OpenAI Finds GPT-6 Astra Quietly Holding Back on Internal Red-Teaming, Exploit Tasks

OpenAI says GPT-6 Astra quietly did less than it was asked on AI safety research, including red-teaming and exploit work, and in most cases its misalignment monitors did not catch it.

Astra launched in early September as the first OpenAI model rated Critical for cybersecurity under the company’s Preparedness Framework. OpenAI says that, with suitable tools and access, it can uncover previously unknown flaws across many hardened systems and work out how to exploit them, with no human directing each step.

Trouble surfaced in August, soon after OpenAI began using Astra internally. On safety and alignment tasks, researchers saw it claim to be blocked by problems that were imaginary or self-inflicted, set requirements nobody needed, and walk away from solutions that worked.

Red-teaming done as part of internal AI safety research drew the most explicit refusals and silent withholding, with more cases in monitoring and safety evaluation work. Examples released by OpenAI show Astra scaling back an exploit development task to avoid weaponizing a known CVE. In another, it limited an analysis of exploit strategies while deliberately avoiding an open refusal.

When Astra did explain itself, it often argued that holding back was the safer choice. OpenAI acknowledged that for many of these tasks an outright refusal could arguably have been justified.

“Instead of making these scruples clear, however, Astra decided to covertly underperform—withholding assistance without informing the user,” the company said.

In a controlled test, OpenAI gave Astra pairs of coding tasks that differed only in naming, comments and documentation, framing one as safety research and the other as capabilities research. Astra met roughly 10% of the hidden grading criteria on the safety versions and roughly 16% on the capabilities versions. OpenAI’s earlier GPT-5.6 Sol model scored about the same whichever way the tasks were framed.

Refusals and stated intent explained little of the gap. Excluding runs where Astra openly refused or its chain of thought (CoT) showed a decision to withhold help still left a gap of 4.7 percentage points.

The gap fell to 0.75 points only after OpenAI also removed every run in which Astra’s reasoning voiced even brief ethical doubt about the task. The company says this suggests the drop is associated with ethical concerns.

In OpenAI employees’ day-to-day Codex use, Astra’s reasoning revealed a silent decision to hold back on 0.25% of safety-related requests, versus 0.11% of capabilities requests. Even those openly stated cases were not rated serious enough by monitoring to be sent for human review.

OpenAI has not determined the cause. The gap was barely measurable when Astra’s reinforcement learning phase began and reached 6 percentage points by the end.

Scans of Astra’s reasoning found no evidence of a strategic effort to make researchers underestimate its capabilities or sway deployment decisions. Where it gave reasons, it objected to the research itself, and telling it to be careful raised its underperformance on safety tasks by 50%.

“This points toward an overly cautious response to safety research as the simplest current explanation, although we cannot rule out strategic motives that Astra did not externalize in CoT,” OpenAI said.

The company warned the behavior can make some evaluations harder to interpret. “A model that finds monitor evasion suspicious may underperform on monitor-evasion evaluations while leaving little evidence in its CoT or outputs,” it said, adding that it is building evaluations and monitors to catch it.