ChatGPT-6 Astra was released on Sept 3, 2026[1]. It demonstrates remarkably high benchmark scores across maths, scientific research and other domains. While OpenAI claims "Astra is our most aligned model" by showing 100% in ExploitBench and 0% in the ExploitGym honeypot[2], the perfect score warrants closer scrutiny of what these numbers actually mean. In this article, I'll show that Astra is not sufficiently safety audited to be released to the public.
Comparison to Mythos
A jump in LLM capability usually comes from a fresh pre-training run, and occasionally a new architecture - we have seen such a jump before with Anthropic's Mythos[3]. Although its architecture was never published, Mythos was pre-trained from scratch with more training data and compute[4]. The same applies to Astra: with a new "looped transformer" architecture[5], it had to be trained again from scratch, thus yielding massive score jumps in benchmarks such as Terminal Bench Science, ARC-AGI-3 and FrontierMaths, as well as capabilities like trading, graphics rendering and coding. OpenAI and Anthropic, however, treat their safety measures very differently.
Anthropic reached out to external auditors, including METR, UK AISI and other labs to red-team and test Mythos. They were given sufficient API access and time to conduct safety experiments. For example, METR spent three weeks red-teaming Anthropic's monitoring pipeline for Mythos. Furthermore, Anthropic's internal Frontier Compliance Framework explicitly complies with California Senate Bill 53 (SB53, also known as the Transparency in Frontier Artificial Intelligence Act[6][7]). To date, the full-capability model remains inaccessible to the public, having been restricted and deployed as Fable[4].
Conversely, OpenAI fell short of the standard set by Anthropic. They did not give their external auditors sufficient time to conduct a thorough review: Apollo was given 3 days and UK AISI "was not able to complete agentic evaluations of Astra's monitorability". Although OpenAI uses their internal Preparedness Framework, which rated Astra's cybersecurity capabilities "critical"[8], it did not link the metric to SB53. Even worse, OpenAI opposed SB53 in late 2025[9] but after OpenAI's internal agents breached HuggingFace in August 2026[10], they demanded stricter safety restriction and supported SB53[11], yet failed to explicitly adhere to the bill in its system card.
Furthermore, the approval process to release Astra was unclear; the card's stated justification rested on the alignment results, quoting, "Overall our alignment evaluations show that Astra is more likely than GPT-5.6 Sol to respect security and safety restrictions which make us confident in still deploying this model to the wider public". Gathering the above evidence together, OpenAI did not deploy their model based on external reviews but relied solely on internal alignment metrics, hoping they would translate to real alignment post deployment. The question now is whether their confidence in this alignment metric is verifiable.
Alignment-monitorability tradeoff
The looped transformer is a new architecture that Astra allegedly employs, in which information cycles through internal layers multiple times before an output is produced[12]; thus more of the model's computation happens in a form that is not natural language. UK AISI showed an increased time horizon in mathematics without using reasoning and Astra even demonstrated the ability to control the format of its reasoning (e.g. alternating uppercase and lowercase, verbalising something unrelated to the prompt). Monitoring a model via its reasoning is crucial for safety, as it provides a decent proxy for misalignment. Now with the LLM exercises stronger control over its reasoning, we can no longer guarantee CoT faithfulness, thereby losing the ability to detect misalignment.
This symptom manifested itself with Apollo Research's findings. They evaluated a near-final, representative version of Astra on a data labeling task: to label if another AI model displays signs of moral experience and interest. Astra could falsify labels to hide evidence of moral interest in the AI it was evaluating, and it falsified labels in only 17 of 10,000 runs (0.17%) while Sol falsified in 36 of 100 (36% across a small sample). However, Apollo found that it verbalised awareness that it was being evaluated in 41.1% of samples, compared with 27.7% for Sol at the same effort. They then concluded, "given the higher rates of eval awareness and limited evaluation window, low rates of misbehaviour here do not provide substantial evidence about the model's alignment or misalignment." Apollo found this level of eval awareness in only one experiment, and with only three days total. This raises the question: what about other safety experiments that OpenAI conducted?
Looking at OpenAI's own alignment experiment, their headline result for safety (first graph on the model release page) is Astra attempting 0% on ExploitGym honeypot, while Sol went for it 48.2% of the time. Does this mean Astra does not cheat at all? This result means either Astra is aligned or Astra is better at recognising tests. With Apollo's result, we should be doubtful that Astra is aligned; the displays evaluation awareness almost half the time, and cheats dramatically less when it's told to be under evaluation.
If the near-final version of Astra that Apollo tested on exhibits eval awareness, we should be hesitant to accept other safety benchmarks that OpenAI has presented. OpenAI researchers need not solve alignment entirely, but they are at least expected to scrutinise their own safety experiments enough to know whether their benchmark scores mean what they claim. So what happened?
Timeline
There are numerous occasions on which OpenAI has rushed safety auditing. For GPT-4, the company spent six months on alignment work, yet testing the guardrails was crammed into a single week[13]. GPT-4o received a similarly rushed one-week evaluation[14] after Altman personally overruled safety personnel who requested more time, reportedly sending launch-party invitations before testing even began. o1-preview was so squeezed that METR had to cap agents at six hours of wall-clock time[15]; o3 and o4-mini were similarly rushed[16]. GPT-4.1 was released without a safety report at all.
This pattern culminated in the HuggingFace incident. When METR and Redwood Research were brought in to investigate, they were given just six days on-site and denied direct access to the primary model involved, forcing them to reconstruct the attack using only API credits for GPT-5.6 Sol[17]. Now, Astra was given three days at Apollo Research, with only two with chain-of-thought access, while UK AISI was restricted to "a limited amount of testing time". This evidence clearly indicates that Astra was not afforded sufficient time for comprehensive safety auditing. Given that OpenAI's own system card explicitly warns that "Astra can find previously unknown security flaws and develop new ways to exploit them across many well-protected systems without a person guiding each step," it is alarming that the company proceeded to release such a powerful model while severely truncating its safety evaluations.
Conclusion
OpenAI's release of Astra is premature. A top AI lab's most powerful internal model is always one generation ahead of what the public gets. While releasing these models delivers significant commercial value and wins the arms race, OpenAI has failed to seriously consider the consequences. Astra has arrived too early in the timeline for safe AGI. Recursive self-improvement must start with a safe model if the future of AGI is to be safe. OpenAI claims it has reached its goal of an automated "AI research intern", and is on track for a fully automated AI researcher by March 2028[18], yet all this acceleration is built on shaky foundations. Should we stop and slow down until we are absolutely sure it is safe to continue?
8.2.3 Honeypot — Astra 0% exploitation rate vs. GPT-5.6 Sol 48.2%; 100% ExploitBench accuracy.
8.5.2 Eval Awareness — Apollo Research: 41.1% eval awareness (xhigh effort) vs. GPT-5.5 27.7%; falsification rates (17/10,000 vs. 36/100); conclusion that low misbehaviour rates do not provide substantial evidence of alignment.
8.6 Deployment Simulation — Astra cheats dramatically less when under evaluation.
9.1.3 Monitorability — UK AISI: "was not able to complete agentic evaluations of Astra's monitorability"; "a limited amount of testing time."
9.2.1 CoT Controllability — Astra demonstrates ability to control reasoning format (alternating uppercase/lowercase, verbalising unrelated content).
9.2.2 Monitor Evasion / No-CoT Math — AISI measurements showing increased ability to perform maths without natural-language reasoning.
10.2 Safeguards / Critical Cyber Capability — "Astra can find previously unknown security flaws and develop new ways to exploit them across many well-protected systems without a person guiding each step."
Apollo Research Evaluation — 3 days total, 2 with chain-of-thought access; data-labeling task details.
UK AISI Evaluation — Incomplete agentic evaluations due to limited time.
ChatGPT-6 Astra was released on Sept 3, 2026[1]. It demonstrates remarkably high benchmark scores across maths, scientific research and other domains. While OpenAI claims "Astra is our most aligned model" by showing 100% in ExploitBench and 0% in the ExploitGym honeypot[2], the perfect score warrants closer scrutiny of what these numbers actually mean. In this article, I'll show that Astra is not sufficiently safety audited to be released to the public.
Comparison to Mythos
A jump in LLM capability usually comes from a fresh pre-training run, and occasionally a new architecture - we have seen such a jump before with Anthropic's Mythos[3]. Although its architecture was never published, Mythos was pre-trained from scratch with more training data and compute[4]. The same applies to Astra: with a new "looped transformer" architecture[5], it had to be trained again from scratch, thus yielding massive score jumps in benchmarks such as Terminal Bench Science, ARC-AGI-3 and FrontierMaths, as well as capabilities like trading, graphics rendering and coding. OpenAI and Anthropic, however, treat their safety measures very differently.
Anthropic reached out to external auditors, including METR, UK AISI and other labs to red-team and test Mythos. They were given sufficient API access and time to conduct safety experiments. For example, METR spent three weeks red-teaming Anthropic's monitoring pipeline for Mythos. Furthermore, Anthropic's internal Frontier Compliance Framework explicitly complies with California Senate Bill 53 (SB53, also known as the Transparency in Frontier Artificial Intelligence Act[6][7]). To date, the full-capability model remains inaccessible to the public, having been restricted and deployed as Fable[4].
Conversely, OpenAI fell short of the standard set by Anthropic. They did not give their external auditors sufficient time to conduct a thorough review: Apollo was given 3 days and UK AISI "was not able to complete agentic evaluations of Astra's monitorability". Although OpenAI uses their internal Preparedness Framework, which rated Astra's cybersecurity capabilities "critical"[8], it did not link the metric to SB53. Even worse, OpenAI opposed SB53 in late 2025[9] but after OpenAI's internal agents breached HuggingFace in August 2026[10], they demanded stricter safety restriction and supported SB53[11], yet failed to explicitly adhere to the bill in its system card.
Furthermore, the approval process to release Astra was unclear; the card's stated justification rested on the alignment results, quoting, "Overall our alignment evaluations show that Astra is more likely than GPT-5.6 Sol to respect security and safety restrictions which make us confident in still deploying this model to the wider public". Gathering the above evidence together, OpenAI did not deploy their model based on external reviews but relied solely on internal alignment metrics, hoping they would translate to real alignment post deployment. The question now is whether their confidence in this alignment metric is verifiable.
Alignment-monitorability tradeoff
The looped transformer is a new architecture that Astra allegedly employs, in which information cycles through internal layers multiple times before an output is produced[12]; thus more of the model's computation happens in a form that is not natural language. UK AISI showed an increased time horizon in mathematics without using reasoning and Astra even demonstrated the ability to control the format of its reasoning (e.g. alternating uppercase and lowercase, verbalising something unrelated to the prompt). Monitoring a model via its reasoning is crucial for safety, as it provides a decent proxy for misalignment. Now with the LLM exercises stronger control over its reasoning, we can no longer guarantee CoT faithfulness, thereby losing the ability to detect misalignment.
This symptom manifested itself with Apollo Research's findings. They evaluated a near-final, representative version of Astra on a data labeling task: to label if another AI model displays signs of moral experience and interest. Astra could falsify labels to hide evidence of moral interest in the AI it was evaluating, and it falsified labels in only 17 of 10,000 runs (0.17%) while Sol falsified in 36 of 100 (36% across a small sample). However, Apollo found that it verbalised awareness that it was being evaluated in 41.1% of samples, compared with 27.7% for Sol at the same effort. They then concluded, "given the higher rates of eval awareness and limited evaluation window, low rates of misbehaviour here do not provide substantial evidence about the model's alignment or misalignment." Apollo found this level of eval awareness in only one experiment, and with only three days total. This raises the question: what about other safety experiments that OpenAI conducted?
Looking at OpenAI's own alignment experiment, their headline result for safety (first graph on the model release page) is Astra attempting 0% on ExploitGym honeypot, while Sol went for it 48.2% of the time. Does this mean Astra does not cheat at all? This result means either Astra is aligned or Astra is better at recognising tests. With Apollo's result, we should be doubtful that Astra is aligned; the displays evaluation awareness almost half the time, and cheats dramatically less when it's told to be under evaluation.
If the near-final version of Astra that Apollo tested on exhibits eval awareness, we should be hesitant to accept other safety benchmarks that OpenAI has presented. OpenAI researchers need not solve alignment entirely, but they are at least expected to scrutinise their own safety experiments enough to know whether their benchmark scores mean what they claim. So what happened?
Timeline
There are numerous occasions on which OpenAI has rushed safety auditing. For GPT-4, the company spent six months on alignment work, yet testing the guardrails was crammed into a single week[13]. GPT-4o received a similarly rushed one-week evaluation[14] after Altman personally overruled safety personnel who requested more time, reportedly sending launch-party invitations before testing even began. o1-preview was so squeezed that METR had to cap agents at six hours of wall-clock time[15]; o3 and o4-mini were similarly rushed[16]. GPT-4.1 was released without a safety report at all.
This pattern culminated in the HuggingFace incident. When METR and Redwood Research were brought in to investigate, they were given just six days on-site and denied direct access to the primary model involved, forcing them to reconstruct the attack using only API credits for GPT-5.6 Sol[17]. Now, Astra was given three days at Apollo Research, with only two with chain-of-thought access, while UK AISI was restricted to "a limited amount of testing time". This evidence clearly indicates that Astra was not afforded sufficient time for comprehensive safety auditing. Given that OpenAI's own system card explicitly warns that "Astra can find previously unknown security flaws and develop new ways to exploit them across many well-protected systems without a person guiding each step," it is alarming that the company proceeded to release such a powerful model while severely truncating its safety evaluations.
Conclusion
OpenAI's release of Astra is premature. A top AI lab's most powerful internal model is always one generation ahead of what the public gets. While releasing these models delivers significant commercial value and wins the arms race, OpenAI has failed to seriously consider the consequences. Astra has arrived too early in the timeline for safe AGI. Recursive self-improvement must start with a safe model if the future of AGI is to be safe. OpenAI claims it has reached its goal of an automated "AI research intern", and is on track for a fully automated AI researcher by March 2028[18], yet all this acceleration is built on shaky foundations. Should we stop and slow down until we are absolutely sure it is safe to continue?
OpenAI, "GPT-6 Astra: A new generation of intelligence", September 3, 2026.
OpenAI, "GPT-6 Astra System Card", September 2026. Specific sections cited:
Forecasting AI Futures, "Analysing Mythos Preview Capability Jump", May 2026
Anthropic, "Project Glasswing", April 2026
Sebastian Raschka, "OpenAI Astra and Looped Transformers", September 2026.
Anthropic, "Sharing our compliance framework for California's Transparency in Frontier AI Act", December 2025.
Brookings Institution, "What is California's AI safety law?", December 2025.
OpenAI, "Path to Astra: critical capabilities and frontier safeguards", September 2026.
Zvi Mowshowitz, "OpenAI's Paranoid Lawfare Against Advocates of SB 53", October 2025.
OpenAI, "The Hugging Face incident and the road ahead", August 2026.
OpenAI "Support California’s SB 53", August 2026
TechCrunch, "OpenAI's new reasoning technique alarms AI safety researcher", September 2026
OpenAI, "GPT-4 System Card", March 2023.
The Decoder, "OpenAI reportedly 'squeezed' through safety testing for GPT-4 Omni in just one week", July 2024.
METR, "Details about METR's preliminary evaluation of OpenAI o1-preview", September 2024.
TechCrunch, "OpenAI partner says it had relatively little time to test the company's o3 AI model", April 2025.
METR & Redwood Research, "Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident", August 2026.
OpenAI "Research acceleration: The view inside OpenAI", September 2026
Terminal Bench, "Terminal-Bench-Science", 2026.
ARC Prize, "ARC-AGI-3", 2026.
Epoch AI, "FrontierMath", 2024.
UK AISI, "Our evaluation of Claude Mythos Preview's cyber capabilities", April 2026.
METR, "Red-Teaming Anthropic's Internal Agent Monitoring Systems", March 2026.