AI Brief, 2 September 2026: OpenAI calls a model Critical for cyber, and restarts the run it paused

Two American labs published their positions on offensive cyber capability on 1 September, hours apart, and between them turned an argument that has been conducted in the abstract for a year into a set of published numbers.

OpenAI went first, at 13:00 UTC, with a post on Astra, an unreleased model it says meets the Critical cybersecurity capability threshold in its Preparedness Framework. It is the first model OpenAI has designated at that level. The post also resolves something this brief has been carrying since 19 August. The frontier reinforcement learning run OpenAI paused after the Hugging Face incident is running again: it restarted on 28 August, once what OpenAI describes as higher bars for the safety and security of the training environment were in place, and some smaller experimental runs remain held back. The 27 August issue named the restart date as the substantive thing to watch. That is the answer, and it comes with a wrinkle, because OpenAI's earlier page on the pause is still live and still says the largest planned run remains on hold.

Anthropic followed later the same day by releasing Claude Fable 5.1 and Claude Mythos 5.1. The two are the same underlying model carrying different safeguards. Fable 5.1 is generally available; Mythos 5.1 goes only to vetted cyberdefenders and life scientists through two access programmes. Anthropic benchmarked both and published both, which means there is now a public figure for what a frontier lab's own safety layer costs in capability. On Terminal-Bench 4.0 at maximum effort the restricted model scores 55.8% and the permissive one 60.9%. At high effort the gap is 7.7 points. Same weights, different refusals.

Both sets of figures are the labs' own. No third party has evaluated Astra at all, and the only independent measurement of Fable 5.1 comes from Artificial Analysis, which discloses in its first sentence that it did pre-release evaluation work for Anthropic. Read on that basis, the day still moved: a year of "what if a model gets good at this" now has two labs saying it has, and shipping different answers to what follows.

• OpenAI designated Astra at the Critical cybersecurity threshold, the first model at that level. Nothing is released: no weights, no API, no price, and the system card comes at launch.
• The paused frontier RL run restarted on 28 August, four days before the announcement.
• Astra's "perfect score of 100%" is on a public exploit suite OpenAI itself flags for contamination. On its uncontaminated internal port, 20 high-severity V8 vulnerabilities, Astra reaches 39% and GPT-5.6 Sol reaches 11.5%.
• Fable 5.1 and Mythos 5.1 are one model with two safeguard configurations, released 1 September. Fable 5.1 is live on the Claude API, Bedrock, Google Cloud and Azure as claude-fable-5-1.
• Cache reads fall 75% to $0.25 per million tokens. Input stays at $10 and output at $50.
• Artificial Analysis scores Fable 5.1 at 65.65 on its Intelligence Index against Claude Opus 5 at 63.05, and measures cost per task about 20% higher than Fable 5.
• New Claude API accounts can no longer edit a prior assistant turn while preserving its thinking transcript, an anti-distillation change with immediate consequences for some integrations.

OpenAI declares a model Critical for cyber #

The Preparedness Framework's Critical threshold for cyber requires a model to produce functional zero-day exploits of all severity levels against many hardened real-world systems without human intervention, or to build end-to-end novel attack strategies against hardened targets from a high-level goal. OpenAI says Astra meets it. Nothing about the model itself is disclosed: no architecture, no training recipe, no scale. A widely repeated claim that Astra uses "recurrent depth" is secondhand reporting attributed to The Information; the string does not appear anywhere in OpenAI's own post, and it should not be attributed to OpenAI.

The evaluation numbers need care, and OpenAI supplies most of the care itself. The headline is a 100% score on ExploitBench, which measures exploit development from known vulnerabilities and which OpenAI flags for contamination. So OpenAI built a clean port: 20 high-severity V8 vulnerabilities from June to August 2026, after the plausible training cutoff. On that port the curve tells a different story.

Astra's 39% is reached at about 76,000 output tokens per task; Sol's 11.5% takes roughly 138,000. A denominator of 20 means each vulnerability is worth five percentage points, so the gap is real but the resolution is coarse. And an italicised line under the chart carries the most important caveat in the post: the Astra results shown reflect capabilities with a privileged access configuration, not the default production one. The Critical designation is a statement about a model nobody outside a tester group will be given. During that evaluation the model found and chained two zero-days that have not been disclosed to maintainers.

The safeguard figures are the other half. OpenAI reports Astra refusing 91.5% of its internal cyber jailbreak set against 59% for GPT-5.6 Sol, which also means 8.5% non-refusal at a capability level OpenAI has just called Critical. On an ExploitGym honeypot run without production safeguards and in observation-only mode, Sol attempted the flagged targets in 55.4% of tests and Astra in none, solving 1.3% legitimately. Users will feel this: OpenAI says the monitor can flag legitimate work, and where ChatGPT and Codex ask you to review and continue, on the API the task simply stops.

Anthropic ships the same weights twice, and publishes the gap #

Fable 5.1 and Mythos 5.1 are, in Anthropic's words, the same model with different levels of safeguards. That makes the pair an unusual experiment, because the difference between their scores on a shared benchmark is not a capability difference at all. It is the tax the safety layer levies.

The shape is worth more than the headline. The gap is 1.5 points at low effort and 7.7 at high, then narrows again to 5.1 at maximum. Cheap runs rarely reach the tasks the safeguards guard; longer ones do. Anthropic says the difference reflects tasks where its earlier, less precise cyber safeguards intervened, and expects it to shrink now that Fable 5.1 is permitted to identify software vulnerabilities, though not to write exploits for them. Claude Code users should see around 60% fewer cyber-safeguard interventions per session. Penetration testing, exploit generation and binary-based vulnerability scanning still get redirected to Opus models.

That redirection is also why the comparison table should be read as measuring a system rather than a model. Anthropic states it plainly: Fable 5.1 was evaluated with production safeguards on, tasks where the safeguards intervened scored zero on OSWorld 2.0 for both Fable versions and on AutomationBench for Fable 5, and every other intervention was completed by Claude Opus 4.8 or Opus 5. So AutomationBench going from 17.1% to 31.4% is partly a model improving and partly a safety layer firing less often. The Terminal-Bench-Science 0.1 jump, 24.7% to 52.6%, carries a stated standard error of 3.5 to 4.5 points per model, and Anthropic used its own reproduction of the Fable 5 baseline, 24.7%, rather than the public leaderboard's more flattering 21.4%. No provenance is given for the GPT-5.6 Sol column at all.

Artificial Analysis is the one outside measurement, and it opens by saying it supported Anthropic with pre-release evaluation, so it is independent in method rather than arm's length. Its Intelligence Index puts Fable 5.1 at max effort on 65.65 against Claude Opus 5's 63.05, a real move of 2.60 points rather than the three the rounded display suggests, and it notes that the configuration it tested routes safety-flagged requests to Opus models, which served about 4% of output tokens. Its AA-Omniscience score is flat, 43.45 against Fable 5's 43.3, with accuracy up to 67.2% from 65.4% and the hallucination rate on non-correct answers up to 72.6% from 63.6%. More right, and more confidently wrong when wrong.

The price cut is real, and smaller than the discount #

Cache reads now cost $0.25 per million, down 75% from $1.00. Input and output are unchanged at $10 and $50. Anthropic's indexed chart, measured on four weeks of real August usage at default effort, shows a typical workload falling from 100 to 75 and a highly agentic one from 100 to 55. Those are the 25% and 45% headline savings. But the same chart gives the split, and the arithmetic does not quite land where a pure price cut would:

# Anthropic's indexed cost chart, highly agentic workload. Fable 5 = 100.
cache_reads, other = 65.0, 35.0            # how the Fable 5 bill splits
price_only = cache_reads * 0.25 + other    # same tokens, new cache price
print(round(price_only, 2))                # 51.25  -> a 48.8% saving

# Anthropic's chart puts Fable 5.1 at 17 + 38 = 55, a 45% saving.
# The missing ~4 points are extra tokens: 5.1 consumes more of both kinds.
print(round(17.0 / (65.0 * 0.25), 3))      # 1.046  -> 4.6% more cache reads
print(round(38.0 / 35.0, 3))               # 1.086  -> 8.6% more other tokens

Artificial Analysis, holding the task set fixed rather than the workload, measures the same effect larger: $3.69 per Intelligence Index task at max effort against Fable 5's $3.14, about 20% more, because the new model spends roughly 1.7 times the output tokens. Both things are true. If you replay the same context-heavy agentic traffic you will pay less; if you buy a fixed amount of finished work at the top effort setting you may pay more. Which one you are doing decides whether this is a price cut.

One other change lands today with no migration window. Anthropic has closed a documented distillation route: accounts created from 1 September onwards can no longer edit an earlier assistant turn while keeping that turn's thinking transcript intact.

# The pattern that stops working on new API accounts: rewrite the visible text
# of a prior assistant turn, keep its signed thinking block, and re-send.
prior = messages[-2]["content"]
prior[1]["text"] = "A cleaner answer supplied by the caller."   # edited
# prior[0] is the signed thinking block, forwarded verbatim      <- now rejected

Existing accounts are unaffected for now, but Anthropic says the restriction applies to everyone at the next model release, so integrations that rewrite assistant turns have a deadline rather than an exemption.

Ai2 fits item response theory to sixteen benchmarks #

Ai2 published BenchMIRT at 21:39 UTC, a multidimensional item response theory fit over 100 models and 34,301 benchmark items, of which 29,574 survive filtering for items everyone or nobody gets right. The model is a two-parameter logistic generalised to vectors: the probability that model $i$ answers item $j$ correctly is

$$P(U_{ij}=1\mid {\theta }_i)=\sigma (a_j\cdot ({\theta }_i-b_j))$$

where ${\theta }_i$ is the model's latent ability, $a_j$ the item's discrimination, $b_j$ its difficulty, and $\sigma$ the logistic function. Making $\theta$ , $a$ and $b$ vectors rather than scalars is the whole move: two latent factors fall out, one tracking general reasoning and one tracking safety behaviour, and the item table then says which factor each benchmark question actually loads on.

The results are uncomfortable in a useful way. BBQ, filed as a safety benchmark, discriminates on the reasoning axis (mean 2.83) and not on the safety one (mean −0.05). GPQA is the noisiest set in the study: 27.7% of its items discriminate below 0.5 on both axes. Ai2 reports that keeping the 10% most discriminative items reproduces model rankings, and that its fit predicts held-out responses at 79% accuracy against 70% for a benchmark-average baseline, though on rank correlation the dumb baseline wins, 0.89 to 0.81. The report acknowledges the circularity: the ground truth for judging benchmarks is benchmark scores, and the two-factor structure partly follows from having chosen six reasoning benchmarks and ten safety ones. The model pool also stops at March 2025. The eval data is CC BY 4.0 and the fitted weights Apache 2.0; the code repository carries no licence.

Also notable #

• Gemini gets agentic video. Google shipped an agentic video processing mode across Gemini 3.7 Flash, 3.6 Flash and 3.5 Flash-Lite at 17:00 UTC, available now with no waitlist and no feature fee. Instead of ingesting frames at a fixed rate, the model calls an internal tool to load only the segments it wants. The claimed savings, up to 88% fewer tokens and up to 66% lower cost, are self-reported, are all "up to" figures, and the post names no benchmark at all.
• Copilot can now approve pull requests. GitHub put an admin-enabled setting into public preview that lets Copilot's review count toward a repository's required-approvals rule. It is off by default, configurable at enterprise, org and repository level, path-restrictable, and dismissed on new commits like any human review. The changelog does not say whether it may approve a pull request it authored.
• Anthropic's watermark detection API is in private preview. The mechanism is a sampling-time watermark derived from Google DeepMind's SynthID-Text, not a classifier, applied to models released after 2 August 2026 under the EU Code of Practice on Transparency of AI-Generated Content. Anthropic publishes no detection rate, no false-positive rate and no length threshold, and says detection is weak on short, factual or lightly edited text and on code, which is most of what the named audiences would want to check.
• The Codex desktop app ships LibreOffice. Simon Willison found 1.7 GB of runtime under ~/.cache/, including a 429.7 MB headless LibreOffice, 187.9 MB of poppler and 148.1 MB of git, invoked by document-handling skills. No response from OpenAI is recorded.
• A Venus elevation map, openly licensed. Anthropic says Fable 5.1 trained a network on 30-year-old Magellan radar to map a third of Venus at 2 to 3 km resolution, and released the result under a Creative Commons licence. Unlike most of the day's claims, that one is downloadable.
• Cognition is reported raising about $1 billion at roughly $47 billion, per Bloomberg. No Form D appears in EDGAR and Cognition's own blog says nothing, so treat it as reported, not filed.

What to watch #

• Whether OpenAI reconciles its two live pages. The 27 August post still states that the largest planned frontier RL run remains on hold, four days after the run it describes restarted. One of those documents is stale, and which one gets corrected says something about how the disclosures are maintained.
• Whether anyone outside OpenAI evaluates Astra. Every cyber number published yesterday is OpenAI's own, on a configuration that is not the production one, with a denominator of 20. No government body, external red team or academic group is named anywhere in the post.
• The two undisclosed zero-days. Astra found and chained two live V8 vulnerabilities during evaluation. OpenAI has not said whether or when they go to maintainers, and that is now a coordinated-disclosure question with a public clock on it.
• Whether the Fable and Mythos gap actually narrows. Anthropic expects the 5.1-point Terminal-Bench difference to shrink under the new safeguards. It published the number that makes the claim checkable at the next release, which is more than most labs do.
• DeepSeek-V4-Flash-Vision-Exp remains untested independently. Monday's issue asked whether Artificial Analysis would re-run it once weights existed. Its changelog has added nothing for that model, so the 9.7-point Terminal-Bench discrepancy still rests on one measurement.
• Gemini 3.8 Flash was reported for today. The Wall Street Journal says Google planned to ship it as soon as Wednesday, with Gemini 4 still in post-training. Nothing had appeared on the Gemini API changelog as this issue went out.