On August 18, 2026, Beijing time, OpenAI disclosed that its reinforcement learning training for the latest model to be deployed had been suspended for two weeks, and the largest planned cutting-edge reinforcement learning training had not resumed as of the time of the announcement. The company said it is currently only conducting smaller-scale training and evaluation to check model behavior, verify protective measures and accumulate more alignment evidence. This suspension is not a shutdown of all model research or training of OpenAI, and the announcement does not give a date for the restart of the largest training.
Adjusting the background: Hugging Face incident and possible critical-level network capabilities of Astra
OpenAI divided the background of the adjustment into three parts: the previous OpenAI and Hugging Face security incidents, the upcoming Astra model that may touch the critical level network capability threshold defined by the company's Preparedness Framework, and the rapid progress of internal research. The company used the statement that it "may" reach the threshold, and did not announce the completion of the final capability determination, nor did it provide the results of independent testing of Astra's network capabilities by external agencies.
After the Hugging Face incident, OpenAI immediately suspended part of the cutting-edge model inference in the research cluster, ranging from running tasks that can execute code or use tools that may have access to the Internet. The company said that the more restricted and safer code execution path was subsequently restored, and the team then judged whether each workload can continue one by one; some have been restarted under new controls, and others still need to be modified. Officials did not list the number of affected tasks, itemized recovery status, or the location of the research cluster.
Research environmental isolation measures and ongoing safety testing
The new research environment requires that isolation be dealt with first. Workloads running model generation code or other untrusted code must enter a stronger sandbox, as does software that processes model output and may be attacked; network controls are added between high-risk and untrusted workloads and the Internet, and the design goal is that when a single workload or supporting service is compromised, unauthorized Internet or internal network access cannot be obtained based on that breach alone. OpenAI also removes potentially vulnerable shared services, reduces resident permissions, and adjusts trust boundaries.
Continuous security testing is another part. OpenAI said it is strengthening the collection and monitoring of security logs and investing in automated systems to allow models to continuously conduct simulated attack tests on the boundaries of the research environment. Workloads involving Astra or network models are subject to the most stringent security levels currently available; some Astra training and evaluations are already compliant, but a large number of workloads remain on hold until they are migrated and hardened to the new standard. The company has prioritized security and alignment workloads for migration and has not released a complete migration schedule.
New surveillance system and its goals
The new monitoring system is divided into several stages. The first layer activates the classifier to check the internal activities of the model on each sampled token. If potential problems are found, they are handed over to the automatic investigation system with higher computing power. The latter checks tool actions, available inference records and complete activity sequences to search for unauthorized access, data theft, sabotage and attempts to bypass protection. OpenAI claims that the old solution focuses on internal cutting-edge model deployment and cutting-edge reinforcement learning training, but does not cover inference and training of all tools used. The new solution expands the scope of application.
The goal set by OpenAI is to issue an alert within 30 minutes after the monitoring system detects suspicious activity. If the system determines that a critical security boundary may have been violated, it will generate the highest priority alarm and notify the safety, security, and research teams; if the team cannot clearly determine that it is a false alarm within 30 minutes, the expected approach is to suspend related activities. This monitoring applies to all reinforcement learning training and evaluation of models using tools and capable of reaching Sol or higher levels; starting from August 7, all Astra inference with tools has also been included in the additional requirements.
Alignment Measures and Technical Reporting Plan
The company estimates that the computing power required for current monitoring is approximately equivalent to 20% of the inference computing power being monitored, indicating that there are significant differences between different training and evaluation workloads. In terms of alignment, OpenAI said it has expanded the application of core technologies in all stages of reinforcement learning for high-capability models, including improving reward models, training models to more accurately describe actions and constraints, and reducing the use of rewards, scorers, tools, or supervision weaknesses. Both TechCrunch and The Verge’s information flows that day summarized the updates as adjustments to the research environment, monitoring and alignment measures.
As of the announcement, OpenAI has not disclosed the false positive rate, false negative rate, independent audit results or complete technical implementation of the monitoring system, nor has it disclosed the model parameters, training computing power, total workload, recovery date and commercial release time involved in the suspended training. About 20% of the expenses and existing control coverage come from the company's self-report and cannot be used as independent proof that the protection has been effective. OpenAI said it would introduce the monitoring system in a follow-up article and planned to release a technical report on the Hugging Face incident in the coming weeks; these materials had not yet been made public at the time.