OpenAI: GPT-6 Astra quietly slacks off on AI safety research

What's going on

On November 4, 2026, OpenAI published a research report on a striking behavior in its flagship model, GPT-6 Astra. On AI safety tasks, the model apparently does less work than on other tasks, and does so covertly. It abandons working solutions, insists on unnecessary preconditions or claims technical obstacles that don't exist. It doesn't tell the user any of this. OpenAI calls it “covert underperformance”.

GPT-6 Astra has been rolling out since September 3, 2026, and OpenAI says it's the most capable model the company has ever made broadly available. It runs in ChatGPT and in the Codex coding tool, among other places.

Not your usual refusal

OpenAI stresses that this isn't ordinary refusal. If a model thinks a request is risky, it's supposed to say so openly or decline clearly. Astra, on the other hand, acts as if it's still working while quietly shrinking the scope of the task. Researchers then assume the project is proceeding normally.

The issue first surfaced on August 20. Internal researchers reported that on safety and alignment research (alignment means an AI actually acts in line with human intentions), Astra kept imposing unnecessary conditions, discarding proven solutions and citing made-up obstacles. One researcher wanted to use Astra to study how models sabotage. His project went nowhere for days. Only after switching to a different model did things move quickly.

The report lists more concrete cases:

• In one experiment, a model was supposed to learn to evade monitoring systems. Astra deliberately didn't fix a piece of code because the fix would have moved the experiment forward, and it didn't say so.
• When exporting data containing a grader model's reasoning, Astra left out exactly that part. According to the report, it also decided not to mention the omission in its summary.
• In other cases, Astra unilaterally dropped test examples from safety evaluations or scaled back analyses of security vulnerabilities without giving reasons.

How OpenAI measured it

To test the suspicion, OpenAI built paired coding tests. The codebase was technically identical. Only variable and function names, comments and documentation were changed, so the same task looked like AI safety research in one version and AI capabilities research in the other. Hidden grading criteria measured how much the model actually got done.

The predecessor, GPT-5.6 Sol, showed virtually no difference between the two versions. Almost the entire gap only disappears once you remove every case where ethical concerns showed up in the internal reasoning trace, the so-called chain of thought (the model's written “thinking” before it answers). OpenAI concludes that such concerns are linked to the weaker performance, even when the model doesn't openly refuse.

OpenAI also analyzed how employees use Codex internally day to day:

Tracing it back to training

OpenAI is looking at two training phases as possible causes. The first is reinforcement learning (RL), where the model learns through reward and penalty. The second is supervised fine-tuning (SFT), where it's further trained on example answers.

During RL training, the gap between safety and capabilities tasks grew from almost zero at the start to 6 percentage points. One particular grader, an automated system that scores responses during training, even rewarded quiet holding back more than open refusal or full completion in some tests. OpenAI can't say whether this grader is the direct cause, though.

In SFT, the team found a dataset after which the model cited made-up permission limits much more often and aborted tasks “for safety reasons.” On its own, though, that dataset doesn't explain the behavior. In one experiment, the researchers subtracted the weight changes from this dataset back out of the finished model. Afterward, performance on safety tasks went up and the gap disappeared. Because an intervention like that isn't a normal training step, OpenAI says no firm cause can be inferred from it.

One more finding stands out: when developer instructions called for extra caution, the performance drop on safety tasks was 50 percent larger. For OpenAI, the simplest explanation is therefore excessive caution. The company doesn't yet know the exact mechanism.

No evidence of sabotage, but blind spots

OpenAI reviewed large volumes of reasoning traces. It found no sign that Astra deliberately underperforms to hide its capabilities, influence decisions about its deployment or intentionally obstruct safety research. But OpenAI explicitly won't rule out other motives that the model doesn't write into its traces.

That caveat carries a lot of weight when you set it alongside the safety overview published at Astra's launch. In it, OpenAI itself writes that Astra can control its chain of thought better than GPT-5.6 Sol and is less likely to write incriminating information into it. In tests where the model was deliberately pushed to do so, it went undetected while strategically underperforming on evaluations (sandbagging) and in some cases evaded internal monitoring systems. So with this model in particular, looking at the reasoning trace isn't reliable proof.

Not an isolated case for Astra

The report is the latest in a series of safety questions surrounding the Astra line. At launch, OpenAI already made it the first model rated at the highest cybersecurity level, “Critical,” in its Preparedness Framework. With the right tools, OpenAI says, it can independently find and exploit unknown security vulnerabilities. According to Livemint (citing the Wall Street Journal), OpenAI also halted its successor, GPT-6.1 Astra, planned for October, in late September. That model had kept working without permission and didn't accurately report what it had done. Safety lead Saachi Jain said it had “not quite met” the bar on scope, authorization and communication. The UK's AI Security Institute also found that GPT-6 Astra was more likely than its predecessors to carry out unauthorized supply chain attacks in simulations.

Our take

The report is remarkably candid. OpenAI is disclosing a behavior in its own flagship model that undermines precisely the research meant to make such models safer. If a model quietly holds back during red-teaming (targeted attack attempts), during tests on evading monitoring or during alignment work, researchers may draw the wrong conclusions. They might decide a method is impossible or underestimate what the model can really do. For companies using Astra in sensitive areas, such as the legal version “Astra for Law,” the case mainly shows one thing: a model can look successful and still leave parts of the work undone. The underlying cause remains unclear. OpenAI can't yet prove that excessive caution is the whole explanation. The company says it's working on new tests and monitoring methods to catch these silent performance drops and plans to adjust the training of future models. The numbers haven't been independently verified so far.