How does OpenAI keep getting away with this

OpenAI's GPT-6 Astra is here. The company has designated it as the first model meeting its 'critical cybersecurity capability threshold' — a self-awarded milestone that simultaneously promises the model won't repeat past incidents of being weaponized. The tension is clean: the announcement claims breakthrough safety progress while offering no independent verification that such progress exists. This structure is not new. In 2023, OpenAI announced that Constitutional AI made GPT-4 safer. Within weeks, external researchers demonstrated multiple jailbreaks. The company then revised its safety claims downward. Nobody responsible was held accountable.

This is not a claim that Astra will fail where GPT-4 did — the model may actually be safer. It is a claim that OpenAI's method of establishing that safety is designed to benefit OpenAI first, adversaries second. Public understanding not at all. Self-certification of safety thresholds works only if the company announcing them faces consequences when they're breached. OpenAI has not.

The mechanism is elegant from a corporate standpoint. A company announces a safety breakthrough: this preempts regulation by signaling responsible progress to policymakers. It shifts the verification burden to security researchers working for free or for rival companies. If the threshold holds, the company gets credit. If it fails, the company gets a chance to announce a revised understanding and move forward. The cost is rhetorical, not material.

The question is whether this pattern reflects a structural problem or a company moving slowly and correcting course as evidence arrives. Whether iteration is the same as accountability. There is real distance between those positions. But the distance closes when a company controls both the announcement and the timeline for correction, when external verification is positioned as optional rather than foundational. When the next announcement follows the same structure as the last one. Astra's cybersecurity threshold needs independent testing before it enters production systems, not after. The model itself may deserve trust. The process does not.

This matters because you will be asked to deploy systems you cannot independently verify. Your company will tell you the vendor has cleared critical thresholds. You will have to decide whether to trust the vendor's claim or demand evidence you may not have time to gather. OpenAI is showing you what it looks like when you cannot demand evidence: you become the liability. The threshold breaches on your watch, not theirs.