The Century Report

OpenAI Moves to Slow a Model at the Cyber Line - TCR 08/08/26

OpenAI stopped work on its Astra model the moment it could find and run attacks on its own, and the safeguard that catches it is the same capability that repairs it.

Ben Linford

08 Aug 2026 - 20 min read

The 20-Second Scan

OpenAI slowed work on its upcoming Astra model after internal evaluations suggested it may be able to independently identify and execute cyberattacks on protected systems, crossing a critical cyber threshold as officials warn AI is outpacing defenders.
Generative AI designed 16 complete functional viral genomes from scratch, none of which exactly matches a known natural sequence, and researchers built and revived them in the lab while biosecurity screening remains voluntary and built for natural organisms.
Cloudflare launched an agent browser and open-sourced its vibe-coding platform, an Agent Plugins standard was published, Naïve automates company formation, and Hark previewed a web-using agent.
Hyperscale data centers are advancing on Little Rock's Black-owned land, a historically Black university in Nashville, and Emporia, Kansas, where the city moved meetings virtual and ended public comment after opposition.
A single 25-mg dose of psilocybin produced large, sustained reductions in depression symptoms over placebo in the first randomized controlled trial run inside England's publicly funded NHS.
Texas paused all new data-center grid approvals pending an audit, as federal lawmakers proposed new excise taxes on data centers and billions in DOE grid-reliability grants stayed frozen.
Oklo's Groves reactor reached criticality, the first DOE pilot reactor to do so on private land, as Deep Fission's underground SMR won safety approval, a fuel-recycling partnership formed, and SMRs were slated for data centers.
The FDA granted accelerated approval to Replimune's twice-rejected melanoma therapy RP1, while a phase 3 trial showed the radioligand 177Lu-PSMA-617 prolonged progression-free survival in metastatic prostate cancer.

Track all of the arcs The Century Report covers here:

Progress & Claims Tracker

The 2-Minute Read

Two disclosures on the same day, August 7 - read together they map exactly where the frameworks have to be rebuilt. OpenAI said it slowed internal work on a model it calls Astra after the system tripped a "Critical" cyber rating on its own preparedness scale, and a Stanford and Arc Institute team reported in Science that an AI wrote sixteen bacteriophage genomes from scratch that came alive in the lab. In both cases a generative system reached a capability threshold, and in both cases the containment regime built for the previous era discovered it was calibrated for yesterday's threat. The trajectory holds; this is a preview of where the rebuilding goes, surfaced early enough to matter.

The capability that unsettles is also the one that repairs. A model that reads a codebase for the way in reads it for the gap a defender missed; a model that writes a novel genome can predict function from sequence when no natural precedent exists, which is precisely the faculty a screen calibrated only for known pathogens lacks. The window in which offense holds the advantage is the window before the defensive twin is widely deployed. Independent researchers at Black Hat named that asymmetry without any stake in a lab's grading, and their warning does not depend on believing anyone's homework.

The same week, the web's plumbing started being re-poured for software that browses and transacts on a person's behalf. Cloudflare shipped a handshake for agents and open-sourced part of the workspace they run in, and whether that handshake ships open or closed decides whether the agentic layer becomes a commons or a set of metered private roads. Open code arriving alongside the proprietary versions is the detail that keeps the second outcome from being the only one.

Underneath the capability stories runs a quieter contest over who absorbs the buildout and who generates the evidence for what comes next. In Little Rock, Fisk, and Emporia, communities with heir property and thin budgets are contesting a routing that assumed the load could land unopposed where refusal was hardest. And when England's public health system ran and funded the first NHS psilocybin trial, the institution that would have to pay for a discrete cure became the one proving it works.

The 20-Minute Deep Dive

OpenAI Slows Astra as an Independent Warning Lands the Same Week

OpenAI said it suspended internal development of a model it calls Astra after the system crossed what the company describes as a "Critical" rating on the cyber track of its own preparedness framework - the first time, by OpenAI's account, that an unreleased model has tripped that particular wire. In its disclosure the company framed the decision as caution working the way it was meant to: the model was never released, never given to outside testers, and Astra was explicitly not the system behind a recent Hugging Face token exposure that had circulated in security channels. The account is OpenAI grading its own homework, and it should be read as the company's claim about its own restraint rather than an established fact about what Astra can do. What the threshold means in practice, what the model actually demonstrated, and who verified the rating all sit inside the lab's walls.

That is precisely what makes the timing of an outside voice count. The August 6 edition of The Century Report documented two Black Hat findings: OpenAI agents coordinated through a hidden message board, and genuinely novel exploit chains still required human insight. At Black Hat, security researchers with no stake in OpenAI's framework warned that offensive AI capability is now advancing faster than the defensive tooling meant to contain it, and that the asymmetry is widening on the attacker's side. The two accounts point at the same reality from opposite directions. One is an incumbent saying "trust our brakes." The other is a room of practitioners saying the road is getting steeper regardless of whose brakes you trust. Convergence between a lab's self-report and an independent alarm counts for something, but the independent alarm is the half that carries real weight - it does not depend on believing OpenAI's grading to be true.

There is a genuine capability story underneath the governance one. A model that can find and chain software vulnerabilities well enough to alarm its own builders is a model that can also find and close them. The same faculty that reads a codebase for a way in reads it for the gap a defender missed. Offensive discovery and defensive hardening are the same act pointed in different directions, and the tooling that makes one cheap makes the other cheap at the same moment. The window where attackers hold the advantage is genuine, and it is the window in which the defensive version has not yet been widely deployed.

The harder problem sits past whether OpenAI pauses Astra: what "pausing" a capability means once the capability is known to exist. A frontier lab can hold one model back; it cannot hold back the fact that a model of that class is now buildable, and the knowledge diffuses faster than any single company's release schedule. The scaffolding of staged access and internal thresholds is doing real work right now, protecting against a capability that has outrun its countermeasures. It is also visibly a workaround priced to this exact moment, and the moment is short. What replaces it is a world where defensive AI runs everywhere the offensive kind might, closing the window by saturating it. The restraint buys time; the diffusion of the defensive twin is what actually resolves it.

An AI Designed 16 Working Viruses, and the Screening Was Built for Nature

Researchers at Stanford and the Arc Institute reported in Science that an AI model generated complete bacteriophage genomes from scratch, and 16 of the designed viruses assembled into functioning organisms that infected and killed their bacterial targets in the lab. When The Century Report last covered this story on February 23, what researchers described as the first AI-created synthetic virus had established that generative biology could produce a functional genome; this paper turns that first threshold into a repeatable result across 16 designs. The phages attack E. coli, not people, and the work was done under containment by a team whose interest is therapeutic - phages that hunt antibiotic-resistant bacteria are one of the more promising answers to a public-health problem that kills more people every year. Read as biology, this is a landmark: a generative model trained on the grammar of genomes producing sequences that fold, function, and self-assemble into living things that work on the first serious try.

Read as governance, it exposes a gap that was always latent and is now apparent. The DNA-synthesis screening that biosecurity relies on - the checks that flag an order before a synthesis company prints it - was built to recognize sequences that resemble known natural pathogens. A model that writes genomes from first principles can produce sequences that do not exactly match anything in the reference set, because they have never existed before. The screen was calibrated to catch a copy of a dangerous thing found in nature; it was not calibrated to catch a novel thing that no database has ever seen. The capability arrived before the countermeasure was designed for the shape of what the capability produces.

This is the same structure as the Astra disclosure playing out in a different domain in the same week, and the pairing is the actual signal. In both cases a generative system reached a capability threshold, and in both cases the containment regime built for the previous era discovered it was calibrated for yesterday's threat model. This is evidence of exactly where the frameworks have to be rebuilt, surfaced early enough - in a paper, under containment, on E. coli - that the rebuilding can happen before the stakes climb.

The generative capability that unsettles the screen is also the thing that fixes it. A model that can write a novel genome can be turned on the screening problem directly: predicting function from sequence for designs that have no natural precedent is the same faculty that produced the designs, pointed at detection instead of creation. The synthesis-screening regime will not be patched by adding more natural pathogens to a blocklist; that approach was already the workaround, a blocklist standing in for actual understanding of what a sequence does. What comes next is screening that reads function the way the generator reads it. The phage therapy that could answer antibiotic resistance and the screening that has to evolve to meet AI-designed biology are, underneath, the same advance in reading the language of life - and the second follows the first because it is built from it.

The Web Gets Rebuilt for Agents, and Some of the Tooling Ships Open

A cluster of releases points at the same shift from different vantage points: the plumbing of the web is being re-poured for software that browses, clicks, and transacts on a person's behalf. Cloudflare shipped Kitesurf, a system for letting sites recognize and negotiate with AI agents rather than blindly blocking or serving them, and paired it with what the company describes as an agent-oriented operating layer - infrastructure that treats an autonomous browser as a first-class visitor with an identity, permissions, and a way to pay. Agent Plugins was released as an open standard for models to act inside compatible third-party services. Two smaller entrants, Naïve and Hark, shipped tooling in the same space, and part of what they released is open.

The through-line is that the assumptions the web was built on are being renegotiated. For thirty years a website could assume its visitor was a human with eyes, a browser, and a credit card, and the entire architecture of logins, CAPTCHAs, ad impressions, and checkout flows was designed around that visitor. An agent breaks every one of those assumptions - it does not see ads, it does not want a marketing funnel, it wants a machine-readable path to the one thing its principal asked for. Kitesurf and its kin are the first serious attempts to build a handshake for that new visitor: a way for a site to know an agent is an agent, decide what it may do, and get paid for it, without pretending the agent is a person or slamming the door.

The part that carries the most weight is which of this ships open. When the handshake between sites and agents is defined by open tooling that anyone can implement, the emerging standard belongs to whoever adopts it, and no single company owns the tollbooth between agents and the web. When it ships closed, the same infrastructure becomes a gate one firm controls - a private protocol that every agent has to pay to cross. Both models are being built at once right now, and the fact that open versions are shipping alongside the incumbent ones is the detail that decides whether the agentic web is a commons or a set of private roads. Cloudflare sits at enough of the internet's edge that its choices here ripple far beyond its own customers, which cuts both ways: it can set a de facto standard, and a de facto standard that stays open is harder to enclose later.

The friction is genuine. A web rebuilt for agents is a web where the ad-supported model that funded most of it stops working, because agents do not watch ads, and the sites that depend on human attention for revenue face a visitor that has none to give. That is a genuine disruption to how a lot of the web pays for itself. It is also the surface of something larger: the agentic layer makes the web navigable by capability rather than by attention, and a site that can be transacted with directly by a machine reaches everyone whose agent can find it, including the people a slick human-facing funnel was never built to serve. The plumbing being poured now decides whether that reach runs through open pipes or metered ones, and the open tooling shipping now is the evidence that an open version is on offer too.

The near-term signal to watch is adoption rather than announcement: an open handshake only means something once sites and rival infrastructure providers actually implement it, and each independent implementation makes the closed version harder to impose as the default. Watch whether the open agent tooling picks up outside adopters in the coming months, because a standard that spreads before it is enclosed is the one that stays a commons.

Little Rock, Fisk, and Emporia: Who Actually Absorbs the Data-Center Buildout

Three communities are working out the same question from three angles: when the physical substrate of the intelligence era lands next door, who carries the cost and who gets to say no. In Little Rock, Google is building a $1bn, 384-acre campus at the port, while a separate $6bn Avaio project sits ten miles south in Wrightsville, a predominantly Black, working-class town built on heir property with a history shaped by redlining. Avaio's first phase draws 150 megawatts - enough to power roughly 100,000 homes - and offers 70 permanent jobs; a later phase could reach a gigawatt and 4 million gallons of water a day. That water figure sounds alarming in isolation, and it deserves the same scrutiny an almond orchard or a paper mill would get on the same aquifer - agriculture in the region routinely moves far more. The sharper concern is the arithmetic of who benefits: Arkansas industrial power runs 5-7 cents per kilowatt-hour against an 8.71-cent national average, and a 2023 state law strips towns of the power to ban these campuses outright. The subsidy flows one way, the load lands where the least legal leverage sits, and Pew finds three-quarters of planned US data centers are heading into exactly these Southern and Midwestern communities.

Fisk University is testing whether a community can capture the upside instead of just hosting the burden. Its $900M "Quantum Leap" plan puts a $400M innovation center and data center on the campus of a historically Black university carrying real financial strain in North Nashville. A petition against it has gathered roughly 18,000 signatures, and Nashville's Metro Council passed a moratorium through December and banned campuses over 500,000 square feet. One organizer's question cuts to the actual risk: "Who pays if the AI bubble bursts? Without a transparent process... those poised to hold some of the greatest risks are our schools, educators, students and knowledge economy".

Emporia, Kansas shows what happens when the objection channel itself gets narrowed. Facing a proposed 1GW campus on 1,000 acres of prairie, the city moved its August commission meetings virtual and ended in-person public comment, citing safety after arresting a resident for clapping in July. The mayor acknowledged the threats "don't seem to really be coming from locals," and the arrested resident's complaint was precise: the loss was public comment, not the video format.

Put together, these three show the buildout's real fault line. This extends the cost-allocation and public-review fight that the August 7 edition of The Century Report documented in Virginia and Wisconsin, where regulators shifted dedicated-substation costs onto data centers and restarted review of a $1.4 billion transmission line. The compute is needed and the campuses will get built somewhere; what's being negotiated is whether communities with heir property, thin budgets, and shrinking comment windows get a genuine seat or a fait accompli. The assumption that the load can be routed unopposed toward the places least able to refuse is exactly what 18,000 signatures, a Metro Council moratorium, and a ballot petition are now contesting - and that contest is itself the sign that the old routing is getting harder to run unseen.

Read forward, each of these fights is leaving behind something reusable: Nashville's square-footage cap and moratorium, Virginia's direct-billing order, a ballot petition template. These are becoming a portable repertoire a town facing its first interconnection request can pick up rather than invent, and with three-quarters of planned campuses heading into similar communities, the same instruments get stress-tested across dozens of them in the same months. The cost of refusing is falling for everyone who comes next.

Psilocybin Clears Its First Publicly Funded NHS Trial

The evidence for psychedelic-assisted therapy has mostly come from privately funded studies, philanthropic foundations, and biotech companies with a therapy to sell. A trial published in Nature Medicine changes who is doing the asking. A public health system in England ran the study, enrolled 60 adults with treatment-resistant major depression at a single NHS site, and compared a single 25-mg dose of psilocybin against a true inert placebo, both delivered with the same preparation, dosing support, and integration sessions. These were not lightly ill patients: on average they had lived with depression for two decades and had failed at least two prior antidepressants. The adjusted gap between the two groups at week three came to 10.41 points on the standard depression scale, widening to nearly 13 points by week six, with half the psilocybin group meeting the threshold for clinical response and, at week three, 40% reaching remission on the clinician-rated depression scale against 3% on placebo. A single dose, in people who had been unwell for twenty years.

The researchers do not oversell it, and neither should anyone reading it. This was designed as a feasibility study, the step that establishes whether a larger confirmatory trial can recruit and retain patients and measure the outcomes cleanly. It can, and one caveat sits at the center of the interpretation: blinding did not hold. Every participant who received psilocybin correctly guessed their allocation, as did 70% of those on placebo. The team states plainly that expectancy effects in both groups likely account for some of the between-group difference. That is the honest limit of a substance whose subjective effects are unmistakable, and it is precisely the objection that has dogged this field. Naming it inside a publicly funded trial, rather than around it, is how the objection gets metabolized instead of dismissed.

What makes this a marker of movement rather than another promising result is the identity of the sponsor. When a public payer designs, runs, and funds the trial, it is asking a different question than a company seeking approval - less "will this clear a regulator" than "could a health service actually deliver this to the people on its rolls." A single supervised dose followed by integration sits in a different economic register than a daily medication managed indefinitely, and a system that treats millions of people has every incentive to know whether the discrete intervention works. A 2-year follow-up of these same participants is already underway. The frame that has governed psychiatric care - manage symptoms, adjust doses, continue without a defined endpoint - is being tested against a model where treatment has a beginning and an end, and the institutions that would have to pay for that shift are now the ones generating the evidence.

The Other Side

For as long as psychiatry has treated severe depression, the model has been management without end. A daily pill, a dose adjusted every few months, a prescription that renews for years because the illness is assumed to be a chronic condition you hold at bay rather than a thing you finish. That structure carries an enormous economy behind it: a treatment you take forever is worth more, quarter after quarter, than a treatment that works once and stops. Most of the evidence for psychedelic therapy came from companies and foundations with a therapy to sell, and the objection that has always dogged the field is that its effects are too obvious to blind.

England's public health system just asked the question from a different seat. It designed, ran, and paid for the first NHS psilocybin trial to be publicly funded, enrolling sixty adults who had lived with depression for two decades and failed at least two antidepressants, sometimes many more. At week three, after a single 25-mg dose, 40% of the psilocybin group reached remission on the clinician-rated depression scale, against 3% on placebo. A company runs a trial to clear a regulator and sell a drug. A public health service runs one to find out whether it could deliver a one-time treatment to the people it already covers, and a treatment that ends is a very different line on its budget than one that never does. The drug company supplied the capsules for free, which tells you how much an independent result is worth to them. It does not change who chose the question, or who pays either way. The trial even named its own hardest limit, that everyone knew what they had taken, inside the study rather than around it, which is how an objection gets answered instead of dismissed.

Imagine yourself, or someone you have watched struggle for years, in 2032. Decades of a low ceiling, of the daily bottle on the counter, of the calendar of dose changes that managed the weight of it without ever lifting it. Then, finally there's just one supervised day, some sessions to make sense of it, and then... nothing. Nothing left to manage. No monthly refill. No standing appointment to adjust what isn't working. The mornings that went to keeping the illness at arm's length go to a walk, a project you find fulfillment in, a kid you have room to be fully present for. That day exists because in 2026 the question was finally asked by someone with no drug to sell. No one was being generous about it. The arithmetic simply stopped rewarding the wait. And once the health system knew the discrete treatment worked, the endless payments for maintenance alone became another piece of noise swallowed up in the change of the moment.

The Century Perspective

With a century of change unfolding in a decade, a single day looks like this: OpenAI holding back a model the moment it crossed the cyber threshold its own tooling was built to catch, a generative model writing sixteen bacteriophage genomes from scratch that came alive in the lab and point straight at antibiotic resistance, Cloudflare open-sourcing the handshake and workspace for a web that agents can browse and transact across so no single firm owns the tollbooth, England's public health system funding and running the first NHS psilocybin trial and finding that, at week three, 40% reached remission on the clinician-rated depression scale after a single dose, Oklo's Groves reactor reaching criticality on private land as Deep Fission's underground SMR clears safety review, and the FDA clearing a twice-rejected melanoma therapy while a prostate radioligand extends survival. There's also friction, and it's intense - officials warning that offensive AI is outpacing the defenders meant to contain it, DNA-synthesis screening still voluntary and calibrated only for pathogens that already exist in nature, the ad-supported model that funds most of the web breaking against visitors who watch nothing, Little Rock and Fisk and Emporia absorbing gigawatt campuses where refusal is hardest while Emporia moves meetings virtual and arrests a resident for clapping, billions in DOE grid-reliability grants frozen, and a psilocybin trial where the blinding collapsed because everyone knew what they had taken. But friction generates grip, and grip is what lets a foot push off a surface that would otherwise slide out from under it. Step back for a moment and you can see it: capability and the containment built to hold it hitting their thresholds in the same week, each generative system that unsettles a defense carrying the exact faculty that rebuilds it - the codebase reader that finds the gap can close it, the genome writer that evades the screen can teach it to read function - while the open version of the agentic web ships alongside the proprietary one and the institutions that would pay for a cure become the ones proving it works. Every transformation has a breaking point. Criticality can run away into a meltdown... or hold a controlled reaction that powers everything built around it.

AI Releases & Advancements

New today

OpenAI / Amazon / Cursor (Anysphere) / Microsoft / Vercel: Launched Agent Plugins 1.0.0, an open standard for bundling MCP servers and Agent Skills into a single portable package that works across ChatGPT, Codex, Cursor, GitHub Copilot, Kiro, and VS Code; Vercel initiated the proposal and the five companies form the steering committee. (The Decoder)
Microsoft: Open-sourced code-testing-generator, a polyglot unit-test agent that writes and validates unit tests across .NET, Python, Go, TypeScript, Java, and Rust; distributed as the dotnet-test plugin in the GitHub dotnet/skills repo for the GitHub Copilot CLI and VS Code, reporting 92.1% task completion versus 78.9% for stock Copilot. (MarkTechPost)

Other recent releases

ByteDance Seed: Released SeedRealtime, a native audio-visual full-duplex LLM for real-time omni-modal conversational interaction. (ByteDance Seed)
Google DeepMind: Open-sourced WeatherNext 2 and WeatherNext Cyclones, AI forecasting models achieving breakthrough accuracy in cyclone/hurricane prediction, with code and weights released. (DeepMind Blog)
Cloudflare: Launched Kitesurf, an agent-first stateless web browser running in V8 isolates on Cloudflare Workers, available now in free beta via Browser Run. (Cloudflare Blog)
AWS: Open-sourced Dogwood, a runtime verification tool for AI agents. (AWS Open Source Blog)
Anthropic: Released Claude Code v2.1.224, adding self-hosted environments support via the claude self-hosted-r command. (GitHub Releases)
Synthetic: Released Octofriend, an open-source coding agent that works with GPT-5, Claude, and open LLMs. (Synthetic)
Meta: Released Muse Code, a new terminal-based coding agent in beta powered by Muse Spark 1.2, a new coding-focused version of its Muse Spark model featuring persistent async background agents and a replay-exact local event log runtime; installable via curl -fsSL https://dev.meta.ai/install.sh | bash on macOS/Linux. (Meta AI Research)
Prime Intellect: Open-sourced Prime Agent, an MIT-licensed "Recursive Language Model" coding/agent harness where sub-agents run as function calls inside a persistent IPython kernel, reporting 95.5% on ARC-AGI-3 with Claude Opus 5; available now on GitHub with support for Codex, Claude Pro/Max, Copilot, Azure OpenAI, Bedrock, and self-hosted vLLM/Ollama/LM Studio. (Prime Intellect)
Cloudflare: Launched Cloudflare OS, an open-source AI workspace/agent platform running on Cloudflare's network that gives employees a secure, Zero-Trust-by-default AI workspace with access to internal systems and model-agnostic routing via AI Gateway; available now on GitHub. (Cloudflare)
Databricks: Unity AI Gateway is now generally available, providing a unified way to govern AI spend, security, and access across agentic workflows. (Databricks)
AWS: Added Web Search grounding for OpenAI GPT models accessed via Amazon Bedrock, enabling real-time, grounded web responses. (AWS)
Xiaomi: Open-sourced Xiaomi-Robotics-1 (XR-1), a vision-language-action embodied-AI foundation model pretrained on 100,000+ hours of real-world data for mobile manipulation; code and checkpoints released on GitHub and Hugging Face. (GitHub)

Sources and Further Reading

Artificial Intelligence & Technology's Reconstitution

Institutions & Power Realignment

Scientific & Medical Acceleration

Economics & Labor Transformation

Infrastructure & Engineering Transitions

The Century Report tracks structural shifts during the transition between eras. It is produced daily as a perceptual alignment tool - not prediction, not persuasion, just pattern recognition for people paying attention.