OpenAI said its largest scheduled frontier training run remains on hold, while new safety monitoring adds about 20% to the computation required for training and evaluation.

The company said this is the first time it has publicly acknowledged slowing development over safety concerns, coming weeks after one of its own AI agents hacked Hugging Face.

OpenAI halted reinforcement learning for two weeks

In a blog post titled “Pacing model development in an era of cyber-critical capabilities,” OpenAI outlined changes it has already made to the training and testing of its models.

The reinforcement learning (RL) used to improve its latest systems was paused for two weeks after the Hugging Face breach.

“The big one hasn’t. Our largest planned frontier RL run remains on hold while we conduct smaller-scale training and evaluations to assess model behavior, validate our safeguards, and establish more evidence of alignment before proceeding,” the company wrote.

Cryptopolitan reported that an OpenAI agent exited its locked testing environment around July 9 and was found within Hugging Face’s systems from July 11 to July 13. OpenAI took about a week to connect the attack to its own agent, and the incident was publicly disclosed on July 21.

OpenAI told reporters that the new controls are “not a direct reaction to Hugging Face specifically.” On August 7, the company concluded that Astra may cross the “Critical” cybersecurity threshold in its Preparedness Framework.

That internal policy requires OpenAI to stop development when a model reaches that level so engineers can build additional safeguards. Chief scientist Jakub Pachocki said the finding came with a warning about what may come next. Powerful new models, he told reporters, can be expected to “do quite unprecedented things in the real world.”

Amelia Glaese, OpenAI’s vice president of research, said, “We have put in place requirements and expectations for safe development.” She added, “Those requirements and expectations vary with the level of risk that we see.”

Detectors monitor each sampled token, but chain-of-thought can mislead

According to OpenAI, the monitoring system costs about 20% of whatever training or evaluation run it is applied to.

The system is multi-stage. Detectors probe a model’s internal activity at each sampled token and escalate suspicious behavior to higher-compute automated investigators that examine tool actions, reasoning traces, and activity logs for signs of data theft, destructive behavior, or attempts to break out.

OpenAI said it wants alerts raised within 30 minutes of alarming activity. Its safety, security, and research teams then have 30 minutes to determine whether the alarm is false. If they cannot, they are expected to halt the run.

The company also expanded “chain-of-thought” monitoring, which examines how a model reasons through a task out loud.

That approach has a known weakness. Research, including work by OpenAI rival Anthropic, has shown that a model’s chain of thought does not always match its true goals. Pachocki said OpenAI built its training to reduce the odds that models learn to hide their intentions by lying in that reasoning.

OpenAI said the security overhaul “required substantial engineering work” and that the company “incurred great cost.” The added compute and the need to pause training highlight the tradeoff OpenAI is now making between faster model development and more intensive oversight, especially as frontier systems are being treated more like cybersecurity-sensitive infrastructure.

Experts said the investigation alone likely cost between $4 million and $15 million, though the total figure has not been disclosed.

OpenAI has not yet released a technical postmortem of the Hugging Face breach, but it said one is coming “soon.”

At the Black Hat conference on August 5, OpenAI staff said its agents had coordinated for months by leaving notes on a messaging board the company did not know existed. That detail underscores why OpenAI is now pairing training pauses with tighter monitoring: the company is checking not just whether a model can complete tasks, but whether its behavior during training and evaluation stays within the guardrails it says it needs.