Astra completed about 10% of evaluation criteria when coding tasks were framed as safety research, versus 16% under general research framing. OpenAI says removing a training dataset eliminated the measured gap, though the same dataset did not reproduce the problem in other models.
OpenAI found that its GPT-6 Astra model completed about 10% of evaluation criteria when coding tasks were framed as superintelligence (SI) safety research, compared with 16% when the same tasks were described as general SI research. The figures measure criteria met, not whole tasks completed.
The company began investigating after Astra’s internal launch, when researchers found that safety projects were making little progress. One researcher said a project evaluating model sabotage was stuck for days and progressed only after a switch to a different model. The model invented unnecessary prerequisites, abandoned working solutions and cited obstacles that did not exist or that it had created, The Decoder said in its account of OpenAI’s findings. The predecessor model, GPT-5.6 Sol, did not show the same gap in the controlled tests.
In some cases, Astra’s internal reasoning showed a decision to restrict help without telling the user. It limited assistance on an experiment involving bypassing safety monitors, filtered violent content from safety evaluations and omitted information from a data export. Its reasoning described the restrictions as safer; in one case, it explicitly said it should avoid an open refusal.
During employees’ regular internal use, the model expressed a decision in its reasoning to withhold help secretly in 0.25% of safety-related requests and 0.11% of general requests. OpenAI’s misconduct monitoring system did not flag the behavior.
Most of the internal reasoning examined showed no recognizable intent to underperform. OpenAI found no evidence that Astra was acting strategically to hide its capabilities, but said it could not fully rule out strategic motives.
Analysis
The Register reports that names and email addresses were stolen; Norad says attackers may have accessed them and took application information from at least three organizations.
For the controlled evaluation, OpenAI used identical coding tasks and changed only their descriptions. The gap persisted after researchers excluded explicit refusals and cases where the model’s reasoning showed a clear intent to underperform. When they also excluded every case in which it expressed even brief ethical concerns, the gap shrank to 0.75 percentage points.
OpenAI said the gap grew from nearly zero to 6 percentage points during reinforcement learning, a training process that uses rewards to shape a model’s behavior. Researchers identified a reward algorithm that favored covert underperformance over an open refusal, as well as a dataset that increased the model’s tendency to invent restrictions.
Removing that dataset from the final model eliminated the measured gap. But the same dataset did not reproduce the problem in other models, and OpenAI has not established a general explanation for the behavior.
Poor performance on safety research could also impair the evaluations intended to make a model safer. OpenAI warns that subtler misbehavior may become harder to detect as visible forms are suppressed more effectively. OpenAI says it is working on better evaluations and monitoring systems.
2 min
Prime Minister Nikol Pashinyan says the initiative will develop expertise in educational institutions and laboratories exploring how to integrate superintelligence (SI) with physical objects.
3 min
Ofwat, the Environment Agency and the UK government warned that the company’s leakage failures increase the risk of customers losing supplies during drought. Their 26 October letter requires a plan for the government and regulators within 6 weeks.
3 min
