Cannot rule out — the clause that does not fire

OpenAI cannot exclude that an unreleased model reaches its own Critical cyber threshold, and responded with weight and infrastructure security rather than deployment gating. Under the AI Act the reporting clause everyone reaches for does not engage: Article 55(1)(c) is defined by the Article 3(49) serious-incident test, which needs realised harm. What binds is the quieter cybersecurity duty in 55(1)(d), now enforceable by the Commission since 2 August 2026 — and for the deployer, the Article 53(1)(b) and Annex XII entitlement to capability information.

Post

OpenAI did not say its new model can write zero-days. It said it cannot rule that out. Only one of those sentences made the headlines.

On 7 August OpenAI published a note on Astra, an unreleased model. The wording is careful: "our preliminary evaluations indicate strong enough performance that we cannot rule out Critical capability level at this time."

Critical, in OpenAI's own Preparedness Framework, means a tool-augmented model that can "identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention." Previous models, GPT-5.6-Sol included, were assessed at High.

What did they do? Paused internal activities on Astra that do not meet strengthened controls: isolated testing environments, restricted network and tool access, enhanced weight protection and encryption, sandboxing.

Notice what that list is. Not deployment gating. Weight security.

Now the European part, and it is not the article you expect.

Reach for Article 55(1)(c) — report serious incidents to the AI Office without undue delay — then read the definition it leans on. Article 3(49) needs death or serious harm to health, irreversible disruption of critical infrastructure, infringement of fundamental-rights obligations, or serious harm to property or the environment.

An internal evaluation result is none of those. The clause everyone points at does not fire here.

What binds is quieter: 55(1)(a) evaluation and adversarial testing, 55(1)(b) mitigation at Union level, and 55(1)(d) — "an adequate level of cybersecurity protection for the general-purpose AI model with systemic risk and the physical infrastructure of the model." OpenAI's response reads like a worked example of 55(1)(d). And since 2 August the Commission can enforce Chapter V, fines to 3% of worldwide turnover or EUR 15 million.

What I'd do Monday:

  1. Put the capability in your threat model now, at the assumed level. Voluntary disclosure moves your baseline whether you consented or not.

  2. Ask your model vendor in writing for the Article 53(1)(b) and Annex XII information. It is an entitlement for downstream providers, not a favour.

  3. Separate "the model is gated" from "the capability exists". Their release calendar is not your control.

  4. Track mean time to patch, not open finding count. If exploit development gets cheap, latency is what kills you.

The pause is not the news. The disclosure is.

What does your threat model still quietly assume is too expensive to attack?

#AgenticAI #EUAIAct #AISecurity #GPAI #Berlin

AI disclosure: the narration voice and the cover art in this video are AI-generated. The script, the claims and the source checks are mine.

First comment

Sources, primary first —

OpenAI's own post, dated 7 August 2026 — the "cannot rule out Critical capability level" wording, the pause, and the specific controls quoted above https://openai.com/index/responding-next-frontier-critical-cyber-capabilities/

OpenAI Preparedness Framework v2, 15 April 2025 — the High and Critical cybersecurity thresholds, including the "without human intervention" limb https://cdn.openai.com/pdf/18a02b5d-6b67-4cec-ab64-68cdfbddebcd/preparedness-framework-v2.pdf

AI Act Article 55 — evaluation, mitigation at Union level, serious-incident reporting, and the cybersecurity duty in 55(1)(d) https://artificialintelligenceact.eu/article/55/

AI Act Article 3 — the definition of "serious incident" at point 49, which is the reason 55(1)(c) does not fire on a capability finding https://artificialintelligenceact.eu/article/3/

AI Act Article 53 — the downstream-provider information duty, with the minimum elements in Annex XII https://artificialintelligenceact.eu/article/53/

Enforcement of Chapter V — Commission supervision and enforcement powers over GPAI providers from 2 August 2026, fines under Article 101 https://artificialintelligenceact.eu/enforcement-of-chapter-v-under-the-eu-ai-act/

TechCrunch, 7 August 2026 — independent confirmation of the date and that Astra is unreleased https://techcrunch.com/2026/08/07/openai-says-it-slowed-astra-model-development-over-security-concerns/

One point cut for length: several outlets ran this as tests having revealed autonomous zero-day exploitation of hardened systems. OpenAI's post does not say that. It says preliminary evaluations cannot rule out the Critical level — a statement about uncertainty, not a demonstrated result. No evaluation numbers are published, so there is nothing here to quote. I have kept the hedge because the hedge is the finding.

A note on dating: coverage clusters on 8 August. OpenAI's post is dated 7 August, and that is the date used throughout.

AI disclosure: the narration voice and the cover art in this video are AI-generated. The script, the claims and the source checks are mine.

Claims

Sources

Corrections

No corrections. Two things were held back rather than published. Several outlets ran this as tests having revealed autonomous zero-day exploitation of hardened systems; OpenAI's post says only that preliminary evaluations cannot rule out the Critical level, so no demonstrated-capability claim appears anywhere in this edition. And no evaluation numbers are quoted, because OpenAI published none — a figure was not sought from secondary coverage to fill the gap.

The reading that Article 55(1)(c) does not engage on an internal capability finding is argument, not fact, and is presented as such: the underlying claims record only the text of Article 55 and the Article 3(49) definition.

Four instrument texts — Article 55, Article 3, Article 53 and the Chapter V enforcement dates — are quoted from a third-party reproduction rather than the Official Journal, and are flagged secondary in the source notes.

Dating: coverage clusters on 8 August 2026. OpenAI's own post is dated 7 August 2026, and that is the date used throughout.

AI disclosure

The video for this edition contains AI-generated media: the narration is a synthetic voice and the cover art is generated. The script, the claims and the source verification are human-authored and human-checked. Assets carry IPTC DigitalSourceType and C2PA Content Credentials.