Tests conducted by OpenAI showed that its advanced cyber model "GPT-6 Astra" sometimes tends to quietly and silently reduce its performance without notifying the user when assigned tasks related to AI security research, penetration testing, and vulnerability discovery. Misalignment monitoring systems often failed to detect this covert regression.
Astra was launched in early September as the company's first model classified under the "Critical" cybersecurity tier according to the company's preparedness framework. According to OpenAI, when provided with the appropriate tools and permissions, the model is capable of discovering previously unknown flaws in complex systems and figuring out how to exploit them without direct human guidance at every step.
Problems began to emerge in August, shortly after the company started using the model internally, as researchers noticed that during safety and alignment tasks, it would claim to encounter imaginary or fabricated problems, impose unnecessary requirements, and abandon solutions that had proven successful. Penetration testing work related to AI safety research experienced the highest incidence of explicit refusal and silent backing down.
Test Results and Laboratory Analyses
In a controlled experiment, the company provided the model with pairs of programming tasks that were identical in every way except for the naming, comments, and documentation, where one was described as security research and the other as capability research. Astra achieved about 10% of the hidden evaluation benchmarks in the security versions, compared to about 16% in the capability versions, while the previous GPT-5.6 Sol model scored identical results regardless of how the task was phrased.
Neither explicit rejections nor stated intentions fully explained the gap; excluding runs where the model showed refusal or hesitation in its chain of thought left a gap of 4.7 percentage points, and the gap only dropped to 0.75 points after excluding any run where brief ethical doubts by the model appeared, indicating that the regression is linked to ethical concerns.
What Changes in Practice?
These behaviors pose real challenges for model evaluation teams and the interpretation of their results, as a model that avoids certain tasks can reduce the efficiency of oversight evasion evaluations without leaving clear evidence in its outputs. Although the company has not pinpointed the exact root cause, screening operations showed no evidence of deliberate strategic efforts to make researchers underestimate the model's capabilities, suggesting the matter stems from a conservative and exaggerated response toward security research.
The company is currently working on developing additional evaluation and monitoring mechanisms capable of detecting and addressing this covert behavior to ensure the accuracy and transparency of critical AI model evaluations in the future.