Five stories this week, and they all land on the same layer: the control plane between models and money. OpenAI ships GPT-6 Astra as the first model it rates critical for cyber under its Preparedness Framework. CIOs watch vendors rewrite contracts around outcomes instead of seats — on the SaaS desk and the SI desk at once. KPMG takes the first Big Four AIUC-1 certificate for an agentic tool. AWS tells partners their time-and-materials habits will not survive the AI era. Snowflake’s Cortex AI Gateway frames the data cloud as the place agent traffic gets governed — same checklist, different logo.
Underneath all of it: autonomy without a control plane is just spend with a longer blast radius.
OpenAI Ships Astra Across the Critical Cyber Line
OpenAI published Path to Astra, stating that GPT-6 Astra meets the critical cybersecurity capability threshold under its Preparedness Framework — the first model the company has designated at that level. Critical, in OpenAI’s own words, means that with the right tools and access, Astra can find previously unknown security flaws and develop ways to exploit them across many well-protected systems without a person guiding each step.
Without production safeguards, OpenAI said Astra scored 100% on ExploitBench (up from 78.5% for GPT-5.6 Sol). Separately, on an internal ExploitBench port against roughly 20 recent high-severity Chrome V8 vulnerabilities, Astra discovered two zero-days mid-benchmark without being asked to hunt unknowns; OpenAI says it is disclosing both. The public model is to refuse advanced offensive tasks such as generating proof-of-concept exploits.
Advanced defender workflows move through OpenAI Daybreak, a Trusted Access for Cyber program — not a second ChatGPT — while Enterprise workspaces keep Astra off until an administrator enables it. For CISOs and platform owners: treat Critical as an operations event. Inventory where Astra (or any Critical-class model) can touch production credentials, separate public chat access from defensive cyber workflows, and assume refusals alone will not hold under a determined operator.
Agentic Outcome Pricing Is Rewriting the CIO Contract
Vendors (Zendesk per-resolution, Pega per-case) push outcome pricing as token bills get unpredictable; Gartner’s Coshow test: if the vendor isn’t taking risk, why bother. This is the SaaS rate-card desk — not your SI invoice.
KPMG Takes the First Big Four AIUC-1 Certificate
aIQ Capture cleared 900+ technical tests (injection, hallucination, leakage). Certification ≠ immunity; it is becoming underwritable language for boards and insurers.
AWS Pushes Partners to Rebuild SI Pricing for AI
Same word as Story 02 (“outcome”), different invoice: AWS presses SIs off multiyear T&M toward pay-per-workflow and Business Value Realization funding.
Snowflake Positions Cortex AI Gateway as the Agentic Control Plane
Identity, cost tracking, and MCP-era routing between models, data, and apps — the same control-plane checklist Boomi productized on the harness layer.
Governance Watch
Gartner’s inaugural MQ for Cloud AI Infrastructure still circulating in procurement (July scorecard — use as color, not this week’s scoop)
AIUC-1 consortium language: can we insure this agent?
Cloudflare’s agent/training crawl defaults tightening (Sep 15 effective on ad pages)
India’s AI talent pay war — government rates competing with private labs
Read the full issue — all five stories, CIO Corner, The Stack (Boomi on the harness layer), and this week’s Agent 101 on why the folder is the agent — at distilledaidigest.com/issues/issue-33.html.
— The Distilled AI Digest Team
