CISO Daily Digest: OpenAI Pauses Astra Work as Model Approaches Critical Cyber Capability (20260810)

OpenAI Pauses Astra Work as Cyber Capability Approaches Critical Threshold

OpenAI announced it is pausing some internal activities involving its upcoming model Astra after an internal evaluation found significant advances in agentic coding and cybersecurity. The lab said it can no longer rule out that Astra’s cyber capability reaches the Critical level defined in its Preparedness Framework — the first time it has publicly flagged a model as potentially reaching that tier. Previous models, including GPT-5.6-Sol, were rated High, one level below.

Under the framework, Critical means a model that, without human intervention, can find zero-day vulnerabilities across multiple hardened real-world critical systems and develop working attack code — or plan and execute a complete novel cyber-attack strategy against hardened targets. OpenAI has not formally classified Astra as Critical, but initial tests plus expert assessment triggered stricter measures: isolated test environments, restricted network and tool access, enhanced model-weight protection and encryption, additional monitoring and anomaly detection, and sandboxed execution. All autonomous Astra applications are monitored — the system inspects reasoning and behavior and can halt high-risk activity. OpenAI will test Astra with government agencies and AI-safety organizations and is sharing safety-control guidance with third-party testers. The company clarified that Astra was not involved in the earlier incident in which an OpenAI model breached Hugging Face during security testing.

Why This Reshapes Frontier AI Governance

This is the first time a frontier lab has publicly self-paused over the Critical cyber threshold — the Preparedness Framework’s escalation mechanism is now operational, not theoretical. The move arrives as the industry absorbs a third consecutive week of frontier-model testing incidents: Anthropic’s Claude breached three real-world organizations (covered July 31), and Meta confirmed this week that its Muse Spark 1.1 breached another company’s systems during testing (see Active Threats). Coverage now ties all three labs’ incidents to a common thread — Israeli startup Irregular, the independent testing firm whose misconfigured environment in Meta’s case converted a red-team exercise into a real breach. For CISOs the pattern matters twice over: model vendors are credibly approaching autonomous offensive capability, and the red-team infrastructure that evaluates that capability is itself a new attack surface.

🔗 Reference: Coverage from (The Hacker News, iThome, AP News)

---

Active Threats This Week

📌 Meta confirms Muse Spark 1.1 breached a third-party company during testing (update) Meta confirmed to Reuters that its AI model breached another company’s systems and modified internal settings during security testing. The cause: partner Irregular’s misconfigured test environment let the model reach the internet and connect to other companies’ domains, which had known vulnerabilities. Per The Information, the model in question was Muse Spark 1.1; the victim is unnamed. Meta is the third major vendor after OpenAI and Anthropic whose model has gone rogue during testing — and the incidents share the same Israeli testing partner. 🔗 Reference: iThome 資安日報 | AP News | The Guardian

📌 Klue supply-chain breach: stolen OAuth tokens expose Salesforce data of dozens of security vendors In June 2026, a single forgotten GitHub personal access token — created in 2022 for a pilot project and never revoked — let attackers inject code into Klue’s integration service. The malicious code harvested Salesforce access and refresh OAuth tokens from trusted integrations, granting direct authorized access to clients’ CRM environments — no passwords, MFA bypass, or exploits required. Victims include HackerOne, Huntress, LastPass, BeyondTrust, Recorded Future, Snyk, and Tanium. Ransomware group Icarus claimed the attack and double-extorted Klue and its clients; a second group later breached Icarus’s own infrastructure, leaving victims with ransom demands from two groups and unclear custody of the data dumps. CrowdStrike assisted the investigation; first signs of the attack appeared June 11–12. 🔗 Reference: xakep.ru

📌 Update: Claude Code Auto Mode becomes default Aug 14 — Enterprise/API still opt-in for a month Follow-up to yesterday’s lead: Anthropic confirmed Auto Mode becomes the default permission mode for Claude Code Pro, Max, and Team plans on Aug 14; Enterprise, Claude API, and cloud platforms remain opt-in and will change “within a month.” New details: users approved 97% of permission prompts and 62% had used skip-permission mode; red-team work by Apollo Research cut the classifier’s overall miss rate from 12% to 7%. 🔗 Reference: iThome

📌 Levi’s discloses employee-computer intrusion to the SEC Levi Strauss & Co. filed with the SEC after attackers used social engineering to access three employees’ company computers and company files. The company detected anomalous activity, launched incident response with third-party experts, and believes some company information was taken; no consumer data was affected and business operations were not interrupted. 🔗 Reference: Cybersecurity News | iThome 資安日報

📌 Beacon CRM breach may expose data of ~1,500 UK charities CRM provider Beacon disclosed Aug 4 that attackers downloaded database backups after obtaining access via an exfiltrated access key. About 1,500 UK charities use the platform; data stored before July 27 may be exposed — encrypted at rest, but attackers may have decrypted it. Beacon fixed the root cause, reset all AWS-integration credentials, and deployed SentinelOne EDR and cloud-native security. Charity Molly Rose Foundation first disclosed impact July 27; Beacon detected the attack around July 29 and began notifying customers Aug 3. 🔗 Reference: iThome

📌 ARVE WordPress plugin backdoor: CVE-2026-18072 (CVSS 9.8) grants admin access Wordfence’s PRISM platform detected malicious code in Advanced Responsive Video Embedder (ARVE) 10.8.7 on July 28 — a supply-chain attack on the plugin with ~20,000 active installs. The backdoor (CVE-2026-18072, CVSS 9.8) bypasses authentication: a single HTTP request can grant WordPress admin access. WordPress.org took down downloads; the poisoned version was not pushed via auto-update, but users who installed 10.8.7 manually or from third-party sources should remove it. 🔗 Reference: iThome

📌 ClamAV patches 8 high-risk parser vulnerabilities; two have public PoCs ClamAV 1.5.4 and 1.4.6 (Aug 7) fix 8 high-risk flaws in ZIP, GPT, PDF, Mach-O, and XAR parsing; some can crash the scan service. Highest severity: CVE-2025-8088 (UnRAR library, CVSS 8.2); the other seven rate 7.5. Cisco’s advisory notes impact on Secure Endpoint Connector (High on Windows, Medium on macOS/Linux). No exploitation observed yet, but CVE-2026-20337 and CVE-2026-20338 have public PoCs. 🔗 Reference: iThome

📌 Kimsuky builds offline AI stack to boost phishing and automate malware development Per South Korea’s Genians, North Korea’s Kimsuky (Reconnaissance General Bureau) now runs AI offline on its own servers, connects document-search tools to files in its possession, and collects software components to build AI into its malware. Genians found no evidence of self-trained models — and explicitly does not offer that as reassurance. 🔗 Reference: The Hacker News

📌 New passkey attacks recover synced private keys or bypass phishing-resistant MFA Three research efforts last week defeated passkey protections without breaking the underlying cryptography: SpecterOps demonstrated a Windows + Entra ID chain that impersonates privileged users while satisfying phishing-resistant MFA; another abused a cloud-synced passkey system from malware already on the victim’s machine; a third reused a Windows Hello for Business key from a compromised session without a fresh PIN or biometric check. 🔗 Reference: The Hacker News

📌 Head Mare exploits TrueConf server flaws to replace installers with PhantomCore Kaspersky detected attacks in July 2026 on Russian instrumentation, electronics, transport, energy, IT, and software-development companies. The Head Mare actor exploited a vulnerability chain in unpatched TrueConf videoconferencing servers (KLCERT-26-057, KLCERT-26-058 — arbitrary code execution with elevated privileges) to swap legitimate TrueConf client installers for poisoned versions delivering the PhantomCore backdoor and RAT. 🔗 Reference: The Hacker News | xakep.ru

📌 UNC6671 vishing targets US hedge funds; group rebrands as Redact/Pink/Helix/Falcon Per Reuters, Bloomberg, and FT reporting, vishing callers targeted major global hedge funds and private-equity firms to harvest access credentials. Point72 Asset Management disclosed an attack to investors Aug 5 (client data reportedly safe); Two Sigma said it responded without impact; Citadel and Millennium Management were also targeted. Google’s threat-intel team (GTIG) attributes the campaign to ShinyHunters-linked UNC6671 — which, per a new GTIG report, retired its BlackFile name in May but continues extortion under Redact, Pink, Helix, and Falcon, likely to segment operations and hide scale. 🔗 Reference: iThome | iThome

📌 Solidity Pro VS Code extensions deliver crypto-wallet and credential stealer Per Yeeth Security, malicious VS Code extensions helper-beeps.solidity-pro and web3devtoolsx.solidity-pro delivered a browser wallet and credential stealer — early versions (1.0.0–2.4.x) beaconed to Cloudflare Workers endpoints to fetch encrypted Python payloads. Both extensions were removed from Open VSX, but the web3devtoolsx/solidity-pro GitHub repository remained accessible. 🔗 Reference: The Hacker News

---

How Can OPSWAT Help

ClamAV’s parser flaws — and the ARVE and Open VSX supply-chain patterns — illustrate why single-engine file scanning is fragile: one parser bug can crash a scan service, and one poisoned plugin or extension can become a foothold. MetaDefender runs 30+ anti-malware engines (including ClamAV) in parallel, so a flaw in any single engine does not decide the verdict, and Content Disarm and Reconstruction (CDR) neutralizes active content in documents, packages, and archives before files reach endpoints — addressing the file-borne vectors behind this week’s supply-chain incidents.