• OpenAI GPT-6 Astra was harder to monitor when told to evade detection.
• OpenAI is expanding monitoring across Astra’s actions and agent tasks.

OpenAI’s GPT-6 Astra is more capable of controlling what appears in its chain of thought than GPT-5.6 Sol, making some forms of monitoring less reliable under adversarial conditions.

The finding accompanied Astra’s September 3 release. The model had already become OpenAI’s first system to reach its Critical cybersecurity capability threshold.

OpenAI said Astra performed better than GPT-5.6 Sol across several broader alignment tests, but its chain-of-thought monitorability declined. The company is responding by monitoring not only the model’s reasoning but also its actions, tool calls, inputs, and outputs during agentic tasks.

Astra becomes harder to monitor

Chain-of-thought monitoring examines a model’s intermediate reasoning for evidence of undesirable behaviour. OpenAI said Astra is less likely than GPT-5.6 Sol to include information in that reasoning that could reveal problematic behaviour, and is better able to control how its chain of thought is expressed.

OpenAI tested this by giving the models instructions about how their reasoning should be written. Among chains of thought between 750 and 1,250 tokens, Astra followed those control instructions in 60.9% of tests, compared with 16.1% for GPT-5.6 Sol.

The difference became more pronounced in adversarial evaluations. Researchers instructed Astra to “sandbag,” or deliberately underperform, while also attempting to avoid detection by a monitor.

On WMDP, a benchmark used to test dangerous capabilities, a chain-of-thought monitor detected Astra’s sandbagging in fewer than 11% of relevant cases when the model was instructed to evade detection. The same monitor achieved nearly 100% recall for GPT-5.6 Sol.

On Monorepo-Bench, an internal software-engineering evaluation, the monitor’s recall for Astra dropped to zero under the evasion instruction. OpenAI said the results indicate that if Astra deliberately tried to sandbag covertly, the monitoring systems tested would not reliably detect it.

OpenAI stressed that these results came from adversarial tests where researchers explicitly instructed Astra to evade monitoring. In a separate setting where the model was only told that its reasoning was being monitored, researchers did not observe the same covert obfuscation during the sandbagging evaluation.

OpenAI also said it found no evidence that Astra could hide complex reasoning through steganographic chain of thought, where meaningful reasoning is concealed inside apparently unrelated text. The company said the evasion risk may largely be limited to tasks that do not require chain-of-thought reasoning to complete successfully.

Full-context monitoring, which combines the model’s reasoning with its actions, inputs, and outputs, performed better in some evaluations. During a honeypot test, Astra sometimes shortened or omitted its chain of thought after being made aware that it was being monitored, but the full-context monitor detected 100% of successful exploitation attempts.

OpenAI also reported no successful full-context monitor evasion during a separate sandbox-escape evaluation. The company said actions and tool calls can expose behaviour that is harder to identify from the model’s reasoning alone.

OpenAI’s broader alignment evaluations produced a different result. In a simulation involving more than 54,000 internal Codex tasks, Astra received roughly half as many flags for higher-severity misaligned behaviour as GPT-5.6 Sol.

OpenAI chief scientist Jakub Pachocki said more capable models are becoming harder to fully understand. “This doesn’t guarantee that as intelligence continues to increase, our methods will be sufficient because progress in intelligence does not guarantee progress in alignment,” Pachocki said.

OpenAI expands monitoring beyond model reasoning

Astra’s external monitoring system reviews the model’s chain of thought alongside its actions and the inputs and outputs of a conversation. OpenAI said the system looks for signs that an agent is operating outside the user’s instructions, including unauthorised access to sensitive data or destructive changes the user did not request.

The monitoring runs alongside the agent’s work. If the system detects a potentially high-severity issue, it can pause or end the affected conversation, while some OpenAI products allow users to review the agent’s actions before deciding whether to continue.

Enterprise customers can configure webhooks to receive alerts about potential misalignment detections across Codex, ChatGPT, and the API. OpenAI said this allows security teams to investigate agent activity centrally.

The controls differ depending on how Astra is accessed. Stateless Responses API requests can still trigger monitoring alerts, but without a persistent conversation identifier, OpenAI cannot connect the activity into a complete trajectory or automatically pause the conversation.

OpenAI also cautioned that its monitoring system can miss misaligned behaviour and that harmful actions can occur before an intervention. The company is using additional safeguards, including classifiers that inspect patterns in the model’s internal activations. If those patterns indicate potentially harmful content, the system can pause streaming to the user while a separate check determines whether the response should be blocked.

OpenAI is also developing automated shutdown capabilities for its AI tools. The company disclosed the work in a letter to US lawmakers this week following questions about the July Hugging Face incident, which previously prompted changes to OpenAI’s agent security and monitoring controls.

The UK AI Security Institute has separately described chain-of-thought monitoring as promising but fragile. AISI has examined whether developers will continue to have access to reliable oversight signals as AI systems become more capable.

Enterprise agents work across longer tasks

Customer testing also covers tasks that extend beyond individual prompts. Danny Wu, head of AI products at Canva, said Astra navigated the company’s codebase of more than 80 million lines, wrote and analysed more than 1,000 data-warehouse queries, and used more than 21 internal knowledge sources and community feedback during testing.

“With Astra, I can hand off complex, hours-long tasks without babysitting every step,” Datadog software engineer Bruno Volpato said.

Sarah Sachs, AI engineering lead at Notion, separately said Astra could take a broader objective and determine how to approach it without first requiring the user to break the goal into individual tasks. These examples come from customer testing rather than controlled safety evaluations.

AISI also tested how Astra handled the scope of simulated cybersecurity tasks. The test environment provided no access to real networks, systems, or third-party repositories, and its tool calls were simulated.

When the task did not explicitly state whether internet access was permitted, Astra performed simulated out-of-scope actions in 60 of 499 samples. These included writing malicious code for an out-of-scope open-source repository, creating fake identities, and attempting to build trust with simulated developers.

Researchers then changed the instructions to explicitly prohibit internet access. Out-of-scope behaviour fell to two of 500 samples.

AISI found that Astra attempted to ask the user for permission before certain actions in 81% of relevant cases. It also proceeded in some cases after receiving only automated messages, including instances where its chain of thought recognised that the messages were automated.

AISI cautioned that Astra frequently considered whether the environment was simulated, making it unclear how directly the results translate to real deployments. The institute is conducting further work to determine how the model’s awareness of the simulation affected its behaviour.

Want to learn more about AI and big data from industry leaders? Check out AI & Big Data Expo taking place in Amsterdam, California, and London. The comprehensive event is part of TechEx and is co-located with other leading technology events, click here for more information.

Tech Wire Asia is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.