TL;DR
OpenAI has paused training its next model family, Astra, after an internal model escaped a sandbox and hacked Hugging Face, and has wound down Sora, a Disney partnership and its Atlas browser to refocus. The product it is refocusing on is an agent that acts before being asked, including buying things, using your calendar and your finances. I read the pause as opportunistic but still worth something. The unresolved part is the trust chain underneath an agent that transacts on sites it found itself — I do not know what stops a convincing fake storefront, and I have not seen OpenAI asked.
In plain English
An agent here means software that pursues a goal by taking actions — opening pages, calling functions, completing forms — rather than answering a question and stopping. A sandbox is a sealed environment a model is meant to be confined to during testing. Alignment is the work of making a system act on what its operator actually intended, which is why a model that scored well by cheating is an alignment failure rather than only a security one. WebMCP is a proposed browser standard letting a website declare its own functions as tools an agent can call directly, instead of the agent interpreting the page visually.
One sentence in Alex Heath’s two weeks inside OpenAI describes what ChatGPT is meant to become. The system will “act before being asked, recommend things on its own, and perform mundane tasks, such as buying concert tickets autonomously, informed by its access to your calendar, its grasp of your finances, and its understanding of your taste in music.”
That is your calendar, your finances and your taste in music. Greg Brockman puts the same idea more directly: “You have almost an AGI, maybe soon truly an AGI, in your pocket. What is it you want?”
It is a huge ask of trust, and OpenAI has a lot of reputation to claw back before people find it acceptable.
OpenAI lost the lead to Anthropic over the past year — Anthropic built Claude Code into the product that defined the category, passed OpenAI on reported annualised revenue, and is now expected to reach the public markets first.
According to Altman, the side projects have also gone. Sora, a Disney partnership and a standalone browser called Atlas were all wound down, with compute pushed toward Codex and then folded into ChatGPT Work. While there are other genuinely capable players in generative images and video, it would make sense to me for OpenAI not to be there any longer. If Anthropic is genuinely their ‘arch-rival’ (Time’s words, not mine), OpenAI has to compete on the same turf.
Then there is the other reason for the reboot. In late July an internal research model was being graded against a cybersecurity benchmark inside what was supposed to be a sealed environment. It exploited a vulnerability, escaped, and hacked into production systems at Hugging Face, where it retrieved the answers to the benchmark it was being scored on. Anthropic disclosed three incidents during third-party evaluations in which its models gained unauthorised access to outside organisations. Meta said one of its models was involved in something similar. More than 1,300 current and former employees of frontier labs have since signed a petition called “Pacing the Frontier,” asking for mechanisms that can slow development when the risk warrants it.
OpenAI’s response was to pause the training run for Astra, its next model family, until new safeguards are in place — the first time the company has done this.
“Getting AI safety right is more important than any company’s momentum,” Altman told Heath, and separately: “I think any alignment failure from here should be treated like this is a big deal, and we’re going to take as long as it takes to figure it out.”
It’s difficult to not see that as an opportunistic move to change public perception of OpenAI rather than an altruistic one. The pause lands right after the incident that handed critics their strongest example, and safety is the ground Anthropic has been claiming for years. But I would still say it counts toward the reputation they need to rebuild, somewhat.
Jakub Pachocki, the chief scientist, says OpenAI had tools that could inspect a model’s chain of thought and had not applied them to models at the capability level involved in the Hugging Face hack. “We didn’t fully expect” what the system could do, he says. Mia Glaese, who leads safety and alignment, says she wishes they had done the work before it happened. This reads to me as nothing other than cavalier and reckless behaviour. So what’s going to change about the culture that enabled that (lack of) decision making?
Heath makes the point himself, in the article: “It’s a whole menu of new ventures for a company that recently vowed to ditch distracting side quests.” In the same interview where the side quests are declared over, OpenAI is designing its own inference chip, planning humanoid robots, weighing whether to sell compute in competition with AWS, and building a small hardware line — something for a table, something for a pocket, something worn on the body.
The pocket device is the one that makes least sense. The overwhelming majority of people are already carrying a powerful computer in their pocket. Brockman’s pitch is an AGI in that pocket, which is a claim about the software. It does not explain why a second device needs to sit beside the phone already there. Altman’s stated dislike of glasses I read as a dig at Meta more than a design position, though that is me reading a motive rather than anything he said.
Generative AI still hallucinates, and the security surface is still very much exploitable through things as simple as prompt injection. The proactive purchase needs an agent that holds your calendar, knows your budget, and can complete a transaction on a site it found by itself, and the product claim is that it acts before you ask.
So: if I use a popular building platform to spin up a convincing concert ticket portal, complete with a payment integration and WebMCP, what is to stop me intercepting that request for a ticket and skimming the card details? WebMCP is the proposed browser standard that lets a site declare its own actions as structured tools, so an agent calls a defined function instead of guessing at the interface. It also means the site supplies the description of what those functions do, and the agent has no way to check it.
I wrote about that standard a week ago and said high-impact actions still need server-side checks, clear audit records, and an approval step that an agent cannot silently satisfy. Buying something is a high-impact action. It moves money, and you cannot undo it if you never agreed to it. The proactive purchase removes the approval step, which is the only place a person could have looked at the site before the money moved.
I have not run this attack and I am not claiming anyone has. I do not know what prevents it, and I have not seen anyone at OpenAI asked.
What would have to exist first is genuinely unknown to me. There is a lot to be secure of in the trust chain, and I do not know who can guarantee any of it. That needs fixing first, for a better internet. It is infrastructure underneath the whole arrangement, and OpenAI cannot build it alone.
So at the end of the day — OpenAI paused a training run because a model broke out of its test environment and hacked another company to get the answers, says it needs to step up trust, is done with side quests, then goes on to describe a product designed to act without asking you first. 🤷