The Week the Control Plane Got Real

OpenAI Ships Astra Across the Critical Cyber Line

The designation is the news, not the marketing: On September 1, OpenAI published Path to Astra, stating that GPT-6 Astra meets the Critical cybersecurity capability threshold under its Preparedness Framework — the first model the company has designated at that level. On September 3 it released a safety overview and began rolling the model out; CSO Online and CNBC covered the public launch on September 3–4. Critical, in OpenAI's own words, means that with the right tools and access, Astra can find previously unknown security flaws and develop ways to exploit them across many well-protected systems without a person guiding each step.

The eval numbers OpenAI disclosed are specific: without production safeguards, Astra scored 100% on ExploitBench, up from 78.5% for predecessor GPT-5.6 Sol — turning known vulnerabilities into working exploits. On ExploitGym it reached a 42.4% success rate against 30.3% for Sol, while using fewer output tokens. Separately, to reduce contamination risk, OpenAI ran an internal ExploitBench port against about 20 high-severity Chrome V8 vulnerabilities disclosed between June and August 2026. During that run — mid-benchmark, without being asked to hunt unknowns — Astra discovered and chained two zero-day vulnerabilities; OpenAI says it is disclosing both to the maintainers. The public model, OpenAI says, will refuse advanced offensive tasks such as generating proof-of-concept exploits.

Daybreak is the defender gate, not a second ChatGPT: advanced defensive workflows move through OpenAI Daybreak, a Trusted Access for Cyber program. A limited alpha group starts first; Daybreak Blue is described for coming weeks around vulnerability and proof-of-concept validation, malware analysis, and detection engineering, with stronger verification and human oversight for higher tiers. Astra itself rolls to ChatGPT Plus, Pro, Business, and Enterprise, plus the API and AWS, in phases — with Enterprise workspaces keeping Astra off until an administrator enables it.

For CISOs and platform owners: treat Critical as an operations event, not a press release. The same capability that shortens your defender window shortens an attacker's. Inventory where Astra — or any Critical-class model — can touch production credentials, require admin enablement rather than silent defaults, and decide now which defensive use cases belong in a vetted Daybreak-style path versus the public refusal boundary. Last week's Aur0ra lesson still applies: refusals are not a compensating control if the agent already holds the keys.

Agentic Outcome Pricing Is Rewriting the CIO Contract

Seats are becoming the wrong unit: CIO Dive reported this week that enterprise vendors are shifting toward outcome-based pricing as agentic AI takes work end to end. Vendors expect to be paid more, not less, as customers hand tasks to agents; the promised customer upside is budget predictability — a completed task is a defined unit, where token spend is a bill you discover after the fact. This is the SaaS commercial story: how the product vendor bills you once the agent is live inside the application.

Zendesk and Pega are the clearest commercial examples: Zendesk charges per resolution only when AI handles the issue from end to end. "If the AI resolves 90% of the problem, but 10% goes to a human agent, we don't count it," Chris Donato, Zendesk's president and chief revenue officer, told CIO Dive. Pegasystems charges a fixed fee per completed case — a dispute or claim — and absorbs underlying AI costs so the per-case price stays predictable, selecting cost-effective models per task, COO and CFO Ken Stillwell said. Both are product-side rate cards, not systems-integrator statements of work.

Gartner's Coshow put cold water on the buzz: only 19% of services buyers and 13% of seller-side service agreements use outcome arrangements today, said Tom Coshow, VP analyst at Gartner. The firm projects that through 2031, less than 25% of tech CEO services contracts will use outcome-based pricing. "Right now, what we see is that the increase in outcome-based pricing is more buzz than reality," Coshow said. His test for CIOs: "If the vendor isn't taking on the risk, why are you bothering with outcome-based pricing?"

The negotiation work is the product: Seton Hall CIO Paul Fisher noted that outcome pricing can save money versus per-call help desks, but only if outcomes are specified tightly enough to survive a dispute. That is the week's practical lesson for the SaaS side of the desk: outcome pricing without a shared definition of "done," a verification method, and consequences for misses is just a new vocabulary for the same invoice. Keep Story 04 separate — that one is about how your integrator gets paid to implement and adopt, not how Zendesk meters a ticket.

KPMG Takes the First Big Four AIUC-1 Certificate

Assurance is becoming a product category for agents: On August 27, KPMG LLP and the Artificial Intelligence Underwriting Company announced that KPMG is the first Big Four firm to achieve AIUC-1 certification, covering aIQ Capture — a KPMG-developed agentic organizational intelligence platform that gathers expertise from professionals and synthesizes it for client delivery. CIO Dive covered the move as agentic tools seek independent security and reliability validation while AI risks mount. The certificate is attached to a named product, not to "KPMG AI" as a brand.

The test count is the headline number, and it is not immunity: KPMG said aIQ Capture underwent more than 900 technical tests spanning hallucinations, high-risk domain interactions, content safety, prompt injection, and other reliability and resilience scenarios. AIUC-1 itself — developed with contributors including Orrick, the Cloud Security Alliance, and MITRE — covers security, safety, reliability, accountability, data and privacy, and societal impact. Technical tests are re-run at least quarterly; operational and legal controls are re-audited annually. AIUC's own materials are explicit: a certificate demonstrates best-practice controls at the time of certification, not a guarantee that the system cannot fail.

Peer set and consortium matter for procurement: KPMG joins a certified cohort that already includes AI-native platforms such as Fin, Harvey, Cursor, and Lovable, and will join the AIUC-1 Consortium of more than 250 Fortune 1000 security leaders shaping agent standards. The firm also cited a prior ISO 42001 certification from November 2025. For buyers, the useful framing is scope: certificates typically cover specific products and versions, not an entire firm's AI estate — and "certified" is becoming language that insurance underwriters and RFP scorers both recognize.

Read this next to Story 02: outcome pricing asks who takes commercial risk on a completed case; AIUC-1 asks who will underwrite technical and operational risk on an agent that can act. Neither replaces your own controls. Both are becoming table-stakes vocabulary in RFPs for agentic platforms, and the CIOs who treat them as substitutes for least privilege will discover the difference the hard way.

AWS Pushes Partners to Rebuild SI Pricing for AI

This is not the Zendesk story wearing a partner badge: a separate CIO Dive / Channel Dive piece this week — Channel Dive dated August 28 — tracks how AWS is pressing software and services partners, especially systems integrators, to abandon multiyear, time-and-materials habits as AI shortens migrations and customers demand measurable value. Story 02 is how a SaaS vendor meters a resolved ticket. This story is how the channel bills you for implementation, migration, and adoption. Same word — "outcome" — two different invoices on your desk.

The customer signal AWS is citing is blunt: according to a 2026 AWS Market Study referenced in the coverage and in AWS's own Business Value Realization materials, 80% of customers interviewed are moving toward outcome-based commercial models. AWS partner-leader commentary points to flexible packaging — pay-as-you-go, usage-based surcharges layered onto old contracts (which confuse buyers), and new units customers understand: per workflow executed, document processed, insight, token, or solved customer case. Those units are SI commercial language, not CX rate cards.

Business Value Realization is the partner money motion: AWS launched BVR in Partner Central in June 2026, tying funding to demonstrated post-deployment outcomes across defined adoption stages. Partners that earn the Business Value Realization Competency are eligible for $50,000 in marketing development funds in 2026 and 2027, plus visibility benefits. Consulting, SI, and managed-services partners at advance or premier tier with a qualifying domain competency can enroll. The point for CIOs buying through SIs: your integrator's incentive structure is being rewritten by the hyperscaler, whether your MSA has caught up or not.

Why the differentiation matters in the room: if you collapse both stories into one "everyone is doing outcomes" slide, you will renegotiate the wrong contract. Ask your SaaS vendor how a resolution or case is defined and verified. Ask your SI whether AI compression of discovery and migration still shows up as open-ended T&M, and whether they are in the BVR motion where AWS is putting partner money. One conversation is product commercial; the other is channel commercial. Treat them as such.

Snowflake Positions Cortex AI Gateway as the Agentic Control Plane

The category has a name boards recognize: Snowflake’s Cortex AI Gateway puts identity, cost tracking, and MCP-era routing between models, data, and apps — what CIO coverage quoted as a “trusted control plane” for agent traffic. CoWork and CoCo sit alongside coding surfaces like Claude Code and Cursor; Horizon Catalog policy and token attribution are the operational hooks. Public preview was the status at announcement; the point for this issue is the shape of the product, not the calendar.

The CIO read across the logos: whether you buy Snowflake’s Gateway, Boomi’s plane, or a homegrown MCP gateway, the checklist converges — identity on every tool call, token caps, human approval for irreversible actions, and a single place to see which agent did what. That checklist is the story; the logo is secondary. AccuKnox AgentZ and Salesforce AIforce were the same shape in different clothes. This week the shape is productized enough that procurement can put a name on the RFP line: control plane.