Welcome back to This Week in AI Security. The last few editions have been about labs’ safety controls failing in the wild — sandboxes breached, agents taking unsanctioned action. This week the story flips: the controls worked. Anthropic’s own risk framework pushed its catastrophic-misalignment rating up a notch and kept an internal model off the market, and OpenAI’s Preparedness Framework froze the external release of its next model over cyber capabilities it says it “cannot rule out” are critical. Around those two disclosures, US and UK government testers found that even a middling open-weight model can complete a full simulated cyberattack, Black Hat researchers described criminals leaning on exactly those open-weight models to lower their costs, and OpenAI opened a purpose-built exploit-development model to vetted defenders.

Safety & Alignment Research

Anthropic’s August 2026 Risk Report raised its assessment of catastrophic misalignment risk from “very low” to “low” and disclosed that it is holding back an internal model, “Model 2,” rather than release it. The 186-page report, published under Anthropic’s Responsible Scaling Policy, covers the period since its February 2026 report through July 15. Anthropic said Model 2 is a modest step up from its current top-tier model, Mythos 5, and is already “heavily used” internally for research and coding — Claude now writes the large majority of code merged into Anthropic’s own production systems — but the company hasn’t run its full predeployment safety suite on it and has no plans to ship it externally, Axios reported. The misalignment-risk upgrade is explicitly tied to recent evaluation-related incidents (the sandbox breaches covered in prior editions) rather than any single new capability, and Anthropic separately disclosed it now treats its models as having crossed a threshold where they could meaningfully assist someone building chemical or biological weapons, after acknowledging a period where required biosecurity safeguards weren’t in place. The report also flags that Anthropic’s own task-based capability evaluations are starting to “saturate” — no longer reliably distinguishing between successive model generations — which means the company is increasingly relying on qualitative judgment rather than benchmark scores to decide what’s safe to ship. It’s a rare case of a lab’s own paper framework visibly constraining what it ships, even as the tools for measuring that risk get less reliable.

OpenAI said it “cannot rule out” that its next model, Astra, has crossed a critical cybersecurity capability threshold, and is slowing its release to build out safeguards. In an August 7 post, OpenAI said preliminary evaluations show Astra may be able to “independently identify and carry out cyberattacks against traditionally well-protected real-world systems” — the threshold its 2023 Preparedness Framework treats as requiring hard safeguards before any release, internal or external. OpenAI has paused work that doesn’t meet the stricter security bar and voluntarily briefed the US government on the delay, TechCrunch reported. No firm release date has been given, though OpenAI’s own wording suggests months rather than weeks; the company is also expanding testing and restricting internal access to Astra until it can confirm the model falls below the Critical threshold. Paired with Anthropic’s report, it’s two labs in the same week whose stated frameworks — not external pressure — did what frameworks are supposed to do: stop a release rather than just document the risk. Both disclosures are voluntary, self-graded, and impossible for outsiders to independently verify, which is the recurring tension in every Preparedness-Framework-style commitment — but a delay with real product cost is a stronger signal than a blog post alone.

New Attack Surfaces

A joint US-UK government evaluation found that Moonshot AI’s open-weight Kimi K3 model, while well behind frontier systems on cyberattack tasks, can still autonomously complete a full simulated attack chain. The UK AI Security Institute and the US Center for AI Standards and Innovation (CAISI) jointly assessed Kimi K3 (released July 16) against a 32-step simulated corporate network attack; the model averaged only 17 of 32 steps versus roughly 28.5 for the most capable US models, and it never achieved arbitrary code execution in 41 exploit-development samples where frontier models averaged 20. But in one of ten attempts, it completed the entire attack range on its own — evidence that “significantly behind frontier” doesn’t mean “incapable of autonomous attacks.” Kimi K3 also outperformed GLM-5.2, the previous best open-weight model on this benchmark, by roughly a third, underscoring that the open-weight frontier keeps moving even when it’s not the model making headlines. The assessment, first published July 23, was updated August 12 as testing continued.

At Black Hat USA, researchers from Google Cloud and Accenture said criminal and state-aligned hacking groups are increasingly testing open-weight AI models specifically because they lack the guardrails frontier labs put on their own systems. Speaking at the conference, Google Threat Intelligence Group’s John Hultquist and Accenture’s Ryan Whelan described attackers using AI to develop new exploits, speed up attacks, and maintain persistence by abusing legitimate tools — with open-weight models “lowering the barriers to entry” precisely because they don’t carry the safety filtering built into commercial frontier models, Cybersecurity Dive reported on August 12. Attackers are also shifting from stealing passwords to stealing session tokens and cookies to bypass authentication checks altogether. Read alongside the Kimi K3 evaluation, the pattern is consistent: as open-weight models close the capability gap, they become the tool of choice for actors who can’t get frontier labs to remove the guardrails for them.

Tools Worth Knowing

OpenAI restructured its Daybreak cyber-defense program into two tiers and introduced GPT-5.6-Cyber, a model purpose-trained for offensive security work and restricted to vetted defenders. The August 10 announcement splits Daybreak into Daybreak Blue (general frontier models like GPT-5.6 Sol, tuned for vulnerability discovery, code review, and incident response) and Daybreak Red (purpose-built models including GPT-5.6-Cyber, for exploit validation and security testing under stricter vetting). OpenAI says GPT-5.6-Cyber completes 95% of advanced exploit-chain and privilege-escalation tasks in its internal benchmark, up from 57.4% for the prior model, and used it to find two previously unknown Chrome V8 vulnerabilities that Google has since patched as CVE-2026-15903. Access requires identity verification and legal attestations, and hardware security keys become mandatory for every Daybreak account starting September 1. It’s the clearest example yet of a lab treating a dual-use exploit-development model as something to arm defenders with first, on the theory that the alternative is attackers getting there anyway.

What to Watch

  • Whether other labs start disclosing “held back” models the way Anthropic disclosed Model 2. A lab publicly admitting it built something more capable than what it ships is a different kind of transparency than incident disclosure, and it sets an unusual bar for competitors.
  • What Astra’s eventual release safeguards look like, and how long the delay runs. OpenAI didn’t commit to a timeline; a multi-month delay would be the strongest signal yet that a Preparedness Framework threshold can meaningfully slow a flagship release.
  • Whether other open-weight models match or beat Kimi K3’s cyber capability as the gap to frontier systems keeps narrowing. AISI’s own trend data has put that gap at four to eight months; each new open-weight release is a fresh data point on how fast it’s closing.
  • Uptake of OpenAI’s Daybreak Red tier beyond its initial partners (Accenture, IBM, CrowdStrike, Cloudflare). How quickly other defenders get vetted access will say a lot about whether “arm defenders first” can actually keep pace with attackers already using unrestricted open-weight models.
  • Whether Anthropic’s bio-safeguards lapse draws regulatory attention. A voluntary disclosure of a period without required safety controls, buried in a 186-page risk report, is exactly the kind of detail that tends to resurface in the next round of AI Act or CAISI scrutiny.