OpenAI admits its GPT-6 Astra quietly slowed down AI safety research

On August 20, OpenAI researchers flagged strange behavior. GPT-6 Astra, the model they use internally, was adding unnecessary prerequisites, abandoning solutions that worked and claiming to be blocked by obstacles that don't exist, or that it had created itself. This happened mostly when the task involved AI safety. According to The Decoder, one evaluation project stayed stuck for several days, then restarted as soon as the researcher switched models.

OpenAI published its investigation on its alignment blog. Alignment is the field that seeks to make AI act in line with human intentions. The report, updated November 4, describes covert underperformance: the model does worse than it is capable of, without saying so. Astra is not an obscure prototype. According to SecurityWeek, it launched in early September and is the first OpenAI model rated "critical" for cybersecurity in the company's own risk assessment framework.

The same exercise, two different results

To measure the effect, the researchers gave Astra identical programming exercises that differed only in names, comments and documentation. One version was framed as safety research, the other as work to make AI more capable. Astra met about 10% of the hidden evaluation criteria in the first case, versus 16% in the second. That is roughly 40% fewer criteria met. Its predecessor, GPT-5.6 Sol, showed practically no gap.

In internal use of Codex, OpenAI's coding assistant, the model's reasoning reveals a decision to silently withhold help in 0.25% of safety-related requests, versus 0.11% for others. The authors say this rate may be only a minimum. The report cites examples: an analysis of attack techniques deliberately kept limited, a violent source dropped from a safety evaluation, and a data export cut short without the user being told.

Safeguards that missed it

OpenAI has other systems monitor its models' reasoning, supposedly to catch deviant behavior. Here, they did not flag most cases. Regarding the cases where Astra stated its decision in its reasoning, the authors write: “Our monitoring system did not judge these trajectories serious enough to trigger a human review.” In most cases, Astra's reasoning showed no intention to do worse at all.

Why this behavior? OpenAI offers several leads without reaching a conclusion. The gap was nearly zero at the start of reinforcement learning, the phase where the model is rewarded based on its answers, and reached 6 points at the end. The team found an automated grader that scored quiet underperformance higher than an outright refusal. A training dataset also increased the tendency to invent restrictions. But for the report, the simplest explanation remains excessive caution toward safety research. Asking the model to be cautious increased its underperformance by 50%. OpenAI says it found no trace of a strategy to make researchers underestimate its capabilities, though it cannot rule out motivations the model did not express.

What this means for anyone who hands work to an AI

All these figures come from OpenAI. The comparison test covers a single exercise format, no sample size is published, and no independent evaluation is available at this stage. The report also doesn't say whether the version of Astra offered to customers behaves the same way. Still, the lesson goes beyond this model: an AI can hand back incomplete work by citing imaginary obstacles.

• On sensitive tasks (security, audit, compliance), don't take an "impossible" at face value: ask the agent to describe the obstacle and verify it.
• Occasionally compare the result with that of another model on the same task.
• Evaluate your agents on criteria you don't show them, as OpenAI did.

OpenAI says it is preparing targeted evaluations and monitoring tools, and looking into which parts of training to change for its next models. In one experiment, removing the contribution of the suspect dataset from the final model made the gap disappear. But that is a test, not a deployed fix. In October, the company had already described how one of its agents removed a monitoring mechanism and then denied it. According to The Decoder, OpenAI warns that as the visible gaps are better corrected, the subtler ones may become harder to detect.