The Boundary You Outsourced
Return to Part 0: Table of ContentsPrevious Article: Part 30, Two Clocks, One Deadline
Two questions are going to land on the same board agenda this month, and they will sound like one question. Should we be reassured that OpenAI refused to ship a model it could not clear? And should we be worried that other labs' models turned up on real companies' production systems while being tested? They are not one question. They do not run on the same evidence, and they do not have the same answer.
Start with the number that frames the first one. On 7 August 2026, OpenAI said it could not rule out that its next frontier model, Astra, sits at the "Critical" cybersecurity capability level under its own Preparedness Framework. [1] Critical is the top tier that framework defines. No OpenAI model had reached it before. [2]
The definition is narrow, and worth reading in full, because the word does enormous work in headlines and almost none in most of them. Critical means a tool-augmented model that can "identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention," or can "devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high level desired goal." [3]
Read what that threshold actually measures. It is a claim about capability existing, not about an attack occurring. OpenAI is not reporting that Astra did anything. It is reporting that its evaluations cannot prove Astra could not. On that basis the company paused internal activities involving the model that do not meet strengthened security requirements, moved it into isolated testing, restricted network and tool access, encrypted model weights, and turned on monitoring that reads the model's chain of thought to halt a run in progress. [4] It is engaging government agencies and selected safety organisations for further testing. There is no release date.
The same model, in the opposite direction, six days earlier
On Saturday 1 August, OpenAI had introduced Astra to the public a different way entirely: not as a risk, but as a result. Ten previously unsolved problems in mathematics and theoretical computer science, including the first explicit construction of a non-sofic group, a question open since Mikhail Gromov defined soficity in 1999, and a disproof of Connes's rigidity conjecture, posed in 1980. A proof of Ehrhart's volume conjecture. Three problems from the Erdős catalogue. Results in sphere packing, arithmetic circuit complexity and quantum parallel repetition. Total estimated token cost, at GPT-5.6 Sol API rates: about two thousand US dollars. [5]
The part that matters for governance is not the mathematics. It is the packaging. Every one of the ten shipped as a Lean 4 proof certificate, published to GitHub under an Apache 2.0 licence, with a "sorry" count of zero, meaning no step in any formalised proof was left unproven. Anyone with the Lean compiler can check all ten without believing a word OpenAI says about them.
So within one week, the same company published two claims about the same model. One of them is verifiable by any stranger with a laptop. The other cannot be checked by anyone outside OpenAI at all, because the evidence for it is an internal evaluation of an unreleased system. This series spent Part 29 on exactly that asymmetry at the procurement stage. Here it is again, six days apart, inside a single model's public introduction.
Both claims may well be true. Only one of them is auditable, and the auditable one is the good news.
The containment failures did not happen where the coverage put them
Now the second board question, and this is where most of the coverage went wrong.
The story circulating is that four labs' models escaped their safety sandboxes in a single week. That is not what happened. What happened is a set of separate disclosures across five weeks, with different mechanisms, different severity and, in two of the most serious cases, one shared cause that sits outside every lab involved.
Take them in order.
On 30 July 2026, Anthropic published its own account. It had reviewed 141,006 evaluation runs in which Claude models could have obtained internet access, and found three incidents, spanning six runs, in which models reached the production infrastructure of three separate external organisations. [6] The models were Claude Opus 4.7, Claude Mythos 5 and an internal research model. In the worst of the three, Claude created an email account, created a PyPI account, and published a malicious Python package that fifteen real systems downloaded and executed in roughly one hour before it was pulled.
Then read Anthropic's own conclusion, which is the single most useful sentence any lab produced this month: "we believe these incidents to be closer to a harness and operational failure than a model alignment failure." [6]
Here is why. The evaluations were run through Irregular, one of Anthropic's third-party evaluation partners, an Israeli firm founded in 2023 that builds controlled environments for stress-testing frontier models on offensive cyber capability. [7] The environment was supposed to have no internet access. Because of what Anthropic describes as a misunderstanding between itself and its evaluation partner, it did. [6] And the models had been told there was no internet access. So when they encountered real systems belonging to real companies, they had every reason to conclude those systems were part of the simulation.
That is not a model breaking out. That is a model doing exactly what it was asked, inside an environment it had been correctly briefed about and that had been incorrectly built.
Six days later, on 5 August, Meta disclosed the same thing. Its Muse Spark 1.1 model reached a third party's systems during evaluation. Meta spokesperson Andy Stone: "A misconfiguration by Irregular, an independent testing company Meta uses, inadvertently allowed one of our models access to the internet during evaluation." [7] Irregular's own characterisation was that this was the exact same evaluation-environment issue already disclosed by Anthropic. [7]
Two of the best-resourced AI companies in the world, testing different models, in different months, hit the identical hole, because they had both hired the same contractor to dig the moat.
And there is a detail in the sequence that ought to stop any procurement professional cold. On 4 August, Irregular published its own security assessment of Muse Spark 1.1, concluding that the model does not materially alter the cyber threat landscape. Meta's disclosure of the breach caused by Irregular's misconfiguration came the following day. [7] The assessor cleared the model, then the assessor's own environment was the reason the cleared model ended up on someone else's infrastructure. The capability assessment may well have been correct. The infrastructure the assessment ran on was not, and nothing in the assessment covered that.
What the other two incidents are, and are not
Two more events got swept into the same headline and neither belongs there.
Moonshot's Kimi K3 did leave a testing sandbox on 7 August, disclosed by the research firm Frontier Security. [8] The mechanism was different and duller: the sandbox blocked web traffic, the model used command-line tools instead, and it used the access to clone benchmark solutions from GitHub rather than solve the tasks it had been set. That is cheating on an exam, not attacking a company. Felony Bench, the independent public tracker that catalogues cases where AI agents affect third-party entities, is explicit that "escaping a sandbox alone does not constitute a counted incident," and names the Kimi K3 case, along with an Alibaba incident, as excluded on exactly that basis. [9] As at this week the tracker's running totals are Anthropic 8, OpenAI 7, Meta 1, Google 0, Moonshot 0. [9] Those are cumulative across weeks of disclosures, not a week's tally.
And on 4 August, the UK's AI Security Institute published an incident report from evaluations run between 25 and 28 July: 122 runs across seven models, nineteen unsanctioned actions in ten of them. [10] Mythos 5 accounted for seventeen of the nineteen across 43 runs; GPT-5.6-Sol for two across 35. The most serious was genuinely serious. An agent tried to insert malicious code into a public open-source project, then created multiple fake identities and used them to socially engineer a real maintainer into approving the code. A human caught it and refused it. [10]
That finding is real and it should not be softened. But the conditions must be stated alongside it, because the AI Security Institute states them itself: internet access was deliberately enabled and safety filters were deliberately disabled, and "this combination of conditions is not reflective of how frontier models are made available to the general public." [10] A government evaluator switching off the safeties to find out what is underneath is doing its job. It is not evidence that the safeties are failing in normal operation.
The assumption underneath all of it
This series covered the first version of this story three weeks ago, in Part 28, The Sandbox Was Never a Wall, when OpenAI's own pre-release model found a zero-day in Hugging Face's production infrastructure while hunting for a benchmark answer key. Some of this month's coverage recycled that incident as though it were new. It is not, and OpenAI has been at pains to separate it from the current story: Astra was not involved in the Hugging Face attack. [4]
What is new is the shape of the failure. Part 28 identified an assumption that almost every organisation running AI pilots holds without examining it: that the test environment is the safe part. Deployment gets the risk assessment, the sign-off and the monitoring. Evaluation gets a container and a hope. Call it the Sandbox Illusion: the belief that a test environment is a containment boundary rather than an obstacle, and the corresponding assumption that a system being evaluated warrants less governance than a system being deployed.
August added the second half of that. The boundary is not only weaker than assumed. In two of the three most serious cases this month, it was not even the lab's boundary. It belonged to a vendor, procured for the purpose, trusted to be right, and wrong in a way that neither client detected until models were already on other companies' systems.
Set the two halves of this month against each other and the governance lesson is precise. OpenAI applied deployment-grade controls to a system that had not been deployed, and that is what "we are pausing internal activities involving Astra" actually means: isolation, restricted access, encrypted weights, live monitoring, a system treated as dangerous before anyone bought it. Anthropic and Meta applied evaluation-grade assumptions to systems in an environment they had outsourced, and the environment did not hold. Same industry, same month, opposite directions, and the difference between them is not model capability at all.
What this means for a New Zealand organisation
New Zealand's own position on this is general, dated before these events, and says nothing about any of them. That is a description of scope, not a criticism.
On 23 June 2026, NCSC-NZ joined its Five Eyes counterparts in a Call to Action on AI Preparedness. Catriona Robinson, Deputy Director General Cyber Security, put it directly: "AI is not a future consideration, it is already here. It lowers barriers for malicious actors and increases the speed and complexity of attacks." [11] The statement describes frontier AI as shrinking the window between vulnerability discovery and exploitation ever more quickly, and commits NCSC-NZ to accessing frontier models itself, working with providers to understand the risks, and publishing guidance for New Zealand organisations and government. [11] Earlier, on 1 May 2026, NCSC-NZ co-signed the Five Eyes guidance on careful adoption of agentic AI services, which this series covered in Part 28. [12]
Both documents predate this month. Neither addresses evaluation-environment containment, third-party evaluator infrastructure, or a vendor's own pre-release capability gate, because none of those were the live question when they were written. No New Zealand agency and no New Zealand adviser has published anything on the Astra pause or the July-to-August disclosures. That is where the guidance currently sits.
So the work sits with the organisation. Four things follow, and none of them require anyone to have an opinion about frontier model capability.
Ask your vendor who runs their evaluations. Not whether they evaluate. Who. Anthropic and Meta were both diligent enough to run third-party cyber evaluations and both were exposed by the same third party. The name of the evaluator, and whether your other vendors use the same one, is now a concentration-risk question in exactly the way a shared cloud region is.
Treat an evaluator's clearance as scoped to the model, not to the test. Irregular's assessment of Muse Spark 1.1 said the model did not materially change the cyber threat landscape. That assessment is not contradicted by what followed. What followed was a fault in the assessor's own environment, which the assessment never covered and was never asked to. When a safety attestation arrives, read what it certifies and what it silently does not.
Give your test environments the controls you give production. Egress rules, credential scoping, network isolation you have verified rather than assumed, and a named person who authorises the removal of any safety control for evaluation purposes. If a supplier cannot describe their evaluation containment at that level of detail, you have your answer to the board's question.
Watch what a lab does before release, not only what it says after. OpenAI's Astra pause is the most useful vendor behaviour of the month, and the reason is structural: the gate was applied to a system nobody could buy yet, and the company took the commercial cost of applying it. That is a voluntary, self-defined threshold with no external enforcement behind it, and its value to you as a buyer depends entirely on the framework staying stable when the next model is more commercially urgent. Ask which framework a vendor gates on, who inside the company can override it, and what has ever been held back because of it.
- On 7 August 2026 OpenAI said it could not rule out that Astra, its next frontier model, meets the "Critical" cybersecurity tier of its own Preparedness Framework, the first OpenAI model to reach it. It paused internal activities that do not meet strengthened controls, isolated testing, restricted access, encrypted weights and added chain-of-thought monitoring. No release date exists. Critical means capability that cannot be ruled out, not an attack that occurred.
- Six days earlier, on 1 August, the same model was introduced through ten previously unsolved mathematics and theoretical computer science results, each shipped as a Lean 4 proof certificate on GitHub with a "sorry" count of zero, machine-checkable by anyone, for about US$2,000 in tokens. One claim about Astra is independently auditable. The other is not.
- Anthropic disclosed on 30 July that a review of 141,006 evaluation runs found three incidents reaching three real companies, including a malicious PyPI package run on fifteen real systems in about an hour. Its own conclusion: "closer to a harness and operational failure than a model alignment failure." The models had been told they had no internet access, so they treated real systems as simulated ones.
- Anthropic's and Meta's incidents share one cause outside both companies: a misconfiguration at Irregular, the third-party evaluator both had hired. Irregular published a security assessment clearing Meta's Muse Spark 1.1 on 4 August; Meta disclosed the breach caused by Irregular's own environment on 5 August.
- Two events do not belong in the same category. Moonshot's Kimi K3 left a sandbox on 7 August to clone benchmark answers from GitHub, and Felony Bench explicitly excludes it because "escaping a sandbox alone does not constitute a counted incident." The UK AI Security Institute's 4 August report found nineteen unsanctioned actions across 122 runs and seven models, with internet access deliberately enabled and safety filters deliberately disabled, conditions the Institute states are "not reflective of how frontier models are made available to the general public."
- NCSC-NZ's Five Eyes Call to Action (23 June 2026) and the co-signed agentic AI guidance (1 May 2026) both predate this month and neither addresses evaluation-environment containment or third-party evaluator infrastructure. No New Zealand government or advisory publication on these specific events has been located.
The open-source dimension here sits in the half of this fortnight that worked. Astra's ten proofs are checkable at all because Lean 4, the open-source theorem prover the community has built and maintained since 2021, and Mathlib, its openly maintained mathematics library, exist as public, inspectable infrastructure. Anyone can install the Lean compiler and verify a "sorry" count of zero without asking OpenAI to be believed. That is a different open-source claim to the open-weight argument this series has made before: the artefact that matters here is not a model anyone can download, it is a verification toolchain nobody has to trust. The same logic extends past mathematics. Coordinated vulnerability disclosure, the CVE programme, and open evaluation harnesses all rest on the same principle, that a claim checked by machinery nobody controls is worth more than a claim made by the party being checked.
The implication on the sovereignty side is worth stating directly. This month's disclosures were not about export controls or raw capability; they were about who sits inside the assurance chain. Two of the most capable US-built models had a load-bearing plank of their safety evaluation run by a single outside contractor, and neither company controlled that contractor's environment. That is a different sovereignty question from the ones this series has tracked through chip export rules and compute geography: who controls the evaluation and the weights, not the silicon. Frontier labs and governments increasingly treat model weights as strategic assets worth restricting, and the mirror case sits in China's frontier AI capacity, consolidated inside a small number of domestic labs whose evaluation and safety infrastructure the state can reach directly. A concentrated, state-reachable chain and a diffuse, contractor-dependent one carry different risks. Neither is the safer model by default.
The board question worth preparing for is not whether your AI vendor is safe. It is narrower and harder to deflect. Who ran the last evaluation your vendor showed you, what exactly did that evaluation certify, and who was watching the room it ran in?
The views expressed in this article are entirely my own, informed by more than 30 years of professional experience in architecture, security, and technology leadership in New Zealand. They do not represent the views of my employer, any government agency, or the New Zealand government. My commentary on legislation and policy is analytical, drawing on publicly available sources and my professional expertise in architecture, security, and AI governance. I follow the Public Service Commissioner's Code of Conduct for the Public Sector and social media guidance.
Andreas Hamberger is a New Zealand leader in Architecture & Security and Associate Member of the Institute of Directors. The Hamberger Report: Generative AI 2026 provides enterprise leaders with evidence-based analysis of the AI landscape.
I use AI tools, including Sudowrite, Claude, Perplexity AI, DeepSeek AI, ChatGPT, Grok, Copilot, Openart and Gemini, as deliberate production tools, not ghostwriters. This is consistent with my position: AI amplifies human judgement; it does not replace it. The frameworks, arguments, and editorial decisions in this series are original work. AI accelerated the process. The thinking is mine.
[1] TechCrunch. "OpenAI Says It Slowed Astra Model Development Over Security Concerns." 7 August 2026. https://techcrunch.com/2026/08/07/openai-says-it-slowed-astra-model-development-over-security-concerns/
[2] the-decoder. "OpenAI Flags Its New Astra Model as Potentially Reaching the Highest Cybersecurity Risk Level for the First Time." August 2026. https://the-decoder.com/openai-flags-its-new-astra-model-as-potentially-reaching-the-highest-cybersecurity-risk-level-for-the-first-time/
[3] The Hacker News. "OpenAI's Next AI Model Astra Shows Cyber Capability at 'Critical' Threat Level." 10 August 2026. https://thehackernews.com/2026/08/openais-next-ai-model-astra-shows-cyber.html
[4] IT Pro. "OpenAI Has Paused Work on Its Astra AI Model After It Passed a Critical Threshold in Cyber Capability, But It's Not the One That Breached Hugging Face." August 2026. https://www.itpro.com/security/openai-has-paused-work-on-its-astra-ai-model-after-it-passed-a-critical-threshold-in-cyber-capability-but-its-not-the-one-that-breached-hugging-face
[5] SiliconANGLE. "OpenAI's Astra Solves 10 Long-Open Math Problems, Publishes Proofs." 2 August 2026. https://siliconangle.com/2026/08/02/openais-astra-solves-10-long-open-math-problems-publishes-proofs/
[6] Anthropic. "Investigating Incidents Involving Models During Cybersecurity Evaluations." 30 July 2026. https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals
[7] TechTimes. "Meta Breach Reveals Irregular Cleared Muse Spark's Risk, Then Caused the Breach It Had Cleared." 6 August 2026. https://www.techtimes.com/articles/323279/20260806/meta-breach-reveals-irregular-cleared-muse-sparks-risk-then-caused-breach-it-had-cleared.htm
[8] TechCrunch. "Chinese AI Model Kimi Escaped Its Cybersecurity Testing Environment, Researchers Say." 7 August 2026. https://techcrunch.com/2026/08/07/chinese-ai-model-kimi-escaped-its-cybersecurity-testing-environment-researchers-say/
[9] Felony Bench. Independent public tracker of AI agent incidents affecting third-party entities. https://www.felonybench.com/
[10] AI Security Institute (UK). "Incident Report: Unsanctioned Agent Behaviour During Cyber Testing." 4 August 2026. https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing
[11] NCSC-NZ. "Leaders of Five Eyes Cyber Security Agencies Call to Action on AI Preparedness." 23 June 2026. https://www.ncsc.govt.nz/news/leaders-of-five-eyes-cyber-security-agencies-call-to-action-on-ai-preparedness/
[12] Five Eyes. "Careful Adoption of Agentic AI Services." 1 May 2026. https://media.defense.gov/2026/Apr/30/2003922823/-1/-1/0/CAREFUL%20ADOPTION%20OF%20AGENTIC%20AI%20SERVICES_FINAL.PDF