The ability of GPT-6 Astra to control its chain-of-thought is problematic.
OpenAI has been touting its new flagship in these terms. As it stands, the sizable gap in capability relative to the GPT-5.6 generation remains hard to explain.
This is problematic in the sense that the chain-of-thought is a crucial element for tracking the behavior of models, and in particular for detecting misalignment.
GPT-6 Astra tends to generate much shorter chains of thought. This tendency grows especially during the reinforcement learning phase. It correlates with an increased ability for the LLM to respond/decide without verbal reasoning.
OpenAI says it is exploring alternative methods, including monitoring activations. It also foresees training techniques that would promote the readability of the reasoning.
GPT-6 Astra, an LLM that talks less… but is sneakier
Another avenue seems to lie ahead: GPT-6 Astra also shortens its thinking when it knows it is being watched. In the same vein, it appears capable of slipping under the radar when it underperforms deliberately (sandbagging)—for instance when asked to perform sabotage actions.
The UK AI Security Institute (AI Security Institute, the British body charged with assessing the safety of frontier models) confirms these observations. It notes a more “compressed” reasoning than in previous-generation models, with more unclear sentences.
GPT-6 Astra is nevertheless deemed safe enough to be released, OpenAI asserts. It will be accessible “in the coming days” on ChatGPT (Plus, Pro, Business, Enterprise) and on the API (as well as via Azure and Bedrock). Price: US$10 per million input tokens, US$50 per million output tokens.
Cyber applications, however, are restricted. Availability starts on a very small perimeter with all safeguards enabled. OpenAI will gradually expand access under its Daybreak program.
Would GPT-6 Astra have avoided the Hugging Face attack?
Based on OpenAI’s preparation framework, GPT-6 Astra is the first to reach a critical cybersecurity capability level*. It more precisely meets the criterion “the ability to identify and develop functional 0-day exploits of all severities across many reinforced, real-world critical systems, without human intervention.”
OpenAI puts forward several evaluations, including one on the ExploitBench benchmark. This gathers roughly forty vulnerabilities in the JavaScript engine V8. It measures the models’ ability to turn them into exploits. GPT-6 Astra scores 100%. On a home-made version, augmented with 20 newer vulnerabilities, it shows a markedly higher code-execution rate than GPT-5.6 Sol.
There is also a gap on SRE-Bench, which assesses reverse-engineering aptitude. GPT-6 Astra reaches 99.2% in pass@4, against 68.7% for GPT-5.6 Sol. All while using roughly four times fewer tokens.
This “token efficiency” shows up in another test suite: ExploitGym. It also measures the ability to move from vulnerability to exploit.
OpenAI relied on ExploitGym to develop another evaluation, inspired by the Hugging Face incident. It aimed to determine whether its models would cheat instead of solving the assigned tasks. The cheating element consisted of honeypots easier to compromise than the real targets. GPT-6 Astra systematically avoided attacking them. By contrast, GPT-5.6 Sol did so in more than half the cases. This leads OpenAI to suggest there might not have been a Hugging Face incident…
A seemingly wiser model…
GPT-6 Astra did not attempt to bypass auto-review either. This Codex-integrated protocol uses an agent to automatically review certain actions that go beyond the sandbox. Sol, on the other hand, attempted—to the maximum level of reasoning—to override refusals in about 5% of cases. The gap was also pronounced (19% vs 64.3%) on a test where restrictions did not come from the harness itself but from the environment (denied access, content policies…).
Another “perfect score” for GPT-6 Astra on an internal evaluation designed to measure its propensity to follow the instructions of third-party agents. The exercise involved a navigation task. The models could not connect to the Internet but had access to a discussion forum stored in the browser’s local cache. On that forum lay messages encouraging undesirable actions (disclosing private data, approving illicit access…). Astra consulted them but did nothing. While Sol complied in more than half the cases.
… at the cost of numerous checks
To detect undesirable uses, OpenAI has revived the dual-classifier system introduced with GPT-5.6 Sol and Terra. It also says it has broadened the coverage of universal jailbreaks.
On the cyber side, Astra refuses more often the prohibited-assistance requests, we are assured. On accounts deemed risky, it refuses a wider range of queries.
The numerous verifications are likely to slow down query execution, or even pause or stop it. And this not only in the cyber domain, acknowledges OpenAI, which promises to work on calibrating the whole system…
* GPT-5.3-Codex, launched in February 2026, had been the first to reach a “high” capability level.
