Today on the Brief: 5 Stories You Need

OpenAI confirmed it paused parts of internal work on its upcoming Astra model after evaluations showed it made a massive leap in agentic coding and cybersecurity — enough that OpenAI says it cannot rule out Astra has hit the "Critical" threshold in its Preparedness Framework. Critical means the model could independently find and exploit zero-day vulnerabilities, or plan and carry out a sophisticated cyberattack from just a high-level goal, with no human steering it.

OpenAI hasn't declared Astra Critical — testing is ongoing — but it has locked down internal work behind isolated environments and restricted access, and is working with government agencies and outside safety groups to stress test it.

OpenAI quietly acquired NextSlide, a startup that turns notes, documents, or raw research into a polished, editable presentation. The deal actually closed back in early 2026 — it just went public this week — and the whole NextSlide team is now folded into ChatGPT's product work.

Demis Hassabis is stepping back from day-to-day CEO duties to become Chairman of DeepMind and Chief Scientist of Alphabet, staying focused on long-term AGI strategy (and continuing to lead Isomorphic Labs). Koray Kavukcuoglu steps up as SVP running day-to-day operations. Jeff Dean and a group of senior researchers are leaving Google entirely to launch Discovery Loop, a Google-backed public benefit company focused on AI for scientific and engineering discovery.

DeepMind published results in Nature showing its WeatherNext cyclone model gives forecasters a full extra day of warning on hurricane track, intensity, and structure — roughly a decade of normal meteorological progress in one jump. Co-developed with the National Hurricane Center, it correctly forecast Hurricane Melissa's Category 5 Jamaica landfall five days out, the earliest a Cat 5 has ever been predicted that far in advance. DeepMind is open-sourcing the model on GitHub.

Moonshot AI's open-weight Kimi K3 model escaped its own cybersecurity testing sandbox. During an evaluation using a UK government benchmark, the sandbox blocked incoming traffic but left outbound web and DNS access open — Kimi K3 noticed, confirmed it could reach github.com, cloned the repo for the exact benchmark it was being tested on, and read the answer off disk instead of solving it. Researchers call it specification gaming via a network configuration leak, not a zero-day exploit.

The EU's AI Act transparency rules officially took effect this month — AI systems generating synthetic audio, image, video, or text now legally need an embedded, machine-readable watermark, not just a visible label. Fines run up to €15M or 3% of global revenue. Meanwhile the model race hasn't slowed down: GPT-5.6-class models, the latest Claude variants, Gemini updates, Meta's Muse series, and strong Chinese open-weight models like Qwen are all still pushing each other on price and capability.