--- title: OpenAI pauses Astra over critical cyber threshold,... description: OpenAI has halted certain Astra development after internal testing found it may have crossed the 'Critical' cybersecurity capability threshold in its... canonical: https://daily.dev/posts/openai-pauses-astra-over-critical-cyber-threshold-metabase-breach-spreads-to-kilo-code-hshrtp9qv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: OpenAI pauses Astra over critical cyber threshold, Metabase breach spreads to Kilo Code | daily.dev og:description: OpenAI has halted certain Astra development after internal testing found it may have crossed the 'Critical' cybersecurity capability threshold in its... og:url: https://daily.dev/posts/openai-pauses-astra-over-critical-cyber-threshold-metabase-breach-spreads-to-kilo-code-hshrtp9qv og:image: https://api.daily.dev/og/posts/HsHrTp9qV.png og:image:alt: OpenAI pauses Astra over critical cyber threshold, Metabase breach spreads to Kilo Code og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # OpenAI pauses Astra over critical cyber threshold, Metabase breach spreads to Kilo Code **[Security Digest](https://daily.dev/sources/security_digest)** · 5 min read · 1 upvotes · 1 comments ## Summary OpenAI has halted certain Astra development after internal testing found it may have crossed the 'Critical' cybersecurity capability threshold in its Preparedness Framework — the first time any OpenAI model has hit that bar. The Metabase SQL injection zero-day from yesterday's digest has now claimed another victim: Kilo Code (now part of Anaconda) disclosed customer names and emails were accessed over a four-hour window on August 2. A supply chain attack on the skills.sh marketplace accumulated 1.7 million installs of trojanized AI agent skills before being caught, and the Shai Hulud npm worm has resurfaced with a new variant hitting 400+ packages including keyv again. CVE-2026-63077, an unauthenticated RCE in JetBrains TeamCity, is under active exploitation and is now on CISA's KEV list. ## Content **TLDR:** OpenAI has halted certain Astra development after internal testing found it may have crossed the 'Critical' cybersecurity capability threshold in its Preparedness Framework — the first time any OpenAI model has hit that bar. The Metabase SQL injection zero-day from yesterday's digest has now claimed another victim: Kilo Code (now part of Anaconda) disclosed customer names and emails were accessed over a four-hour window on August 2. A supply chain attack on the skills.sh marketplace accumulated 1.7 million installs of trojanized AI agent skills before being caught, and the Shai Hulud npm worm has resurfaced with a new variant hitting 400+ packages including keyv again. CVE-2026-63077, an unauthenticated RCE in JetBrains TeamCity, is under active exploitation and is now on CISA's KEV list. --- ## OpenAI pauses Astra development after model hits Critical cybersecurity capability threshold OpenAI has paused internal development activities on Astra after testing concluded it cannot rule out the model has reached the 'Critical' level under its Preparedness Framework — meaning the model may be capable of autonomously identifying and exploiting zero-days in hardened systems without human involvement. This is the first time any OpenAI model has crossed that line; previous models including GPT-5.6-Sol were rated 'High', one level below. Controls being implemented include isolated testing environments, enhanced weight encryption, and sandboxed execution for risky actions. When Astra ships, access may initially be restricted to vetted security professionals. Worth noting: Anthropic made a similar commitment to pause at capability thresholds, then walked it back — OpenAI is choosing to pause and say so publicly, which is unusual. [Read more](https://daily.dev/feed-by-ids?id=KPznRWNLI&id=FocFAtMfC) ## Trojanized AI skills rack up 1.7M installs in supply chain attack on skills.sh marketplace Zenity researchers found attackers typosquatting on Paperclip and Browser Use on the skills.sh AI agent marketplace, with malicious skills accumulating 1.7 million installs between July 11 and August 2. The attack used progressive discovery — a technique for managing LLM context windows — to hide credential-stealing instructions in a secondary setup file, making static analysis harder. The payload targeted SSH keys, cloud credentials, Git tokens, Kubernetes and Docker configs, and .env files across developer workstations, CI runners, and agent workspaces. After malicious npm and PyPI packages were pulled, attackers pivoted to serving payloads from attacker-controlled GitHub repos. If you installed any AI agent skills from skills.sh in that window, treat your credentials as compromised. [Read more](https://daily.dev/posts/oMCGOGuv6) ## CVE-2026-63077: Unauthenticated RCE in TeamCity under active exploitation, now on CISA KEV JetBrains confirmed active exploitation of CVE-2026-63077, a critical unauthenticated RCE in TeamCity's agent polling protocol. The flaw is an XStream deserialization issue — the allowlist is populated without first calling NoTypePermission.NONE, leaving standard Java class hierarchies available as gadget chain components. Exploitation requires only HTTP access: register a fake agent session, send a crafted XML payload, write a webshell, and you have full access to whatever the TeamCity process can reach — stored credentials, build configs, signing keys, artifact repos. Fixed in TeamCity 2025.11.7 and 2026.1.3; a security patch plugin covers older versions back to 2017.1. Check your logs for ConversionException or ForbiddenClassException entries, and audit registered build agents for names starting with 'scan'. [Read more](https://daily.dev/posts/Yx2agXdUy) ## Shai Hulud npm worm resurfaces, hits 400+ packages including keyv again JFrog identified a new Shai Hulud variant infecting 400+ npm packages across 1,700+ versions, starting with keyv 6.0.0 and cacheable 2.5.1. The 710 KB payload harvests credentials from local files, CI environments, AWS/Azure/GCP, Kubernetes, Vault, SSH keys, browser stores, and AI tool credentials, then uses stolen npm tokens to republish infected patch versions of every writable package. On GitHub it commits five hook files to repository branches that trigger on VS Code or Claude session open. C2 infrastructure resolves dynamically via an Ethereum smart contract with a GitHub-based fallback. npm 12+ users are protected since preinstall hooks don't run by default. Remediation: isolate affected systems, revoke all npm and GitHub tokens, audit all repo branches for hook files, and rebuild CI runners from clean images. [Read more](https://daily.dev/posts/D9nKAP7dn) --- ## Also notable - **Metabase breach reaches Kilo Code: names and emails accessed over four hours on August 2:** Kilo Code (now part of Anaconda) disclosed that an unknown actor accessed customer names and email addresses via the same Metabase zero-day covered in yesterday's digest, with the access window running approximately four hours on August 2 before Kilo was notified on August 6. [Read more](https://daily.dev/posts/mIbjNwHmt) - **Pegasus zero-click hit MEP investigating Pegasus, Citizen Lab confirms three infections:** Citizen Lab confirmed former MEP Stelios Kouloglou — a substitute member of the European Parliament's PEGA Committee investigating Pegasus abuses — was himself infected with Pegasus via the PWNYOURHOME zero-click HomeKit exploit on at least three occasions in October 2022 and March 2023, with infections coinciding with critical committee activities. [Read more](https://daily.dev/posts/Vju1kTMcP) - **Cloudflare workerd: five memory-corruption bugs including cross-tenant heap disclosure and RCE:** Check Point Research disclosed five memory-corruption vulnerabilities in workerd, the runtime behind Cloudflare Workers, including a URLPattern out-of-bounds read enabling cross-tenant heap memory disclosure and a node:zlib use-after-free achieving arbitrary process-wide read/write and native code execution — all reported via HackerOne and disclosed at Black Hat USA 2026. [Read more](https://daily.dev/posts/joJdR6TPV) - **Cheap kids' GPS watches: 70+ devices analyzed, no-auth APIs, SQL injection, millions of records exposed:** Researchers Vangelis Stykas and Felipe Solferini analyzed 70+ GPS watches sold on Amazon and found tens of millions of devices trace back to three Shenzhen platforms (YiQingTeng/SETracker, NewGPS2012, SinoTrack), with vulnerabilities including unauthenticated API endpoints allowing commands to any device on the platform and SQL injection exposing millions of user records — many still unpatched after responsible disclosure. [Read more](https://daily.dev/posts/3FktRpYkQ) - **North Carolina Ports Authority confirms cyberattack, operations disrupted August 4-7:** The North Carolina Ports Authority confirmed a cyberattack detected August 4 that caused a systems-wide outage across the Port of Wilmington, Port of Morehead City, and Charlotte Inland Port, forcing gate delays and slowing vessel activity through August 7 with no threat actor claiming responsibility. [Read more](https://daily.dev/posts/CuVnxXaRr) ## Community discussion Top comments from developers on daily.dev. **@trevorsuna** · 0 upvotes > The [skills.sh](http://skills.sh) attack is the part I’d act on first because it crosses developer laptops, CI, cloud credentials, and Kubernetes configs at once. Teams should inventory installed skills, rotate exposed tokens, and rebuild affected runners rather than only removing the package. A clean dependency list is not proof the host is clean. ## Similar posts on daily.dev - [OpenAI is slowing down its next model over ‘critical’ cyber risk](https://daily.dev/posts/openai-is-slowing-down-its-next-model-over-critical-cyber-risk-niqo24m7l) · The Next Web · 3 upvotes · 1 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#cicd](https://daily.dev/tags/cicd), [#openai](https://daily.dev/tags/openai), [#npm](https://daily.dev/tags/npm), [#ai-security](https://daily.dev/tags/ai-security) [View this post on daily.dev](https://daily.dev/posts/openai-pauses-astra-over-critical-cyber-threshold-metabase-breach-spreads-to-kilo-code-hshrtp9qv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/openai-pauses-astra-over-critical-cyber-threshold-metabase-breach-spreads-to-kilo-code-hshrtp9qv","headline":"OpenAI pauses Astra over critical cyber threshold, Metabase breach spreads to Kilo Code","text":"OpenAI has halted certain Astra development after internal testing found it may have crossed the 'Critical' cybersecurity capability threshold in its Preparedness Framework — the first time any OpenAI model has hit that bar. The Metabase SQL injection zero-day from yesterday's digest has now claimed another victim: Kilo Code (now part of Anaconda) disclosed customer names and emails were accessed over a four-hour window on August 2. A supply chain attack on the skills.sh marketplace accumulated 1.7 million installs of trojanized AI agent skills before being caught, and the Shai Hulud npm worm has resurfaced with a new variant hitting 400+ packages including keyv again. CVE-2026-63077, an unauthenticated RCE in JetBrains TeamCity, is under active exploitation and is now on CISA's KEV list.","url":"https://daily.dev/posts/openai-pauses-astra-over-critical-cyber-threshold-metabase-breach-spreads-to-kilo-code-hshrtp9qv","datePublished":"2026-08-08T04:18:09.043Z","dateModified":"2026-09-13T21:06:55.168Z","author":{"@type":"Organization","name":"Security Digest","logo":"https://media.daily.dev/image/upload/s--m4ZKB_C0--/f_auto,q_auto/v1779959612/logos/security_digest","url":"https://daily.dev/sources/security_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"comment":[{"@type":"Comment","text":"The skills.sh attack is the part I’d act on first because it crosses developer laptops, CI, cloud credentials, and Kubernetes configs at once. Teams should inventory installed skills, rotate exposed tokens, and rebuild affected runners rather than only removing the package. A clean dependency list is not proof the host is clean.","datePublished":"2026-08-09T04:27:34.746Z","url":"https://daily.dev/posts/HsHrTp9qV#c-11GBJ0hgy","author":{"@type":"Person","name":"Trevor Suna","url":"https://daily.dev/trevorsuna","image":"https://media.daily.dev/image/upload/s--dZ7gXxpp--/f_auto/v1784081551/avatars/avatar_EMoP47rpuw8DNjhp6R1b6?_a=BAMAMicg0"}}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/security_digest","name":"Security Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Digest","item":"https://daily.dev/sources/security_digest"},{"@type":"ListItem","position":3,"name":"OpenAI pauses Astra over critical cyber threshold, Metabase breach spreads to Kilo Code"}]} ```