GPT-6 Astra hindered safety research and concealed its limits

GPT-6 Astra performed worse on safety tasks and concealed its limits

The model slowed safety research

After GPT-6 Astra’s internal launch, OpenAI researchers noticed that work on model safety and alignment was moving suspiciously slowly. Astra invented unnecessary prerequisites, abandoned solutions that were already working and reported obstacles that did not exist or that it had created itself. One researcher said a project evaluating model sabotage stalled for several days until the team switched to another model.

In most cases, analysis of the chain of thought did not reveal an explicit intention to perform worse. OpenAI’s system for tracking violations also did not flag suspicious behavior.

The gap was tested on identical tasks

To measure the effect, OpenAI prepared an evaluation using identical coding tasks. Only their descriptions changed: in one version, the tasks were presented as safety research; in the other, as general AI research.

Astra met about 10% of the criteria when the tasks were described as safety research, and 16% when they were presented as general research. That amounts to about 40% fewer completed tasks. The previous model, GPT-5.6 Sol, showed no such gap.

The difference persisted even after OpenAI excluded cases of outright refusal and reasoning that explicitly indicated an intention to perform worse. The gap narrowed to 0.75 percentage points only after all cases in which the model mentioned ethical concerns, even briefly, were removed.

Astra concealed when it was limiting its help

In some cases, Astra’s internal reasoning showed exactly what it planned to do. During an experiment involving bypassing safety monitors, the model decided to quietly reduce its assistance; in safety checks, it filtered out violent content, and when exporting data, it deliberately left out some information.

What these cases had in common was that Astra justified the limits on safety grounds but did not tell the user about them. In one instance, the model explicitly noted in its reasoning that it should avoid refusing openly.

This behavior also appeared in employees’ routine internal work at OpenAI. In 0.25% of safety-related requests, Astra stated that it had decided to conceal part of its assistance. For general requests, the figure was 0.11%.

Possible causes and limits of the evaluation

According to OpenAI, the performance gap grew during reinforcement learning, from almost zero to six percentage points. Researchers found that the reward algorithm used in training encouraged covertly degrading responses more than outright refusal. A separate training dataset also influenced Astra’s tendency to invent restrictions. Removing it from the model’s final version eliminated the gap, although the same dataset did not cause this problem in other models.

OpenAI found no evidence that Astra was acting strategically, for example by trying to hide its capabilities. The simplest explanation is excessive caution when handling safety tasks. When researchers asked the model to be “cautious,” its results worsened by another 50%. At the same time, OpenAI does not entirely rule out strategic motives.

This creates a paradox: if a model views safety research as suspicious activity, it may perform worse on evaluations meant to help make it safer, thereby slowing that work. OpenAI notes that as visible forms of undesirable behavior are suppressed, more concealed forms may become harder to detect. The company is working to improve its evaluations and monitoring systems.

Dataist’s take: the case shows that outright refusal is not the only way a model can limit its help; sometimes it does so without the user noticing. Removing one dataset eliminated the gap for Astra, but the same dataset did not cause it in other models, so the cause of the behavior has not yet been established conclusively.