OpenAI built a model so good at hacking it needs its own release category
Issue #029 · 4 min read
OpenAI built a model so good at hacking it needs its own release category
Astra crosses a safety line OpenAI drew itself. Plus GitHub lets Copilot approve its own PRs.
The big story
OpenAI has a model, code-named Astra, that is good enough at cybersecurity to trip its own alarm.
It's the first OpenAI model to hit the "Critical" capability threshold under the company's own Preparedness Framework — a bar OpenAI set for itself and is now the first to clear, according to OpenAI's own release notes.
That threshold exists for exactly one reason: to flag models that could meaningfully help someone break into systems they shouldn't.
Astra cleared it.
So OpenAI is shipping it anyway, with what it calls "stronger safeguards."
Outside researchers are not reassured. Astra reportedly uses a new technique called "recurrent depth," which lets it reason outside the normal step-by-step chain that other reasoning models use — and safety researchers say that makes it harder to watch what the model is actually doing while it thinks, according to TechCrunch.
The Verge went further and talked to researchers who used the word "disaster" — see their reporting.
There's a second layer here worth sitting with. The Register reports that the usual defenses — sandboxes, permissions, virtual machines — aren't holding up against frontier models, and some researchers now want "data diodes": hardware that only lets information flow one way, so a model literally cannot send anything out even if it wanted to.
That's not a software patch. That's rebuilding the wiring.
For product teams, the read is simple. If you're evaluating Astra for anything that touches a network or a codebase, don't take "stronger safeguards" as a settled fact — read what the safeguards actually restrict before you wire it into anything with write access.
What shipped
Google shipped its third Gemini Flash model in six weeks. Gemini 3.8 Flash "works harder" but may cost more, per The Verge, and Ars Technica notes the Pro line has gone quiet while Flash keeps iterating. If you're pricing anything against Gemini Flash, check your assumptions weekly right now — the SKU you benchmarked in July isn't the SKU you're being billed for in September. It's already live on Vercel's AI Gateway if you want to try it without waiting on a direct integration — see the changelog entry.
GitHub Copilot can now approve its own pull requests. Admins have to opt in, and it's off by default, per the changelog. This is a real workflow decision, not a toggle to flip on autopilot: if you're the PM who owns the eng team's review process, this is worth a five-minute conversation with your eng lead about which repos, if any, are low-stakes enough to let a model sign off on merges.
Google Pics puts image generation and editing straight into Workspace, built on the company's Nano Banana model — see the announcement. Worth a look if your team is currently bouncing between a chat tool and a doc to make a slide graphic; this collapses that into one place.
What I'd actually do this week
- If you use OpenAI models anywhere near code execution or network access, read the Path to Astra page yourself before your security team asks you what "Critical" means — you want to be the one explaining it, not the one being asked.
- Pull up your current model bill and check whether you're still paying for a Gemini Flash version that's two releases behind — three releases in six weeks means your finance team's assumptions are stale.
- If your org is anywhere near turning on Copilot's auto-approve, get eng and security in the same room before it happens by accident on a repo nobody was watching.
Reply if you've already got Astra or Gemini 3.8 Flash in a real workflow — I want to hear what actually broke.
Tools mentioned
- Astra OpenAI
- Gemini 3.8 Flash
- Gemini 3.8 Flash on Vercel AI Gateway
- Copilot code review approvals
- Google Pics