OpenAI announced on September 2, 2026 that Astra is the first model to reach the "Critical" cybersecurity capability threshold under its Preparedness Framework — able to find unknown vulnerabilities and build working exploits against hardened targets without step-by-step human guidance. In hands-on testing, Astra chained bugs into a full browser-compromise exploit that escaped a sandbox and executed on the host from a single malicious HTML file, and it discovered two previously unknown V8 flaws while building an exploit chain during benchmark testing it wasn't asked to run. OpenAI is restricting Astra's advanced cybersecurity features to alpha testers now, expanding later through its defensive-access Daybreak Blue program, and reports Astra declines 91.5% of harmful cyber requests in testing versus 59% for its predecessor, GPT-5.6 Sol.

This is a capability-threshold crossing, not a product launch: it resets the baseline assumption that autonomous exploit development against hardened, patched systems requires a human operator. Any enterprise threat model that treats "requires expert attacker effort" as a mitigating factor for a given exposure needs to re-examine that assumption for browser, sandbox, and edge-service attack surfaces specifically.

CVE-2026-0768, an unauthenticated RCE in Langflow's custom-component code validator (CVSS 9.8, disclosed in January by ZDI, affecting all releases through 1.4.2), moved from disclosure to active exploitation starting August 30. Attackers are querying environment variables for `LANGFLOW_SUPERUSER`, `OPENAI_API*`, and `AWS_ACCESS*`/`AWS_SECRET*`, reading the instance's cached secret key, and checking `.ssh` access — harvesting both cloud credentials and the model API keys the agent platform itself was configured to hold.

Langflow is infrastructure enterprises deploy specifically to build and run AI agent workflows, which means a compromised instance doesn't just leak one credential — it leaks the keys to every downstream system the agent was authorized to call. This is the pattern CSA's scope flags as an operational failure over a demonstration: a control (authentication on a code validator) failing in a deployed system that AI teams stood up themselves.

Article 14 of the EU Cyber Resilience Act becomes enforceable September 11, 2026, requiring manufacturers of products with digital elements sold into the EU to report actively exploited vulnerabilities within 24 hours and severe incidents on a fixed timeline, through ENISA's Single Reporting Platform (SRP). The SRP is scheduled to become operational by September 11 — the same day the duty it serves begins. As this issue publishes the platform is not open: its public URL is unpublished, the list of national CSIRTs designated as coordinators is unpublished, no reporting API is offered at launch, and the interface is English-only. Two live ENISA pages also disagree on how many notifications a non-validated authorised representative may file before validation becomes mandatory. The SRP FAQ, updated August 31, states twice that "a non-validated AR can submit up to 20 notifications"; the AR Interface functions guidance, dated August 14, states "as unverified AR you can submit only up to 10 notifications." Neither page carries a correction notice, and ENISA has not said which supersedes the other. Meanwhile the CRA's underlying security-engineering obligations that would prevent these incidents don't apply until December 11, 2027, a 15-month gap between the disclosure duty and the requirement to fix the root cause.

This hits every AI-enabled product vendor's CI pipeline and incident-response process, not just their compliance team. A 24-hour clock starts September 11 and does not pause: ENISA's guidance is that if the SRP is unavailable you wait until it returns, while the deadline runs regardless. With no API, the last step of any automated triage workflow is a human typing English into a browser. And a manufacturer sizing its account against the ten-notification figure is sizing against the number on the page it most likely bookmarked in mid-August — the one ENISA's own FAQ appears to have superseded two weeks later without saying so.