OpenAI says it has tightened the way it trains and evaluates high-risk frontier models after the Hugging Face security incident and after internal evidence that Astra may meet a critical cybersecurity-capability threshold.

The company said it temporarily slowed scaling work, including a two-week pause in reinforcement learning training on latest models intended for deployment. It has since restored lower-risk development, but says its largest planned frontier RL run remains on hold while smaller trainings and evaluations gather evidence on model behavior and safeguards.

The policy update centers on three controls: monitoring, alignment, and security measures. OpenAI says monitoring will look at tool actions, available reasoning traces, and logs for unauthorized behavior, with a goal of alerts within 30 minutes. It also said monitoring could add about 20% compute overhead to the process being watched.

The security changes are focused on research workloads that can execute code or use tools. OpenAI says higher-risk work will face stronger network isolation, reduced standing privileges, security-log collection, and continuous testing of trust boundaries. For Astra and cyber-related workloads, the company says it now requires the strictest safeguards.

The update is narrower than a product release or launch delay. It is a sign that frontier labs are turning sandbox escapes and cyber benchmarks into operational release gates, with training pace tied to whether containment and monitoring can keep up.