OpenAI’s own yardstick has graded an incoming model too sharp to hand everyone. Path to Astra confirms Astra clears the Critical cybersecurity threshold — the first model a lab has designated at that level — and the advanced cyber capability ships gated behind a tester cohort and Daybreak Blue, with classifiers trained to stop an API task mid-run. The same day, capital made its answer: Cognition is reported closing roughly a billion dollars at about a $47 billion valuation, a bet on the coding harness rather than the model tap, in the same week OpenAI cut Cursor off model access. And today is the opening day of the Grok 4.7 window, except there is no Grok 4.7 anywhere. One day, three answers to the same question: who gets held back, who gets hedged, and what actually shipped.
The gate is now part of the release
What happened. Path to Astra (Sept 1) arrived in the shape this morning’s breaking note sketched: Astra meets the Critical threshold under the Preparedness Framework — able to find previously unknown security flaws and exploit them across many well-protected systems without a person guiding each step — the first model designated at that level. It scored a perfect 100% on ExploitBench, and on an internal port of 20 recent high-severity V8 vulnerabilities it converted to code execution far more often than GPT-5.6 Sol on fewer output tokens, discovering and using two zero-days inside an exploit chain it is now disclosing to the maintainers. The advanced cyber work ships gated: an alpha tester cohort first, expanding through Daybreak Blue for defensive use, with “more friction than we ultimately intend” at launch and hardware security keys mandatory for Daybreak accounts. Production monitoring now runs classifiers over the model’s reasoning and actions that auto-stop unauthorized activity — in ChatGPT and Codex a task pauses for review; on the API it simply stops. OpenAI is explicit that long-running and innocent-looking agent jobs will get caught in the net.
Why it matters. The breaking note planted the flag and the primary now confirms the numbers — the perfect ExploitBench, the chained zero-days, the gated release — so the scorecard is settled before the model ships. What’s new is the failure mode it formalizes: your long-horizon agent can be stopped cold by a monitor it never saw, and the lab says legitimate defensive work will be flagged too. Anyone running long agents has to design for an external kill switch in the runtime, and anyone maintaining a security baseline has to treat autonomous zero-day work as an available, purchasable capability rather than a rumour. Notice the template, now running at two of the four frontier labs: broad model, gated sharpness — the Mythos pattern Anthropic shipped yesterday. The agent trust floor and the exploit clock both just got their first official number.
Source: openai.com, wired.com
Capital is pricing the route around the model tap
What happened. Bloomberg reports Cognition is set to close a round of roughly $1 billion at about a $47 billion valuation, with the final size likely to exceed that given nearly $10 billion in investor interest; talks are ongoing and terms may still change. Reported annualized revenue is north of $900 million on its Devin coding agent, up from about $492 million at the end of May. The ladder reads: $10.2 billion last September, $26 billion in May, roughly $47 billion now — about 80% in under three months, call it fifty times run-rate revenue.
Why it matters. A ~50x run-rate price on a coding agent is a category bet, not an earnings call, and the category it prices is the harness, not the model. Three days after OpenAI moved to cut Cursor off GPT access, capital is marking up the credible second harness to within sight of the $60 billion SpaceX paid for Cursor — the market’s answer to a supply line it has just watched get switched off. For an operator the valuation is noise and the procurement risk is the signal: the agent layer is where value is accreting, and who you build on now reads like a contract with an expiry date.
Source: bloomberg.com
The window opened and there was nothing in it
What happened. Today is the first day of the release window Musk gave Grok 4.7 on August 12 — “3 to 4 weeks,” pointing at September 2 through 9 — and the model list at docs.x.ai still tops out at grok-4.6: no 4.7 model ID, no price card, no context window, no benchmark anywhere on x.ai/news. His July 25 window (around August 22) is already gone, and the precedent is how he framed Grok 4.6 — floated for around August 7, shipped August 12. What is genuinely interesting is the reported reason for the extra training: a supplemental pass over SpaceX engineering data (Starlink telemetry, Raptor chamber-pressure logs, Starship re-entry records, internal Slack, Jira, and repo artifacts), with a roughly 2.1-trillion-parameter design reported but nowhere confirmed.
Why it matters. Score the countdown the way the release-watch discipline requires: a tracker date was never a commitment, and xAI’s verbal deadlines have a measurable bias toward the later end. The artifact to watch is the model list, not the tweets — grok-4.6 first appeared on the docs page, then got announced. For anyone routing traffic nothing else changes: build on what is live at $2/$6 and treat a just-shipped model’s first-week vendor benchmarks as the numbers to distrust until independent re-runs land. The SpaceX corpus is the most interesting unverifiable thing in frontier AI right now, and it only becomes a claim anyone can test if it shows up in a rerunnable engineering evaluation once the model actually exists.
Source: x.ai, orcarouter.ai
The Rest
- Wrapture — the wrapt author shipped an agent-built Python library that wraps real code and serves unit mocks, failure injection, and OpenTelemetry tracing from one mechanism — 1,000-plus tests from a mid-August start, plus an explicit “every line written by an AI under my direction, not vibe coding” disclosure. The accountable-agentic-engineering lane, with an observability tool in it. grahamdumpleton.me
- The Bay Area data-center boom is about to meet the regulators — localities across the region are pushing back on permits and power, the local San Jose fight I flagged Sunday having gone regional; treat siting-and-power friction as a cost risk sitting under any on-site compute plan. mercurynews.com
- US strikes on Iran put a war premium under inference cost — CENTCOM hit IRGC targets in Iran, the first US attacks in a month, and after Iranian retaliation on Gulf and Jordan targets crude moved up. Energy is the biggest line under every token you serve; the bill now carries geopolitical beta. theguardian.com
- Bay Area high-end housing is getting its own AI boom — wealthy buyers, many of them AI-employed, are bidding up high-end homes as an asset class, which is what happens when comp packages start resembling endowments. mercurynews.com
What I’m watching
Two scorecards on the near horizon. Astra’s system card at launch tests whether the Critical designation survives production safeguards and how wide the Daybreak Blue on-ramp actually opens — the gate is only meaningful if the pipeline behind it is real. And the Grok 4.7 watch shifts from the calendar to the model list, the one artifact that makes a release official. The slower thread is the release template itself: if gating sharp capabilities becomes the default at the frontier, the open-versus-closed debate stops being about weights and starts being about whether the sharpest capability is in anyone’s copy at all.