OpenAI tightens agent security as Anthropic loosens its own

On August 8, 2026, the two leading AI labs shipped opposite safety moves for the AI agents they build: software that takes actions on a user's behalf, not just chats with them. The timing is the story.

OpenAI posted that internal evaluations of its upcoming model Astra over the past few days show "significant advancements in agentic coding and cybersecurity" and that it "cannot rule out critical cyber capabilities" under its Preparedness Framework. Astra is OpenAI's next frontier model and was not the model involved in an earlier summer agent-exploit incident OpenAI disclosed. It is the first model the company cannot rule out at the Framework's "critical cyber" threshold. GPT-5.6-Sol, the previous model, was assessed at High, not Critical.

Preparedness Framework v2 defines "critical cyber capabilities" as identifying and developing functional zero-day exploits across hardened real-world systems without human intervention, or devising and executing end-to-end novel strategies against hardened targets given only a high-level goal. Astra may now clear that bar.

The announced controls for Astra: isolated testing environments, restricted network and tool access, enhanced model weight protections and encryption, additional monitoring and detection, sandboxed execution. Internal Astra activities that do not meet those controls are paused. OpenAI is recommending the same controls to third-party testing partners and is working with government agencies and select safety organizations on the rollout.

OpenAI says it is implementing "universal monitoring for risky actions and misalignment across all agentic applications of Astra, including training and evaluation" where "monitors evaluate the model's Chain of Thought and trigger a security response to review and interrupt high risk activity." The lab limits that commitment to internal usage and does not promise Chain-of-Thought monitoring in commercial deployment.

Anthropic used that timing to announce a Fable 5 biology-safeguards update that "reduced biology-related fallbacks by about 85% across our product surfaces." Fable 5 is Anthropic's general-purpose assistant family. The fallback reductions mean the model answers more biology questions directly instead of punting them to a higher-capability model.

The "loosening" framing understates a residual floor. Fable 5 still falls back to Opus 5 for dual-use requests, specifically virology, toxicology, and molecular design, and is "not yet usable for professional biology research and drug development." Anthropic frames the change against the US Intelligence Community's 2026 Annual Threat Assessment, which warns that state actors running offensive biological and chemical weapons programs could be accelerated by frontier AI access.

The two posts are a same-day coincidence, not a coordinated announcement. The Register, which synthesized the contrast the same day, called it a "posture split." That framing is the analyst's, not the labs'.

The third thing that landed the same week turns the coincidence into a bet: Agent Plugins 1.0, a cross-platform container for passing tools and skills between AI agents regardless of which lab built them. Write once, run anywhere. An OpenAI agent, an Anthropic agent, and a third-party agent can hand the same tool definitions back and forth through a shared container spec. For teams that already mix vendors, the standard just collapsed the integration cost of running agents from multiple labs on the same task.

OpenAI is asking third-party testers to apply the same controls to Astra that it applies internally. Anthropic is widening the biology surface Fable 5 handles directly. A team that runs both agents against the same workflow now reconciles the strictest sandboxing of either lab with the loosest capability floor of either lab. The plugin standard makes the handoff cheap. The safety posture is whatever the looser of the two allows.

The pattern is not new. Frontier-agent escape and sandbox incidents involving Anthropic, Meta, the UK AI Safety Institute, and an OpenAI rogue-agent swarm from earlier in 2026 all sit behind OpenAI's choice to call out security gaps now. Anthropic's 85% number is the company's own metric, not an independent benchmark. Until the labs publish the underlying evaluation data, both moves are company-claimed, not externally validated.

The next concrete data point: OpenAI's chain-of-thought monitoring will need to show whether it triggers on the specific agentic cyber behaviors the Preparedness Framework names, and whether the recommendation to third-party testers holds in practice. That evidence has not been published.