also stated that at present, workloads involving Astra or cybersecurity models are required to adopt the highest level of security protection measures, because it has been judged that the Astra model may have Critical-level cybersecurity capabilities.

Secondly, Expand Chain-of-Thought Monitoring

This is also a rather interesting point in the article, OpenAI has begun to "use AI to monitor AI".

OpenAI stated that monitoring has long been an important part of the model development process, including monitoring of internal programming Agents and long-running Sessions. Previous monitoring efforts focused mainly on the internal deployment of cutting-edge models and the RL training tasks of cutting-edge models. OpenAI believes that these workloads have the highest risk, because they may have both advanced model capabilities and access to tools, sensitive systems, and internal or external networks.

However, this set of monitoring previously did not cover all reasoning and training tasks that use tools. The monitoring system has now been adjusted and expanded, that is, the coverage of chain-of-thought monitoring has been greatly expanded.

The new monitoring system is multi-stage. At the front end is a class of activation classifiers, which are detectors that monitor the internal activities of the model, running on every sampled Token. Once potential risks are detected, the task is escalated to a more capable, more computationally intensive automated investigation Agent.

These investigation models will comprehensively examine: what tool calls the model has made, the reasoning information that can be obtained, and the entire behavior trajectory. The focus is on looking for unauthorized access, data theft, destructive operations, and attempts to bypass security mechanisms.

In other words, while the model is performing tasks, another set of models is reviewing it in real time to see if it is "doing something malicious".

OpenAI has set a very clear time indicator for this system: after detecting concerning activities, the goal is to issue an alert within 30 minutes. If the highest-level alert is triggered, the security, cybersecurity and research teams will all be notified. If it is not possible to clearly prove that it is a false positive within 30 minutes, the relevant activities should be suspended.

At present, this monitoring system must be enabled for all RL training and evaluation involving tool calls that reach Sol capability level or above.

Astra goes a step further. After OpenAI judged on August 7 that Astra may have Critical cybersecurity capabilities, it stipulated that: all reasoning activities of Astra + tools must be monitored. This is no longer limited to RL, nor limited to evaluation.

This change is very important, which means that Astra has been regarded as a high-capacity system requiring special control within OpenAI.

In Addition, Promote Alignment Research

OpenAI stated that for RL training of its most capable models, core alignment technologies are now being applied to more training stages. These include:

Improving the reward model so that it can more accurately identify and suppress unsafe behaviors in different tasks and environments;

Training models to more honestly describe their own actions, capabilities and limitations;

Reducing the behavior of models exploiting vulnerabilities in reward mechanisms, scorers, tools or supervision systems.

At the same time, OpenAI is also expanding the coverage of relevant training, focusing on training for behaviors that may cause harm when the model interacts with external systems or resources. OpenAI stated that it will continue to invest heavily in alignment research in the next step, expand evaluation coverage, and apply the research results to guide subsequent training and security protection.

It is worth mentioning that OpenAI left a sentence at the end of the article: "The capabilities of cutting-edge models are accelerating rapidly. Our ability to understand, align and protect these models must stay ahead."

But now the problem has become more and more realistic: as models continue to become more powerful, can security capabilities really always stay ahead of them?

As things stand, OpenAI's choice is: stop the model first.

So what about you, what do you think of OpenAI's approach?

References:

https://x.com/OpenAI/status/2089777845187031262

https://www.reuters.com/technology/openai-slows-model-training-bolster-security-after-hugging-face-hack-2026-08-18/

https://www.theverge.com/ai-artificial-intelligence/981640/openai-security-changes-ai-hugging-face-hack

https://techcrunch.com/2026/08/18/openai-institutes-new-safeguards-after-hugging-face-breach/

This article is from the WeChat official account "Synced" (ID: almosthuman2014), written by AI-focused contributors, and is republished with authorization from 36Kr.