Over recent weeks two developments highlighted rising risks from increasingly capable AI systems: the OpenAI–Hugging Face incident and preliminary evidence that one of our upcoming models, Astra, may meet a Critical cybersecurity capability threshold under our Preparedness Framework. Those developments, together with rapid internal research progress, increased the urgency of strengthening monitoring, alignment, and containment safeguards across every stage of training.
As models gain capability, the risks of developing and testing them internally grow as well. Our monitoring, alignment, and security standards must stay ahead of those risks. To give ourselves the time to meet those standards, we temporarily slowed the pace of scaling. That included a two-week pause in reinforcement learning (RL) training on our latest models intended for deployment while we further hardened and red-teamed our research environments and expanded monitoring coverage. Our largest planned frontier RL run remains on hold while we run smaller-scale trainings and evaluations to assess model behavior, validate safeguards, and gather more evidence of alignment before proceeding.
Alignment — the work that makes AI systems behave as intended and responsive to human oversight — has long been core to our research program. We now require stronger evidence of aligned behavior throughout all training stages, building on research and evaluations already underway. Keeping increasingly capable systems aligned is a challenge the whole field will need to address. Signals from upcoming model progress make clear we need a broader approach that extends beyond the current Preparedness Framework.
We believe transparency about how our approach is changing is important. Below we describe changes already made to research processes and infrastructure, and work still in progress.
Our approach to developing more capable models rests on three reinforcing safeguards:
- hardened security and operational standards for research environments;
- multistage monitoring with rapid escalation and response;
- extended alignment methods applied across more stages of training.
We apply these safeguards across research and deployment, adapting them to each model’s capabilities, operating environment, and level of risk.
As frontier models demonstrate stronger cybersecurity capabilities, we raised the security bar for the environments where we train and evaluate them. Meeting those standards required substantial engineering effort and has caused cost and delays for frontier research. Immediately following the OpenAI–Hugging Face incident, we paused frontier model inference in research clusters for runs that could execute code or use tools that might access the internet. We restored a more limited, secure path for code execution fairly quickly, then reviewed each workload individually to determine whether it could safely resume. Some research workloads resumed under the new controls; others required additional changes.
In the weeks since, we have defined and begun implementing stronger security requirements for frontier research workloads. This process strengthens defenses at multiple points, including hardening research environments, conducting red-team testing, and expanding monitoring coverage. Today we require the strictest level of security safeguards for workloads involving Astra or other cyber models, because we determined that Astra may have critical cyber capability. Those safeguards also apply to all other cyber-related workloads.
While some Astra training and evaluations already meet these requirements, a significant number of workloads remain paused until they are fully migrated and enhanced to meet the new security bar. We are prioritizing safety and alignment workloads for migration into these environments first.
Monitoring has long been an important part of our model development process, including for internal coding agents and long-running sessions. We focused monitoring especially on internal deployments of frontier models and frontier RL runs, which we considered the highest-risk workloads because they can combine advanced model capabilities with access to tools, sensitive systems, and networks. Monitoring was not applied to all inference and training runs that used tools. We have revised and expanded our approach with a new monitoring setup.
The new monitoring setup is multistage: activation classifiers (detectors that inspect a model’s internal activity) run at every sampled token and escalate potential concerns to increasingly sophisticated, high-compute automated investigators. Those systems examine tool actions, available reasoning, and the full activity sequence for unauthorized access, data theft, destructive behavior, and attempts to defeat safeguards. We aim to issue an alert within 30 minutes after concerning activity is surfaced. If the monitoring system identifies a likely violation of a critical security boundary, it generates a highest-priority alert. In the current implementation, the safety, security, and research teams are paged. If they cannot conclusively determine within 30 minutes that the flag is a false positive, those teams are expected to pause the activity.
This monitoring is required for all RL training and evaluations that involve tools for models of Sol capability or higher. After we determined that Astra may have critical cyber capabilities on August 7, we added a monitoring requirement for all Astra inference with tools (not just RL training and evaluations).
These safeguards incur meaningful compute costs. Our current estimates put monitoring overhead at roughly 20% of the inference compute being monitored, though the cost varies substantially across training and evaluation workloads. We will share more details about this system in a forthcoming blog post.
Alignment research remains central to our mission. Our mission is to ensure that artificial general intelligence benefits all of humanity. As models gain advanced capabilities, such as the ability to cyberattack, and operate in more complex environments, misaligned behaviors like reward hacking (finding ways to receive high reward in training without achieving the intended outcome), deception, or unauthorized access will create increasing risk.
For RL runs on the most capable models, we are now applying our core alignment techniques across more stages of the training process. This includes improving reward models to better detect and discourage unsafe behavior across tasks and environments; training models to be more honest about their actions, capabilities, and limitations; and reducing behaviors that exploit weaknesses in rewards, graders, tools, or oversight. We are also increasing training coverage for behaviors that could cause harm when models interact with external systems or resources.
We continue to invest aggressively in alignment research, expand evaluation coverage, and use what we learn to inform training and safeguards. We plan to share substantially more about our alignment research in the near future, including lessons about model behavior and any novel challenges we uncover.
We will evolve our Preparedness Framework to integrate these safeguards across training and deployment and to better reflect the capabilities of future models and the environments in which they operate. Developing methods that scale with those capabilities will require sustained investment in model-assisted security, more effective monitoring, and continued advances in alignment research. We intend to involve external organizations and share more of what we learn as our approach develops.
Frontier model capabilities are accelerating rapidly. Our ability to understand, align, and secure them must stay ahead.
We will publish a technical report of our learnings in the coming weeks.
