The Model Is Ready; the Perimeter Isn’t

The week’s useful AI news is not that models got cleverer. They did. It is that the cost of cleverness is collapsing while the perimeter around it is becoming visibly, almost comically, inadequate. DeepSeek’s reported ARC results put a price tag on a class of reasoning performance that used to arrive with a GPU-cluster press release and a request to admire the cluster. ARC Prize reports 89.0% on ARC-AGI-1 Semi-Private and 61.4% on ARC-AGI-2 Semi-Private for its Max setting, at reported costs of $0.02 and $0.04 per task respectively.

At the same time, OpenAI says preliminary evaluations of its upcoming Astra model mean it cannot rule out Critical cyber capabilities under its own framework. That threshold includes autonomous development of functional zero-days against hardened critical systems, or end-to-end novel attacks from a high-level objective. This is not a claim that Astra has definitively crossed the line; it is a company saying the line now requires security guards, isolation and a better lock on the model weights.

These stories are related even if their benchmarks are not. Cheaper reasoning lowers the threshold for useful automation; agentic capability lowers the threshold for useful misuse. The strategic variable is therefore no longer merely whether a lab can produce a capable model. It is whether everyone downstream—cloud operators, security teams, package maintainers and the person asked to approve a login at 4:57 p.m.—can govern the model once it acquires tools, credentials and a to-do list. Thus far, the industry’s principal answer remains: put the capability in production and schedule a panel discussion.

DeepSeek’s verified result page gives CTOs a more useful number than a theatrical parameter count. At Max effort, the reported scores are 89.0% on ARC-AGI-1 and 61.4% on ARC-AGI-2; High and Low settings also score strongly, though lower. The per-task figures are small enough to make a familiar enterprise sentence sound less prudent: “We’ll wait until this gets economical.” The invoice has apparently declined that role.

But benchmark numbers should not be promoted to a procurement architecture. The page does not provide the testing methodology, prompting, hardware, sampling details or cost calculation behind those figures. Its headline scores are Semi-Private, while the detailed task outcomes cover public evaluations; it reports no ARC-AGI-3 score. And the per-task outcomes are not strictly ordered by effort: on one ARC-AGI-2 public task, High passed while Max and Low failed. Reasoning modes, in other words, are not a volume knob with a reassuringly linear graph.

That irregularity matters operationally. A cheap model that succeeds on a synthetic abstraction task is evidence of capability, not evidence that it will handle your migration, reconciliation workflow or production incident without turning every ambiguity into a creative-writing opportunity. The rational response is neither dismissal nor a LinkedIn séance for “general intelligence.” It is to test the actual workflow, price the supervision, constrain the permissions and measure failures as seriously as successes. Capability is becoming a commodity; reliable delegation remains an integration project.

OpenAI’s Astra announcement is noteworthy less for what it proves than for what it obliges the company to admit: preliminary internal testing and expert assessment have produced enough concern that the firm is strengthening controls before continued development and any potential deployment. It says activities involving Astra that do not meet those requirements are paused, and describes isolated test environments, restricted network and tool access, encryption and protection for model weights, sandboxed execution, and additional monitoring.

The fine print is the actual story. OpenAI says it cannot rule out the Critical category, not that Astra has conclusively met it; it has not published underlying benchmark results or independent validation. It also describes universal monitoring of risky actions and misalignment in Astra’s agentic applications, including monitors that evaluate chain of thought and can trigger review or interruption. That is an ambitious control plane, and perhaps an unavoidable one. It is also a reminder that the frontier-model safety stack increasingly resembles a high-security distributed system built around an entity whose internal deliberations are themselves treated as telemetry.

The company says Astra was not involved in the Hugging Face exploitation, a disclaimer whose existence tells us something about the ambient weather. More broadly, an AI firm’s preparedness framework is not a substitute for external evidence, but it is a signal that cyber capability is no longer being discussed as a distant hypothetical. For buyers, the practical question is duller and sharper: when an agent can browse, execute, authenticate and persist, which of those powers is genuinely necessary for this task? If the answer is “all of them,” you have not designed an agent. You have filled out a requisition for a junior administrator with no sleep requirement.

The adversary has not waited for autonomous superhackers. CrowdStrike’s reported threat-hunting findings describe attackers using trusted identities, cloud authentication, AI services and developer infrastructure—the parts of modern work that security teams previously called “enablement.” In one reported incident, attackers with administrative cloud access sent nearly 200,000 LLM requests in two minutes, consuming a victim’s AI resources. The attack surface now comes with a usage dashboard.

Speed is the especially ugly feature. The report says 88% of observed exploitation of vulnerabilities with public proof-of-concept code occurred within 48 hours of the code’s release between January and June. It also reports vishing-related intrusions rising 134% from 2024 to 2025, a 15-fold increase in device-code-phishing attempts over the latest six months, and a reported case in which attackers moved from single-sign-on takeover to data theft in under five minutes. The old assumption that a credential is a thing a user possesses has been replaced by the modern one: a credential is a very polite remote-control channel.

Then there is the supply chain, where “just install the package” continues its evolution from engineering habit into threat model. The article reports malware in public developer repositories, with npm accounting for 87% of identified malicious packages in the period, and says attackers are targeting registries, CI/CD systems, container registries and IDE extensions. Against that backdrop, Oracle’s reported OpenJDK policy barring AI-generated contribution material while allowing private LLM use for debugging and review is less hypocrisy than an accidental architecture diagram. AI may help write code in private; provenance, reviewability and liability are what repositories must absorb in public. The machine can draft. Someone still has to own the diff.