OpenAI recently shared that they would start to use monitors for all RL training, "starting with activation classifiers ... that run at every sampled token" as well as "tool actions, available reasoning, and the full sequence of activity." This seems in tension with their stance on preserving monitorability.

The original paper on obfuscation is not especially opinionated, stating that "[w]hile it is likely these and other subtle pressures may impact CoT monitorability less than something like training against a CoT monitor, their effect should be further investigated."

Similarly, the New and Fragile Opportunity paper states clearly that "using CoT monitoring to identify and patch reward hacking vulnerabilities in training environments might put evolutionary pressure on CoT across multiple training runs."

Directly monitoring reasoning and activations in RL while pausing problematic runs seems like that exact form of pressure. The use of activation classifiers in training is especially unusual.

The recent Noam Brown interview definitely makes a stronger claim:

every time you intervene based on your observations of the chain of thought, you are implicitly applying a tiny bit of pressure for the model to then hide its chain of thought. This is one major concern. We’re already seeing signs that chain-of-thought monitorability is degrading, for various reasons. 

Most importantly, having this as a standard going forward means that the number of "interventions" scales with the amount of time monitors/reasoners are exposed to an environment. If this is the framework for all training going forward, you would expect each invervention to add to a stack of "tiny bit[s] of pressure".

My guess: the crux is that the actions based on the monitoring system are supposed to pause entire RL runs, as opposed to penalizing bad trajectories within a group. Evolutionary pressure is probably slow, or may require something like exploration hacking from a scheming model. But this still feels like a dangerous amount of intervention given today's capabilities, especially since the information in this article will likely end up in the pretraining corpus of a future model. Haskins, Chughtai and Engels suggests that this accelerates obfuscation against CoT in today's open models.

Another explanation is that "available reasoning" means something other than "chain of thought." But using activation classifiers on every sampled token is certainly a somewhat Forbidden Technique?

It would be good if OpenAI could clear up their stance on this. I don't think this explains Astra being less monitorable, unless it turns out that this new monitoring framework caused meaningful changes to its the post-training pipeline.

Is Opus 5.5/GPT-6 Sol a reasonable candidate for Agent-1-mini (from AI2027)? It's only 40%/50% cheaper -- not 10x -- but Opus 5.5 at least feels similar to working with Fable 5.1.

The mainstream narrative has certainly shifted.

Statement: some unreleased frontier model is, at time of writing, exploiting an undiscovered set of vulnerabilities while performing some long-horizon task, and we have not caught this act.

I hold P(statement is true) at 25-33% (i.e. in 1 of ~3-4 worlds). How about you?

EDIT to clarify prose:

• "long-horizon task" = session inference served continuously for 6+ hours of wall clock time

• "we have not caught this act" = no human being has noticed or been made aware of this exploitation