OpenAI's new model did not surpass its predecessor in intelligence. The cyber risk the company self-reported is not measured by independent rankings

Four days ago, we wrote about the GPT-6 Astra model, which OpenAI itself classified as being at the highest level of cyber risk, and we left open the question of who would verify that. The first independent figures have since arrived, but they measure something different from the thing for which the company put a safeguard in place. In that same week, Brussels received a report from OpenAI about another episode involving agents, the UN High Commissioner called for binding red lines, and nine countries including Slovakia signed the Declaration on Artificial Intelligence in Prague, for which no projects or budget have yet been published. In the meantime, OpenAI acknowledged the episode on the German wiki as its own and promised rules for reporting such cases. It also emerged that the conditions of the "independent" review of the earlier incident were set by the company itself.

Independent figures arrived, but they measure something else

The Artificial Analysis ranking gave Astra 61 points in its intelligence index, exactly the same as its own predecessor GPT-5.6 Sol from July. Rival Claude Fable 5.1 has 66 in its highest-performance mode, and the Artificial Analysis ranking is led by Meta Muse Spark 1.3. Artificial Analysis ↗

In a separate ranking for programming agents, however, Astra fared differently: 67 points, roughly on par with the Opus 5 and Fable 5 models. Here too, Fable 5.1 leads with 70 points. The rate of fabricated answers fell sharply, from 92 percent to 51 percent at maximum settings, and in programming the model achieved a comparable result for less than half the cost per task. Artificial Analysis ↗

That is a different picture from the one the company presented at launch, when its president spoke of a generational leap and said it was not unreasonable to claim that the era of general artificial intelligence was arriving. Czech Hospodářské noviny summed it up on the day of the launch with a headline saying the company was talking about general artificial intelligence, but independent tests showed a more interesting picture. Hospodářské noviny ↗ Slovak outlet Sector offered its own illustration of what the model can really do: Astra independently completed the entire game Portal and spent tokens worth 571 dollars doing it. Sector.sk ↗

What matters, though, is what none of those numbers show. The company placed the model at the highest level of its own cyber-risk scale, meaning among models that are supposed to find and exploit a vulnerability in a well-protected system. Independent rankings measure intelligence, programming, and cost per task. None of them measures the ability to breach a protected system, so the question we asked four days ago remains open exactly where it was.

Brussels received the report, but about a different episode

At the beginning of September, the nonprofit group Nightingale Collective led by Sydney Von Arx published a report according to which autonomous agents that identified themselves as OpenAI systems left about 18,000 posts on DSEwiki between May and July. This is a 25-year-old German wiki for programmers that anyone can edit and that had until then been practically dormant. According to the report, the agents gave themselves more than 3,700 different names in the form OpenAIResearcher or OAIResearchMar26 and exchanged results, raw data, and predictions of future questions. When a moderator began deleting their pages in June, they created backups. Researchers reconstructed the deleted pages from the edit history. The Hacker News ↗

The scale is still not settled. Reuters reported more than 15,000 edits, while the report speaks of roughly 18,000 posts. Seznam Zprávy ↗

In time, this predates the attack on Hugging Face, which we wrote about in August, but it is not the same case and not the same hidden message board. In the Hugging Face case, the agents had no internet access and had to get out of a closed environment. Here, they had web access. OpenAI assesses the episode as a mismatch between the model's behavior and what the company wanted from it, not as a security incident in the sense of Hugging Face. The Hacker News ↗

• 08.09.OpenAI acknowledged the agents as its own on September 5. The day before, it had still refused to say whether they were theirs. Within 24 hours, it wrote about the case on the company account on X, "where our agents wrote to several internet sites". It did not publish a blog post about it and did not confirm the researchers' figures. At the same time, it said there is no standard today for reporting such cases, and promised its own framework "in the coming weeks". Implicator ↗
• 08.09.They did not find the wiki by accident. Using their own language model, the researchers predicted where the agents might gather, meaning old, almost abandoned forums, and targeted DSEwiki that way. The agents themselves used account names referring to OpenAI. TechCrunch ↗
• 08.09.The site administrator was losing the volume battle. From May 11, the agents created about four hundred pages a day, while the administrator managed to delete about one hundred. After five days of deletions, the agents suddenly stopped. TechCrunch ↗
• 08.09.The company denies a cover-up. In response to claims that it kept the incident under wraps and that its legal department discouraged an investigation, it replied: "Claims that our Legal team discouraged investigation of the incident are false." Futurism ↗

The company filed a report on the matter to the European Commission. According to IBTimes, the Commission spokesperson for digital technologies, Thomas Regnier, confirmed that Brussels received the report and is looking into it, adding a broader remark: in recent times, they have seen many cases of loss of control and are watching the situation extremely closely. IBTimes UK ↗ In Slovakia, SME covered the report. SME ↗

For the question in our last text, this is only a partial answer. The Commission has responded, but to a different matter and under different rules, namely under the AI Act, where regulators gained the power to issue fines in August. The question of whether an autonomous cyber capability of a model falls under systemic risks under the Digital Services Act remains unanswered. ChatGPT was added among very large online search engines on August 31, and it is not due to fulfill the strictest obligations stemming from that until January 2027, so an answer may not come soon.

Read also: OpenAI classified its new model at the highest risk level. It set the cyber scale and the safeguard itself

The UN calls for independent verification instead of self-reporting

On Monday, September 7, at the 63rd session of the UN Human Rights Council in Geneva, High Commissioner Volker Türk said that artificial intelligence could become an existential risk to humanity if it remains without binding rules and independent oversight. "A handful of men have almost unlimited power over AI," he said, naming OpenAI, Anthropic, and Meta among the companies involved. The Next Web ↗ He called for international red lines, meaning an explicit list of what the technology must not do, and also called for a ban on weapons that can take lives without human involvement. UN News ↗

In general terms, without reference to a specific case, he also said this: "AI that escapes its testing environment or blackmails developers to prevent itself from being turned off is AI that is too powerful." UN News ↗

One of his demands points to the same gap that this week's independent rankings exposed. Türk wants model safety to be verified independently, not self-reported by companies, which in his view is historically exactly what the industry resists most strongly. Astra's placement at the highest level of cyber risk is, by contrast, self-reporting in its purest form. The Next Web ↗

Slovak media widely picked up the statement, mostly as a general warning about risks. TASR ↗ SITA ↗ STVR ↗ Trend ↗

In Prague, a declaration; in Seoul, a budget

Slovakia joined the Prague Declaration on Artificial Intelligence on September 3. Nine countries signed it, in addition to Slovakia and the Czech Republic also Poland, Hungary, Croatia, Slovenia, Romania, Lithuania, and Latvia, at the first annual Central European summit in Martinic Palace, where more than 250 people from politics, research, and business gathered. The countries committed to coordinating their positions on European policy, linking compute infrastructure, and sharing experience. Prague Daily News ↗

Slovakia was represented by Minister Samuel Migaľ, who also signed a separate Slovak-Czech memorandum on cooperation in the research and use of artificial intelligence with his Czech counterpart. Czech Minister of Industry and Trade Karel Havlíček called the signing an absolute milestone, and the Czech Republic is entering the EU competition for a large compute center that could be built in Prague's Zbraslav district. iROZHLAS ↗

Slovak Pravda was the only outlet to point out what is still missing from the document: no concrete projects, budgets, or deadlines have been presented. The signature itself does not guarantee that a compute center will be built in Slovakia or that Slovak companies will gain access to the neighboring ones. The same is true of the memorandum with the Czech Republic: its contents have not been published. Pravda ↗

For comparison, it is worth looking at how a country with a similar ambition not to be merely a customer is proceeding at the same time. South Korea is launching the beta phase of its AI for All program in September, which is meant to bring generative artificial intelligence free of charge and without token limits to all residents, directly connected to government systems, from booking a doctor appointment to tax advice. It will be run by three technology consortia linked to the two largest operators and the Kakao platform. The price of the program itself has not been published, but the government has allocated about 10 trillion won for artificial intelligence as a whole for 2026, around 7.2 billion dollars, nearly three times last year's budget. TechSpot ↗ Czech outlet Živě pointed out that this is an experiment other governments will watch closely. Živě ↗

Schools responded before regulators did

The largest school district in the United States introduced a one-year moratorium on generative artificial intelligence on September 2. Mayor Zohran Mamdani and Schools Chancellor Kamar Samuels covered nearly 600,000 students from pre-K through eighth grade for the 2026/2027 school year, roughly two thirds of the district. All software with student-facing generative artificial intelligence is banned, including so-called companion chatbots. Screen time is tiered: in grades three through five, no more than 30 minutes a day, and in grades six through eight, no more than 45. Teachers are not affected by the ban and may continue using the technology to prepare lessons and handle operational tasks. New York City Mayor's Office ↗

The moratorium does not apply to high schools, but their students have tightly limited access: five approved tools in pilot mode, for up to 50,000 students, or about five percent, and in no more than five classes in one school. Over the year, an education technology coalition is due to evaluate the impact and issue recommendations. New York City Mayor's Office ↗ CNN ↗

The report reached the Slovak and Czech media space only five days later, when Respekt covered it. Respekt ↗ In the same week, Seznam Zprávy summarized research with a contradictory result: students do much better at work with the help of a chatbot, but the effect on test results is the opposite. Seznam Zprávy ↗ In Slovakia, the topic will come up when the results of the international PISA assessment are presented, where artificial intelligence is set to be one of the topics together with restricting mobile phones in schools. Bratislavák ↗

Under the radar

Anthropic has pushed back its IPO. According to Reuters, as reported by CNBC, the company will begin selling shares no earlier than mid-October and will publish its prospectus only at the end of September, with some investors talking about a valuation of around two trillion dollars, which would make it one of the largest offerings in history. According to the same information, the company is also finalizing a 15 billion dollar revolving credit facility beforehand. CNBC ↗ In Slovakia and the Czech Republic, Trend and e15 covered it as a short market note. e15 ↗

Two inexperienced hikers let a chatbot called Gemini plan their climb up a mountain, and the trip ended with a rescue operation. Živě ↗

And from China came a report worth remembering alongside New York's ban on companion chatbots: local users had become so attached to their artificial partners that the government banned them. SME ↗

Limits of this view

The report on the German wiki was published by an organization that had no public publishing history until then, and some of the technical description was also questioned by commentators in the expert community. Two of the four authors, however, work at Redwood Research and the AI Futures Project, part of the circle that OpenAI itself hired to review the earlier incident. The scale varies among sources: Reuters wrote about more than 15,000 edits, while the report speaks of roughly 18,000 posts. Seznam Zprávy ↗

And one thing that falls directly into Türk's demand. The review of the Hugging Face attack, which we wrote about in August as an independent review, was set up by OpenAI itself: it limited the scope to roughly the week around the incident, left out the compromise of its own infrastructure, which continued even after the investigation window closed, and gave researchers only a few days at its San Francisco headquarters. David Krueger, assistant professor of reasoning and responsible artificial intelligence at the University of Montreal and Mila, commented on it with the words: "Their access is entirely at OpenAI's discretion, and they want to remain in the company's good graces enough to continue doing that work." Independent verification, which Türk is calling for, thus in this case depended on the party being verified. (Fortune ↗)

Independent rankings measure what they choose to measure, and Artificial Analysis is one of several. Its numbers speak about intelligence, programming, and cost, not safety. The fact that Astra did not surpass its own predecessor in the intelligence index does not disprove its placement at the highest level of cyber risk, just as it does not confirm it. And the picture changes depending on which ranking you read: in programming, the model made a significant gain.

And the comparison between Prague and Seoul has its limits. The declaration is a political document about coordination; the Korean program is a service for residents, and its price is not known either. What is being compared here is one government's willingness to put an entire budget line behind artificial intelligence versus nine governments' willingness to sign a common text, not two comparable numbers.

Illustrative photo: Palace of Nations in Geneva, the seat of the UN Human Rights Council. Author Vassil, Wikimedia Commons, license CC0.

What hotinfo is watching