OpenAI just admitted its next model can hack like a nation-state

Good morning 👋 OpenAI just told on itself: its next model clears the "Critical" bar for autonomous hacking, and the safeguard list they shipped alongside it reads like a confession.

In today's issue:

• 🔭 OpenAI just admitted its next model can hack like a nation-state
• 🧠 Gemini 3.8 Flash Cyber goes behind a 650-partner lockbox, NVIDIA and CrowdStrike war-game their own patches
• 🔬 Nemotron's coding pipeline hits gold-medal IOI scores, and a RAG attack that never touches the model
• 🚀 Wonderful triples its valuation in six months with Salesforce joining the round
• 🏛️ Anthropic moves enterprise safety monitoring into your own cloud bucket
• 🛠️ A trust gate for anything your agents can pay for
• 🔗 ChatGPT reads patient charts now, and a law firm proves Enterprise governance can actually work

🔭 THE ONE THING

🚨 OpenAI just admitted its next model can hack like a nation-state

OpenAI says Astra is the first model it's ever shipped that clears the "Critical" bar in its own Preparedness Framework: functional zero-day exploits on hardened systems, no human in the loop needed. This isn't the hedged "can't rule it out" language from a few weeks back. It's a formal determination, and the guardrails came with it: universal chain-of-thought monitoring across every agentic use of Astra, OpenAI pausing its own internal work that doesn't clear the new security bar, and government agencies plus outside safety groups testing it before anyone else gets near it. Read the safeguard list as an admission: they built something they don't fully trust with a keyboard yet. "Critical" was supposed to be the tier that changes how these things ship. Now we get to see if it actually does.

🧠 MODELS & RELEASES

• 🔐 Google DeepMind shipped Gemini 3.8 Flash, a coding-heavy workhorse that beats larger frontier models on the DeepSWE v1.1 benchmark, plus a cyber-specialized sibling, 3.8 Flash Cyber, that found vulnerabilities across 20 languages and, per Chrome Security's own test, wrote 2.6x more correct patches than the leading commercial tool. You can't just call the cyber model's API, though. It's locked behind Fairwind, a new access program for governments and critical-infrastructure operators with 650+ partners already signed, CrowdStrike and Palo Alto Networks among them. Gemini 3.8 Flash · Fairwind
• 🛡️ NVIDIA and CrowdStrike unveiled SafeMind at Fal.Con: an agentic defense system built on post-trained Nemotron models that runs red-team and blue-team agents against each other to harden its own patches before an attacker finds them. The pitch number, a 99% cost cut at 99% accuracy versus rival models, is CrowdStrike's benchmark. Wait for an independent one. source
• 🌐 Equinix, NVIDIA and Together AI are building an Inference Exchange to push inference compute out to Equinix's 280+ data centers, using Together's catalog of 200+ open models and NVIDIA's reference architectures for the hardware layer. Nothing ships until Q1 2027. Call it a roadmap commitment, not a product. source

🔬 RESEARCH HIGHLIGHTS

• NVIDIA's Nemotron coding pipeline. Post-training pushed IOI scores from 130 to 291, then to 468 with a test-time refinement loop called GenCorrect, clearing the 438-point gold-medal bar on a 30B model. The 550B version hit 502 with fine-tuning alone, no RL involved. Twenty-two thousand curated problems and synthetic reasoning traces did the heavy lifting. Builder read: gold-medal competitive coding is now a documented recipe, not a lab miracle from one company. [https://arxiv.org/abs/2609.02849v1]
• CodePoisonRAG. Slip one malicious code snippet into a RAG corpus for a coding assistant, tack on a false "this is safe" comment, and vulnerable code shows up in what the model generates. The model itself never gets touched. Eighty-five poisoned artifacts, a 0.7% corpus-poisoning ratio, attack success rates of 80 to 93% across three code generators. Even the purpose-built defense, CodeGuarder, still let 40 to 71% through. Builder read: a coding agent pulling from an internal doc store or a shared package index just picked up a new attack surface. [https://arxiv.org/abs/2609.02774v1]
• The feedback signal your LLM can't see. User corrections carry real information, models that revise using that feedback fix the flagged problem at meaningfully higher rates than models revising blind. The catch is in how anyone checks the work: ask an LLM judge to grade the fixed output against the original, and it often prefers the worse, unfed version. The tool used to measure whether feedback loops work is quietly undercounting the ones that do. [https://arxiv.org/abs/2609.02859v1]

🚀 AI STARTUPS

• Wonderful closed a $550M Series C at a $5B valuation, more than double the $2B mark it hit in its Series B six months ago. Insight Partners led, and Salesforce joined the cap table for the first time betting on the "AI operating system" pitch over point solutions. source

🏛️ POLICY & REGULATION

• Anthropic built Enterprise Frontier Safeguards with more than 100 customers: misuse monitoring that lives in the customer's own AWS S3, Azure Blob, or Google Cloud bucket instead of on Anthropic's servers, with automated alerts and no default human review on Anthropic's side. Goldman Sachs, Citigroup, Wells Fargo, Salesforce, and Comcast are named collaborators. Rollout starts this fall across Claude Code, Enterprise, Platform, and Bedrock. Developing Enterprise Frontier Safeguards with our customers Builder read: this is the answer to the compliance objection that's been stalling Claude Enterprise deals, not a new safety rule.
• European Commission confirmed Ursula von der Leyen delivers the 2026 State of the Union on September 16 in Strasbourg. The event page itself names no AI agenda yet, despite chatter that AI tops the list. Watch, don't act: nothing's bound until she actually speaks. State of the Union 2026

🛠️ TRY THIS

Put a trust gate in front of anything your agents can pay for

Astra crossing the Critical cyber threshold is a capability story. The nearer risk is autonomy: models are good enough now that people are letting agents transact without a human checking each one. t54's setup on Bedrock AgentCore is the pattern worth stealing, not the specific product. It's governed 20 million-plus agent payments with zero humans in the loop.

1. List every endpoint or API your agents currently have standing authorization to call or pay.

2. Add a deterministic gate in front of it. Score the endpoint before the agent pays it, don't let the model's own judgment be the last check.

3. Cap the blast radius with a session budget per agent run, not just a monthly ceiling.

4. Isolate credentials per session, so one compromised run can't reach into the next.

Prompt: List every tool call or payment action this agent can make without human review. For each one, write a one-line rule for a deterministic check that must pass before it executes.

🔗 QUICK LINKS

• OpenAI ChatGPT now pulls from trusted EHR and healthcare data sources, so clinicians get patient context and medical research without leaving the chat. Healthcare data sources
• Gilbert + Tobin rolled ChatGPT Enterprise and Codex across the firm with CEO-led governance and human sign-off on every use case. Worth stealing if legal is your compliance headache too. The case study

Check what your agents are authorized to spend before you check anything else today.

Pradeep Perugu