Astra crosses a cyber threshold; Nvidia lines up $12.9B Hugging Face deal

Between August 28 and September 4, 2026, OpenAI, Anthropic, and Google each released or disclosed a frontier model with stronger agentic or cyber capabilities. Nvidia also agreed to buy Hugging Face, putting an open-model developer platform inside the largest AI-chip company.

OpenAI says GPT-6 Astra scored 100% on ExploitBench and found two previously unknown zero-day vulnerabilities during a separate evaluation. OpenAI published its safety disclosure on September 1 and says Astra is the first model to meet the Critical cybersecurity capability threshold in its Preparedness Framework. 12

ExploitBench tests whether a model can turn known software vulnerabilities into working exploits. Astra scored 100%, compared with 78.5% for GPT-5.6 Sol. On ExploitGym, Astra reached 42.4%, compared with 30.3% for Sol. OpenAI also ran a June–August evaluation using recent vulnerabilities and says Astra discovered and used two zero-days in an exploit chain; OpenAI says it is disclosing both vulnerabilities to their maintainers. 1

The threshold is about what a model can do without human intervention against hardened systems. OpenAI defines the Critical level as the ability to identify and develop functional zero-day exploits across many hardened real-world critical systems, or to devise and execute novel cyberattack strategies from a high-level goal. 2

OpenAI’s release keeps that capability behind a narrower operating envelope. Astra refuses advanced requests such as creating proof-of-concept exploits. OpenAI says its production deployment adds system classifiers, offline detection, threat-disruption measures, chain-of-thought monitoring, and production misalignment monitors that can stop unauthorized activity. The model’s benchmark results were run without production safeguards, so the scores describe capability rather than the default user experience. 12

The ordinary product is still broad. Astra is rolling out to a limited set of organizations before reaching ChatGPT Plus, Pro, Business, and Enterprise users and the OpenAI API, Microsoft Azure, and AWS Bedrock. Enterprise administrators must enable it. Standard API pricing is $10 per million input tokens and $50 per million output tokens; Fast mode runs at up to twice the speed for twice the standard price. 1

OpenAI’s own comparison puts Astra at 57.9% on Terminal-Bench 4.0, versus 37.3% for GPT-5.6 Sol and 55.8% for Claude Fable 5.1. That result describes software-engineering work; the cyber result describes a separate risk boundary. Builders should keep those evaluations separate when deciding which tools an agent may call. 1

Anthropic says Fable 5.1 costs about 25% less than Fable 5 for typical token-billed workloads, with savings reaching about 45% for highly agentic work. The company launched Fable 5.1 and Mythos 5.1 on September 1. 34

Fable 5.1 and Mythos 5.1 are the same underlying model. Fable is generally available; Mythos is available only through trusted-access programs, with safeguards designed for cybersecurity and life-science work. Anthropic’s model page reports 52.6% for Fable 5.1 on Terminal-Bench Science 0.1, compared with 24.7% for Fable 5, and 55.8% on Terminal-Bench 4.0, compared with 42.0% for Fable 5. 4

The method matters because Anthropic evaluated Fable 5.1 with production safeguards enabled. Anthropic says safeguards sometimes intervened and those tasks received zeroes, so the scores include the cost of refusing or redirecting some work. In cybersecurity, Fable 5.1 can identify software vulnerabilities, while exploit generation, penetration testing, and binary-based vulnerability scanning remain redirected to other models or controls. 4

The price change comes from cache reads: the model charges less when it reads inputs that have already been processed and stored. That matters most in long-running agents, where the same project context is read repeatedly. Anthropic also says its new Enterprise Frontier Safeguards system will let enterprise customers keep data in infrastructure they control while retaining automated misuse detection; the system begins rolling out in phases this fall. 4

Anthropic paired the release with a scientific demonstration. Mythos 5.1 produced protein-binder designs with a hit rate near 50% across 12 targets, while Anthropic says typical hit rates are 10–15%. The company sent the designs to two external organizations for laboratory validation. Mythos also sped up seven open-source biology models by up to 2.5 times, with estimated GPU-cost reductions of 30–60% for genome-wide analyses. These are Anthropic’s reported results, not an independent comparison of all scientific agents. 4

For a product team, Fable and Mythos make a practical distinction visible: the same model can sit behind different permission, retention, and misuse-control regimes. A model card or benchmark table alone cannot tell a team which regime it is buying.

Google released Gemini 3.8 Flash at an introductory price of $0.75 per million input tokens and $3.75 per million output tokens, with the standard price scheduled to double on January 1, 2027. Google published the release on September 2. 5

Gemini 3.8 Flash is built for tasks where a model can spend more inference steps and call tools repeatedly. Google reports 54.9% accuracy on HLE-Verified and says the model outperformed Gemini 3.7 Flash on software engineering, financial-agent, and legal-agent evaluations. The release also makes the trade-off explicit: lower effort levels are available for applications with tighter compute limits. 5

The cyber variant carries a different permission model. Google reports a success rate above 70% for discovering vulnerabilities across an internal benchmark covering 20 programming languages. On the external CWE-Bench patching benchmark, Flash Cyber reached 47.2% pass@1, close to a leading frontier model at 47.8%. Google’s Chrome security team produced 2.6 times more correct patches with Flash Cyber than with the best much-larger commercial models in its internal comparison. 5

Google is routing Flash Cyber through Fairwind, a limited-access program for governments, critical-infrastructure operators, and software maintainers. Fairwind combines Gemini 3.8 Flash Cyber with the CodeMender harness, which Google says writes and validates patches in a secure cloud environment. Google says more than 650 partners participate globally, while access is limited to authorized internal cybersecurity, incident-response, or penetration-testing teams with operational controls such as multifactor authentication. 6

The release leaves two separate questions for a buyer. The first is whether the cheaper Flash model completes a workflow with enough tool calls and verification. The second is whether the organization qualifies for the cyber model and can operate it within Fairwind’s controls. The same brand name does not answer either question.

Nvidia agreed on September 2 to buy Hugging Face for an $11.9 billion purchase price, plus an equity-based retention program of up to about $1 billion for employees who join Nvidia. Nvidia’s SEC filing says the transaction is expected to close in the first half of 2027, subject to customary closing conditions and required regulatory approvals. 7

The filing also gives an unusual condition for a chip-company acquisition. Nvidia committed to keeping Hugging Face’s platform open, allowing model makers, developers, and users to upload and download models and datasets of their choosing. The platform will continue to support other silicon vendors. 7

The strategic value is distribution. Reuters reported that Nvidia sees Hugging Face as a way to reach developers building with open models and potentially create a pipeline of customers for Nvidia processors. Reuters also reported that the two companies already work together to help developers use Nvidia computing services on the platform. 8

The open-platform promise matters because Hugging Face is where developers choose models, datasets, runtimes, and hardware. Nvidia’s filing says that choice remains open; the acquisition will test whether the promise holds in product defaults, optimization work, and access to the best-performing infrastructure. That last sentence is an inference from the announced ownership and platform terms, not a claim that Nvidia has already changed the platform.

OpenAI committed $1 billion over the next six months to subsidized cyber-AI access, training, technical support, and partnerships for frontline defenders. The Daybreak program says more than 2,000 approved organizations and workspaces already use its services, with access split between Daybreak Blue for common defensive work and Daybreak Red for more sensitive work. OpenAI also says its network includes more than 35 partner products and services. 9

The relationship to Astra is operational: OpenAI is pairing a more capable model with a larger, verified defender network. Eligibility still depends on authorized defensive work, and the access program is separate from ordinary model availability. 9

The four main announcements share one constraint: capability is arriving with a permission system attached. Astra, Mythos, Flash Cyber, and Hugging Face each tie technical access to a boundary—production monitoring, trusted programs, approved defenders, or an open-platform commitment. That is an editorial inference from the announcements, not a shared statement by the companies. For builders, the next test is therefore concrete: measure the model, the tool harness, the data-retention terms, and the account permissions as one deployment.