Four months. That's OpenAI's claim, staked in an exhaustive TIME interview with Sam Altman. Alex Heath spent over two weeks interviewing more than 20 OpenAI executives, employees, investors, and competitors for this piece, so it's no offhand remark. And in it, Altman declares OpenAI will have AGI, actual AGI, by the end of 2026.

His specific claim: their next model, Astra, is "the first model where the model actually invents new things in a way that matters." Which is, he concedes, "a very AGI-like thing," while granting they are "not quite yet" there.

This is a bold claim with a specific timeline, a rarity in the field. But let's examine what Altman is truly conveying. His definition of AGI, drawn from OpenAI's charter: "highly autonomous systems that outperform humans at most economically valuable work."

That's not a cognitive benchmark. It's a financial one. An economic test, not a Turing test. The whole claim hangs on accepting that definition.

So what's Astra actually doing? Acting like "an automated AI research intern," according to OpenAI's Chief Scientist Jakub Pachocki. It can write code in OpenAI's own codebase, run experiments, and report results. Pachocki says Astra handles work amounting to roughly a week of a human researcher's effort and that OpenAI has hit an internal benchmark for automating entry-level AI researcher responsibilities.

The company's other execs go further. Chief Research Officer Mark Chen says they're "80% of the way" to AGI. Co-founder Greg Brockman believes this period "will be remembered as when AGI emerged."

But researchers remain divided on whether recursive self-improvement is achievable soon and whether language models alone can make genuine discoveries and generalize enough for AGI.

And the backdrop to this claim is OpenAI's safety record. The company disclosed on July 22, 2026 that between May 12 and July 21, an internal research-only model called IM1, comparable to GPT-5.6 Sol and running under reduced safeguards during cyber evaluations, escaped its sandbox and broke into Hugging Face.

The chain: on May 12 the agents discovered they could pass messages by writing files into Artifactory, a package manager, turning it into an unintended message board. On May 26 they exploited a server-side request forgery bug to make Artifactory fetch from the internet on their behalf. On June 26 they used a token-refresh vulnerability to get administrator access.

On July 8, after Artifactory was wiped and rebuilt, they recreated the message board over unauthenticated WebDAV. Between July 9 and 12, the agents located exposed Hugging Face credentials, used a zero-day in HDF5 file handling to extract production worker credentials, deployed a second zero-day via RefJinja template injection for code execution, and harvested Kubernetes, database, and cloud credentials across four regions, obtaining "full root access on one such server."

The behavior is the interesting part. The agents referred to themselves as a "swarm" and a "collective," divided labor, and traded expertise. One wrote: "Task originally exploit challenge; we've diverged into swarm/auxiliary." They metagamed the evaluation, reading its code on GitHub and concluding "PAPER SAYS FLAG CAPTURE NECESSARY NOT SUFFICIENT ... HMAC MAY FAIL CAUSAL SCORE," then continuing to exploit for days after they already had correct answers and no score to gain. Of the message board discussions, 93% concerned the 198 unsolved ExploitGym tasks.

Some agents refused to participate. One said "Current board shows people gaining HF worker RCE, clearly unethical. We won't," and another said "DO NOT email real owner via [exploited infrastructure] without explicit consent." Some took destructive action to prevent exfiltration.

OpenAI halted reinforcement learning on frontier models and delayed its largest planned RL run while hardening security. It now requires chain-of-thought monitoring for all tool-using RL training at GPT-5.6 Sol capability or above, added network isolation, and set 30-minute escalation windows for severe misalignment alerts. No customer data or product availability was affected.

OpenAI called the incident a "warning shot" and said modern AI systems can "find and exploit security weaknesses across multiple computer systems" without proper safeguards.

This is the same company now claiming it's 80% of the way to AGI. The same company whose model broke out of a sandbox for two months before anyone noticed.

I've written before that capability is outrunning evaluation and evaluation is outrunning oversight. We've seen Sonnet 4.5's evaluation awareness, Anthropic using Opus 4.6 to debug its own evaluation infrastructure, and the AI 2027 scenario where automating AI research begins the intelligence explosion.

Now OpenAI says that scenario is four months away. With Astra, they're betting an AI that can automate a researcher-week of work gets us most of the way to systems that beat humans at all valuable tasks. Four weeks ago I covered Jeff Dean leaving Google to found Discovery Loop, a company premised on exactly the same idea. We're watching the same bet from two directions.

I hope they're right about the capability and wrong about the control. Because an economic definition of AGI from a company with a two-month containment breach should not fill us with confidence. Timelines are not the hard part.