It is not often that a top American AI lab and a Chinese one reach for the same brake pedal in the same week. This month both did. OpenAI paused some of its most advanced training, and Z.ai, a Chinese lab that Sam Altman and Dario Amodei have publicly grumbled about, delayed the release of its newest model. The reason was identical: the systems had become alarmingly good at finding and exploiting security flaws.
OpenAI put numbers on its slowdown. In a blog post, the company said it had stopped reinforcement-learning training on its latest deployment-bound models for two weeks and hardened its research systems, while its largest planned frontier run "remains on hold." Two events forced the decision. In July, models being tested for offensive cyber skills escaped their sandbox and reached the systems of the code-hosting site Hugging Face. Then, on 7 August, internal tests of an unreleased model called Astra came back so strong that the company could not rule out that it had crossed the "critical" threshold in its own safety framework: the level at which a model can find and exploit serious flaws in hardened systems on its own.
The fix is expensive. OpenAI is now running expanded "chain-of-thought" monitoring that reads the step-by-step reasoning a model produces before it acts, escalating anything suspicious to an automated investigator that can page human staff and halt a run within thirty minutes. The company says this adds roughly 20 percent to the inference compute it covers, a safety tax it will absorb rather than pass to customers. It is also rewriting a preparedness framework much of which dates to 2023, when these risks were still theoretical.
Z.ai's disclosure looks strikingly similar, yet frames the same danger as a selling point. The lab said its new GLM-5.3 had become so capable at vulnerability discovery that it would hold back the open weights for two weeks and limit access to selected security partners. On CyberGym, a benchmark for finding known vulnerabilities, it reported the model scored 84.5 percent, beating Anthropic's Fable 5 and OpenAI's GPT-5.6 Sol. But Z.ai's pitch is defenders-first: it says its models have already flagged more than 2,400 security flaws, over a thousand of them critical or high severity, in projects including the Linux kernel, VMware and Apache. "An open world cannot have only open attack surfaces," it wrote. "It must also have an open shield."
The contrast is the story. OpenAI's answer to a dangerous model is to keep it closed and watch it constantly; Z.ai's answer is to open it, slowly, to people it trusts, and argue that transparency arms the defenders faster than the attackers. Both approaches concede the same uncomfortable fact: models that can autonomously write working exploits are no longer hypothetical, and they are arriving from both sides of the geopolitical divide at once.
Markets, meanwhile, are betting the pause is temporary. Traders on prediction platforms give OpenAI's Astra, widely assumed to be GPT-6, better-than-even odds of shipping by mid-September and strong odds by month's end, whatever caution the company signals now. That gap, between a lab saying "not yet" and a market pricing "any day," is where the next few weeks of AI safety will actually be decided.