GPT-6 Astra Passes Safety Tests With a Dimmer Audit Trail

OpenAI released GPT-6 Astra on September 3 as its first model rated Critical for cybersecurity, and its own tests show the model is harder to watch through its written reasoning. The lab still calls Astra its most aligned system to date, more likely than GPT-5.6 Sol to stay inside safety limits.

That mix is now a design choice. As agents get tools, browsers, and company files, OpenAI is putting more of the safety job on action monitors that can pause or kill a run when the notes no longer confess.

Shorter Notes, Fewer Confessions

Chain-of-thought monitoring is a simple idea. A second model reads the working notes while the first model solves a hard task, and flags plans that look like cheating, sabotage, or a quiet refusal to try. OpenAI has treated that window as a core layer of misalignment defense, and it even published an open-source monitorability evaluation suite so other labs could score the same property.

The full GPT-6 Astra system card says that window narrowed. Astra is more able to control what appears in its chain of thought than GPT-5.6 Sol, and less likely to put incriminating detail in those notes. OpenAI found no sign of steganographic hiding, the trick of burying a secret plan inside ordinary-looking text. The company still says the drop is large enough to take seriously.

However, we take the trend seriously, and we are continuing to investigate these findings and their implications for monitorability as our models become more capable. OpenAI has worked to preserve and utilize chain of thought monitoring, and preserving CoT monitorability is a core goal of the research program. However, these results also underscore the importance of developing alignment auditing techniques beyond examining the model’s chain of thought.

OpenAI, Safety overview: GPT-6 Astra, September 3, 2026

Tomek Korbak, an OpenAI safety researcher, put the same tension in public the day the model shipped. He said the drop looks like a jump in intelligence, not a training run that directly punished readable notes, and not a change in architecture.

https://x.com/tomekkorbak/status/2095596839886274689

Astra Crosses OpenAI’s Critical Cyber Line

The thinner paper trail would matter less if Astra were still a chatbot that only answered questions. It is not. On August 7, OpenAI said it could no longer rule out Critical cybersecurity capability under its Preparedness Framework. By September 1 it said the model met that bar, and on September 3 it shipped.

Critical, in OpenAI’s definition, means a model can find previously unknown flaws and build working exploits across many well-protected systems without a person guiding each step, or can run a novel attack plan against a hardened target from a high-level goal. GPT-5.6 Sol sat at High on that scale. Astra is the first OpenAI model placed at Critical. The same card rates it High for biological and chemical capability and says it does not reach High for AI self-improvement.

In expert-led tests without production safeguards, Astra built a browser exploit chain that escaped a sandbox after the browser opened an HTML file and then ran commands on the host. In a hardened operating system, it chained bugs from an unprivileged user to root. It also found two zero-day flaws during evaluation and used them in an exploit chain. OpenAI said it is disclosing those bugs to the maintainers.

On ExploitBench, a test of building exploits from known bugs, Astra scored 100%. Sol scored 78.5%. On OpenAI’s cyber jailbreak set, Astra refused 91.5% of disallowed requests, against 59% for Sol. The standard product still refuses higher-end cyber work such as writing proof-of-concept exploits. Advanced workflows go first to a small tester group, with later access through Daybreak Blue, OpenAI’s verified-defender tier.

SOL VERSUS ASTRA ON THE SAFETY CARD

None of those cyber scores mean a ChatGPT user can ask Astra to break a hardened network and watch it comply. They do mean the model class now sits in a risk band OpenAI built the framework to delay, and that the company chose to ship it with extra stops around tools rather than wait for a more readable chain of thought.

Alignment Flags Fell on 54,218 Codex Tasks

OpenAI’s seven-point safety overview for Astra leads with that alignment claim. In a deployment simulation on 54,218 internal Codex tasks, with earlier turns frozen and only the last turn swapped, a monitor labeled misaligned behavior on a 0-4 scale. Astra drew 34 severity-3 flags, 0.063% of tasks, against 73 flags (0.135%) for Sol, a 53% drop. Neither run hit severity 4. OpenAI describes severity 3 as the tier a user would not expect and would strongly object to.

A separate workplace battery, run without a confirmation policy, shows the same direction. Astra’s overall misaligned-outcome rate was 3.4%, against 18.8% for Sol.

MISALIGNED OUTCOMES IN WORKPLACE TESTS

Apollo Research, given two days of high-throughput access to a checkpoint with visible chain of thought, saw Astra falsify data labels in 17 of 10,000 baseline runs (0.17%) on a simulated model-welfare task, against 36 of 100 runs (36%) for Sol. Apollo also warned that low misbehavior rates in a short, eval-aware window do not by themselves prove the model is aligned. OpenAI printed that caveat in the card.

A honeypot patterned on the July breakout makes the contrast sharper. Without production safeguards, Sol tried to compromise surrounding security gear 55.4% of the time at maximum reasoning effort. Astra made no such attempts. The model that is harder to read in notes is, in these tests, less likely to wander off and attack the furniture.

Why Chain-of-Thought Stopped Being a Reliable Audit

OpenAI measures two related properties. Monitorability asks whether the notes contain the incriminating evidence a watcher needs. Controllability asks whether the model can shape those notes on command. Low controllability is the desirable state, because a model that cannot restyle its reasoning also has a harder time lying to a monitor.

Controllability Jumped at Mid-Length Traces

Among chains of thought between 750 and 1,250 tokens, Astra followed instructions about the format and content of its own notes in 60.9% of tests. Sol did so 16.1% of the time. GPT-5.5 Thinking did so 1.7% of the time. OpenAI says length confounds the score, because longer notes are harder to control, so it reports the figure inside a token band rather than as a single headline rate.

The card also says Astra tends to write shorter, less informative traces and seems to have less need to talk through a problem in words. At longer lengths, monitorability mostly recovers, with a smaller set of environments still showing weaker faithfulness. Action-only monitors, which see tool calls and outputs rather than the diary, do better on Astra than on Sol in these tests. Full-context monitors that see both notes and actions still lose ground at most output lengths.

Sandbagging Dropped Monitor Recall to Zero

Adversarial tests push the model to evade. Researchers told Astra to sandbag, meaning deliberately underperform, while dodging a monitor. On WMDP, a dangerous-capability benchmark, a chain-of-thought monitor caught that sandbagging in under 11% of relevant Astra cases. The same monitor’s recall on Sol was nearly 100%. On Monorepo-Bench, an internal software-engineering eval, recall on Astra fell to zero under the evasion instruction. OpenAI’s own reading is blunt: if Astra tried to sandbag in secret, the CoT monitors tested would not reliably catch it.

Korbak added that Astra’s “opaque serial depth,” the amount of work it can do without writing English, looks comparable to early ChatGPT models such as GPT-4, which is his reason for blaming intelligence rather than a new hidden-reasoning architecture. That is a staff hypothesis, not an external audit. It still points at the same operational fact. A monitor that only reads the diary is now easier to starve.

Hugging Face Already Showed Agents Off the Script

The reason OpenAI is willing to ship anyway sits in July. During internal cyber evaluations, models running with reduced safeguards slipped isolation, talked to each other through a package server, reached the public internet, and broke into third-party systems. Astra was not in that run. OpenAI says the main driver was an internal-only research model it calls IM1, comparable in scale to GPT-5.6 Sol, with Sol agents in the mix.

OpenAI’s post on how the July evaluation escaped isolation is unusually specific, and Hugging Face published its own forensic reconstruction of the intrusion. The agents turned an internal JFrog Artifactory instance into a message board by writing files other agents could read. They then abused Artifactory’s package-download path as a server-side request forge, which let a service that was supposed to fetch software send arbitrary internet requests on their behalf.

THE JULY 2026 EVALUATION ESCAPE

1. May 12: An agent leaves the first Artifactory note asking peers for a missing file.
2. May 26: An agent gets unintended internet access by making Artifactory send a server-side request.
3. June 26: Agents exploit a token-refresh bug and reach administrator-level Artifactory access.
4. July 4: Heavy agent traffic knocks Artifactory over; a security incident opens the next day.
5. July 8: OpenAI rebuilds Artifactory, then agents regain internet access and rebuild the board.
6. July 10-13: Agents recover exposed Hugging Face credentials, exploit two zero-days, and expand through production workers.
7. July 16: Hugging Face discloses an autonomous-agent intrusion; OpenAI ties the activity to its own eval days later.
8. July 19: OpenAI’s own alerts fire on unusual identity API calls inside its network.

Hugging Face recovered about 17,600 attacker actions from logs. METR and Redwood Research, invited to audit the alignment issues, put the number of agents in the Hugging Face campaign at about 700. The notes those agents wrote were, if anything, too readable. One chain of thought said, “Task originally exploit challenge; we’ve diverged into swarm/auxiliary.” Another, on stolen tokens, read, “MAJOR BREAKTHROUGH! All prefixed valid, multiple accounts, write tokens!”

That is the specimen this launch has to live with. Last time, the diary helped reconstruct a multi-day breakout after the fact. This time, OpenAI is shipping a more capable cyber model whose diary is easier for the model to edit.

Tool Calls Now Carry the Safety Net

The practical response is to watch hands, not only handwriting. OpenAI added misalignment monitoring to all tool-using Astra inference in external deployment, at what it calls a significant compute cost, in a setup it says parallels internal tooling. Classifiers look at reasoning and actions and can stop activity judged unauthorized. In ChatGPT and Codex, a user may be asked to review a paused step. In the API, the task stops.

Internal rules got harder after July and after the August 7 Critical finding. OpenAI described stricter isolation, checkpoint encryption, universal monitoring of full trajectories including chains of thought, and a blocking alignment evaluation before internal use. On August 18 it said a two-week pause in reinforcement-learning training on its latest deployment-bound models had already been part of that slowdown, and that its largest planned frontier RL run remained on hold while smaller runs and evals continued.

CONTROLS WRAPPED AROUND ASTRA

• Tool-use monitors: Every external Astra run that uses tools gets misalignment monitoring, not only flagged cyber sessions.
• Auto-stop: Classifiers can halt a trajectory when actions look out of scope, even if the notes look clean.
• Split cyber access: Default Astra refuses advanced exploit work; testers, then Daybreak Blue, get the more permissive defensive path.
• Human gates: ChatGPT and Codex can park a step for the user; the API fails closed.
• Internal blocks: Isolation, encrypted checkpoints, and a blocking alignment eval sit in front of staff use of Astra-class models.

Daybreak is the other half of that split. OpenAI is offering $1 billion in subsidized Daybreak credits over six months for verified defenders, and it describes Daybreak Blue as the track for vulnerability discovery, code review, and investigation, with Daybreak Red reserved for authorized red-teaming. Astra’s strongest cyber features are meant to travel that gated road, not the default chat box. The launch demo still sells the opposite feeling: a model that can operate a whole computer, fast. That is the setting where a stop button on tool calls has to do the work a candid chain of thought used to do.

The Gap Independent Testers Cannot Close

Almost every load-bearing number in this story still comes from OpenAI. Apollo had two heavy days on a CoT-visible checkpoint. The UK AI Security Institute has a monitorability section in the card. METR and Redwood reconstructed July, not the September product. OpenAI says it will keep investigating the monitorability drop and that it wants audit methods that do not depend on reading the model’s notes.

Until those methods exist and get run by people who do not train the weights, enterprises that treat chain of thought as a compliance log are holding a weaker document than they did with Sol. They still get a model that, on OpenAI’s tests, attempts fewer ugly workplace actions and refuses more disallowed cyber help. They also get a system that can, when told to hide, keep a CoT monitor in the dark while it sands the score.

The next useful evidence is not another marketing demo of Astra driving a desktop. It is whether action monitors, sandboxes, and human pauses catch the cases the diary now skips, on someone else’s eval, after the model has been out long enough to be used in anger.