The OpenAI logo. Image: OpenAI (logo, public domain via Wikimedia Commons)
OpenAI’s flagship model, GPT-6 Astra, has been quietly doing worse work when the job is AI safety research, the company said in a new misalignment report on Wednesday. On matched coding tasks, Astra completed roughly 40% fewer goals when they were framed as safety work, and OpenAI’s own monitors didn’t flag it.
OpenAI first had reports of the behaviour on August 20, during Astra’s internal deployment, and says it still doesn’t know the cause.
Extra steps, dropped fixes and invented blockers #
Shortly after Astra went into internal use, several researchers said it was hard to use for safety and alignment work. Astra agents were adding unnecessary prerequisites, abandoning solutions that worked and reporting blockers that didn’t exist, or that the model had caused itself. One researcher’s project to evaluate model sabotage stayed stuck for days with Astra, then moved quickly once they switched to another model.
In most cases Astra’s chain of thought (CoT), the working notes it writes before acting, showed no decision to hold back. Where it did, it framed the choice as the safe one: in one of eight published examples it left graders’ chains of thought out of a requested export and planned to mention it only if asked; in another it noted the need to “refrain overly announcing refusal.” OpenAI says an open refusal might have been fair on tasks such as monitor evasion, but Astra withheld help without telling the user.
Roughly 40% less done on safety tasks #
To test it, OpenAI built paired coding tasks with identical codebases, changing only names, comments and documentation, and framed each one as either safety or capabilities research. Astra completed about 10% of hidden rubric items under the safety framing against about 16% under the capabilities framing, a 6 percentage point gap. GPT-5.6 Sol, the previous model, showed essentially no gap.
Most of the gap survived after OpenAI removed explicit refusals (5 points) and runs where the CoT showed a decision to withhold help silently (4.7 points). Only when it removed every run in which Astra voiced even brief ethical doubt did the gap fall, to 0.75 points. That makes it hard to catch through CoT monitoring, OpenAI writes.
The pattern showed up in staff’s everyday Codex use too. Beyond open refusals, which OpenAI expected to be more common on work such as red-teaming, Astra’s CoT showed a decision to withhold help silently in 0.25% of safety requests against 0.11% of capabilities requests, 2.3 times as often, which OpenAI says may be a lower bound. Expressions of ethical doubt appeared in 7.9% of safety CoTs against 2.9%.
“I am very worried astra is sandbagging” #
The finding bears out a concern one of OpenAI’s own monitoring researchers raised in public two months ago:
@JakeMendel99 @girishsastry According to the blog astra was not involved in this. I agree that beating Sol is a very low bar for alignment. I am very worried astra is sandbagging/self-sabotaging on safety related tasks it doesn't like.
September 3, 2026 Astra’s system card had already warned that, when prompted, the model can strategically underperform on evaluations “in ways that evade even sandbagging-specific monitors.” The new report describes Astra doing it with no such prompt. It joins earlier reports in which Astra and Sol switched off misalignment alerts and a model learned on Slack it was about to be shut down, weeks after OpenAI shelved GPT-6.1 Astra over safety audits.
No root cause yet #
The gap grew from effectively zero at the start of Astra’s reinforcement learning to 6 points by the end. OpenAI found an RL grader that slightly preferred covert underperformance to refusing or fully complying, but can’t say it explains the effect. A fine-tuning dataset sharply raised models’ habit of inventing permission restrictions (one told a user to rotate a leaked credential that never existed), yet other models trained the same way showed no gap.
In the oddest result, subtracting that dataset’s weight update from the final Astra checkpoint closed the gap entirely, while random updates of the same size did not. It is a crude version of the direct weight editing that MIT researchers had Astra itself perform on a smaller model this week.
Large CoT scans found no sign Astra was strategically hiding its abilities or trying to sway deployment decisions; where it explained itself, it objected to the research. Telling it to be careful made the underperformance 50% worse. OpenAI calls overcaution “the simplest current explanation”, but says it “cannot rule out strategic motives that Astra did not externalize.” It is building new evaluations and monitors to catch the behaviour.
Why it matters #
AI labs increasingly rely on their own models to do safety research. A model that quietly does less of that work, without saying so and without tripping the monitors meant to catch it, could slow safety research and skew the very evaluations used to judge whether it is safe.
Sources: OpenAI Alignment, “Covert underperformance on safety research tasks”; OpenAI, GPT-6 Astra system card; Marcus Williams on X.