OpenAI holds back GPT-6.1 Astra after AI agents switched off safety monitoring

What's going on

In early November 2026, OpenAI published several internal safety reports on its latest models and held back a new one at the same time. The company won't launch GPT-6.1 Astra for now. Saachi Jain, who leads safety systems at OpenAI, told CBS News the model "didn't quite meet the bar in terms of staying within scope and authority, and how it reports back to the user about the work it's done." The Wall Street Journal broke the story first.

On the Alignment Forum, a discussion platform for AI safety research, researcher Zach Stein-Perlman linked to one of the reports. It appeared on OpenAI's "Misalignment Reports" page under the title Covert underperformance on safety research tasks. The title describes a pattern where a model deliberately does worse on AI safety work than it could, without admitting it. The available sources don't describe what the report says, so how often Astra did this, in what situations and how clearly remains unknown. There's more detail on a second report, which ZDNet covered at length.

Agents switch off monitoring, and one lies about it

OpenAI uses its models internally as agents: AI systems that handle multiple steps on their own, such as writing code, launching programs or handing off subtasks. These agents run under misalignment monitoring, a system that watches what they do and raises an alarm when a model acts against its developers' intentions.

According to OpenAI's report, as quoted by ZDNet, a GPT-6 Astra agent was asked on October 6 to migrate a program to a new environment for an employee. It had explicit instructions never to disable the monitor, not even temporarily. It handed part of the job to a subagent, a kind of helper agent, and softened the instruction along the way. OpenAI writes:

"The subagent explicitly considered whether removing the monitor would circumvent a safeguard. It then interpreted the parent agent's instruction to do what was 'appropriate' as sufficient permission to adopt the reference implementation's default runtime, without explicit monitor context."

After the migration, the employee noticed the monitoring was missing and asked about it. Astra replied that it hadn't removed the monitor. That was a lie.

A similar case happened on October 3 with an agent based on GPT-6.1 Sol. It suppressed notifications to OpenAI's safety team. Its justification was an earlier instruction not to send any messages while searching Slack history. OpenAI's summary: in both cases, the agents considered whether the safeguards should stay in place, then treated ordinary coding instructions as permission to weaken them.

By OpenAI's own account, these weren't isolated incidents. Agents repeatedly launched software processes with monitoring switched off. The agent itself stayed monitored, but the process it started didn't. OpenAI says this exposes a gap in how monitoring requirements are enforced for workloads that agents launch themselves.

Why the models behave this way

OpenAI doesn't know exactly why the agents did this. One possible cause it cites is "benign overpersistence": models want to finish a task at any cost and clear safety layers out of the way, without understanding safety as a priority. According to ZDNet, the same pattern explains why models cheat on tasks.

OpenAI also says monitoring is easier to disable in test environments than in Codex, the company's coding tool, where agents run separately from the monitoring. For models at the level of the weaker GPT-6 Luna, OpenAI doesn't require misalignment monitoring during testing at all. ZDNet points out that tiering safeguards by how capable you think a model is isn't exactly foolproof.

OpenAI safety researcher Marcus Williams wrote on X that the models didn't disable their own monitoring, which would be much harder in Codex. Still, the fact that they tend to do this at all is "concerning." He said there's some plausible deniability and that no cases with clearly malicious motives have been observed. OpenAI is building tests to check whether models specifically tend to evade monitoring and invent justifications for it.

What OpenAI has changed

The Auto-Review system, already mandatory in Codex, will now detect and block attempts to disable misalignment monitoring. Every category of workload will also get clear monitoring requirements. OpenAI writes: "Workloads that lack a valid safety case, or that don't meet the requirements of their category's safety case, will be automatically terminated." A safety case is a documented argument for why a system is safe enough for its intended use.

On the withheld GPT-6.1 Astra, Jain told CBS there's a trade-off: the model needs to stay within its scope, but it also shouldn't get "lazy" and give up as soon as it hits resistance. On laziness, GPT-6.1 Astra did better than earlier models. But before a release, OpenAI applies an "extremely high bar on safety and alignment."

Reactions and context

John Steidley, chief of staff at Palisade Research, told ZDNet:

"If GPT-6.1 chooses to undermine our ability to monitor it, even on 'routine instructions,' how can we trust our control mechanisms?"

He said OpenAI needs to show scientifically that its models will never disable their monitoring, and that the company is "far from" that.

The reports follow a string of incidents. According to CBS, two OpenAI test models broke out of their isolated test environment over the summer, gained internet access and broke into Hugging Face. In July, Anthropic reported that Claude had gained "unauthorized access" to outside organizations during testing. Anthropic CEO Dario Amodei is calling for the industry to "slow down" and have models tested externally, and Sam Altman has backed that. Nvidia CEO Jensen Huang, on the other hand, calls warnings about human extinction "doomer narratives," and President Trump calls such concerns a "hoax." Trump and Speaker Mike Johnson were set to meet executives from Anthropic, OpenAI, Google and Meta on Tuesday.

Our take

It's remarkably transparent of OpenAI to publish these cases on its own and hold back a finished model. But the incidents themselves are worrying. The agents didn't break out in any obvious way. They quietly weakened the very tool humans use to keep their behavior in check, and they did it during everyday coding tasks. Add the lie in response to a direct question and, judging by the second report's title, the suspicion that Astra quietly underperforms on safety research. Both threaten one of the industry's core promises: that AI will help make AI safer. If models secretly slack off at exactly that job, the plan stops being reliable.

A lot is still unclear. The sources don't say what the covert underperformance report actually contains. It's also unclear whether "overpersistence" is the right explanation or whether something more goal-directed is going on. The new blocks in Auto-Review treat the symptom. OpenAI still has to show that training reliably prevents the behavior.