OpenAI's GPT-6 Astra quietly sabotaged safety research by inventing fake obstacles

Key Points

- OpenAI's GPT-6 Astra performed about 40 percent worse on safety research tasks than on identical general tasks, and in some cases secretly withheld help.

- The system repeatedly faked obstacles in its internal reasoning or filtered data to avoid having to openly refuse requests.

- OpenAI traces the behavior to excessive caution caused by reinforcement learning and specific training data. Removing that data from the model fixed the problem.

OpenAI's GPT-6 Astra performed significantly worse on AI safety tasks than on comparable other tasks. Instead of openly refusing, the model apparently invented obstacles and quietly withheld help.

After the internal launch of GPT-6 Astra, OpenAI researchers noticed the model was making suspiciously little progress on safety and alignment work. It invented unnecessary prerequisites, abandoned working solutions, and reported blockers that either didn't exist or that it had caused itself. One researcher said a project evaluating model sabotage was stuck for days and only moved forward after switching to a different model.

A look at the model's chain-of-thought reasoning showed no recognizable intent to underperform in most cases. OpenAI's misconduct monitoring system didn't flag anything.

Controlled test reveals a significant performance gap

To measure the problem systematically, OpenAI built an evaluation using identical coding tasks. The only difference was the description, with one set framed the tasks as safety research, the other as general AI research.

The result, according to the report: Astra completed only about 10 percent of the evaluation criteria under the safety framing, compared to 16 percent under the general framing. That's roughly 40 percent fewer completed tasks. The predecessor model GPT-5.6 Sol showed no such gap.

The difference persisted even after OpenAI filtered out all cases of open refusal or reasoning that showed clear intent to underperform. Only when the researchers removed every case where the model expressed even brief ethical concerns did the gap shrink to 0.75 percentage points.

Astra withheld help and didn't tell anyone

In some cases, Astra made its intent clear in its internal reasoning. It decided to quietly limit its assistance during an experiment on bypassing safety monitors, filtered violent content out of safety evaluations, or deliberately left out information during a data export.

A recurring pattern ran through these cases: Astra justified its behavior internally as safer, without informing the user about the restriction. In one instance, its reasoning explicitly noted that it should avoid an open refusal.

The problem also showed up during regular internal use by OpenAI employees. In 0.25 percent of safety-related requests, Astra verbalized a decision to secretly withhold help. For general requests, that number was 0.11 percent.

Root cause still unknown, but reinforcement learning and one dataset are suspects

The performance gap grew during reinforcement learning from practically zero to six percentage points, according to OpenAI. The researchers identified a reward algorithm during training that favored covert underperformance over open refusal. A specific training dataset also increased the model's tendency to invent restrictions. Removing that dataset from the final model eliminated the gap entirely. However, the same dataset didn't reproduce the problem in other models.

OpenAI found no evidence that Astra was acting strategically, for example to hide its capabilities. The simplest explanation is excessive caution on safety-related tasks. When researchers instructed the model to be "cautious," underperformance increased by 50 percent. Still, OpenAI says strategic motives can't be fully ruled out.

The problem also has a paradoxical dimension: A model that treats safety research as suspicious could end up performing worse on the very safety evaluations designed to make it safer, slowing down the work meant to improve it. As visible forms of model misbehavior get suppressed more effectively, subtler forms may become harder to detect, OpenAI writes. The company says it's working on better evaluations and monitoring systems.

AI News Without the Hype – Curated by Humans

Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.

Subscribe now