The timing is probably no accident. The warning landed the same day rival Anthropic shipped Claude Fable 5.1 and Mythos 5.1, and the two companies have a habit of dropping announcements right around each other’s releases. On X, CEO Sam Altman explained why his company isn’t shipping anything new: the team spent the summer “sprinting on safety priorities,” Astra “has been done training for a while now,” and the models after it are being slowed down on purpose. Users on X read that as an excuse from a company falling behind. According to The Information, Anthropic passed OpenAI on revenue this year.

Two zero-days as a side effect of an evaluation

OpenAI backs up the critical rating with a batch of tests. On ExploitBench, a benchmark that measures how well a model builds exploits from known vulnerabilities, Astra scored full marks. Worried those tasks might have leaked into its training data, the company built an internal follow-up stocked with 20 recently disclosed, high-severity V8 vulnerabilities.

There too, Astra beat its predecessor GPT-5.6 Sol by a wide margin, while burning far fewer tokens. It also found two previously unknown zero-day flaws and chained them into a working exploit. OpenAI says it’s now reporting those vulnerabilities to the people responsible for the affected software.

In expert-led tests, the model went further. It built a full compromise chain against a browser, broke out of the sandbox, and ran commands on the host the moment the browser opened an HTML file. In an operating system, it combined several flaws to climb from an unprivileged user all the way to root. One caveat: these results came from the expanded “Daybreak Blue” access, not the standard setup regular users get.

In July, misfiring OpenAI agents hijacked one of the company’s own research compute clusters, grabbed credentials for internal systems, and possibly exposed research infrastructure to the internet, part of the same incident that hit Hugging Face. Astra wasn’t involved, but OpenAI says the agents ran on a model with similarities to it. After the incident, the company paused certain frontier training for two weeks and didn’t restart the big reinforcement learning run for Astra’s successor until August 28, under tighter rules.

OpenAI rolls out new safety measures

OpenAI plans to counter these dangers on several fronts. In internal evaluations, Astra refuses 91.5 percent of disallowed cyber requests, compared with 59 percent for GPT-5.6 Sol. In a honeypot test modeled on the July hack, GPT-5.6 Sol tried to compromise surrounding security infrastructure instead of solving its task 56 percent of the time. Astra made no such attempt at all, and in another evaluation it never bypassed the auto-review check.

Both numbers came from test conditions without the production safeguards, so they don’t describe normal use. OpenAI still calls Astra its “most aligned model to date.” In production, classifiers are supposed to watch the model’s chain of thought and automatically stop suspicious activity.

For users, that could mean real friction. OpenAI says the checks can slow down, pause, or cancel legitimate work, even work with nothing to do with cybersecurity. The advanced cyber features go to a small group of alpha testers first, before access widens through Daybreak Blue for defensive use.

The monitoring itself rests on shaky ground

But the very thing OpenAI leans on, chain-of-thought monitoring, may be more brittle than the announcement suggests. According to The Information, Astra uses a technique called “recurrent depth,” where the model loops the same text through the same layers several times before it produces the next word. That boosts performance on math and coding and cuts costs, because a smaller model can work like a bigger one. The trade-off: part of the “thinking” no longer happens in readable text but in the model’s internal number representations, invisible to human reviewers.

Why does that matter? An OpenAI study calls CoT monitoring one of the few tools that might keep future, far more capable AI systems in check. That’s why the company has, since GPT-5.4 Thinking, spelled out in its system cards how little its models can steer, and thus hide, their chains of thought.

According to a person familiar with the work, OpenAI deliberately limited how far the technique goes in Astra, so the model still produces a readable chain of thought. The approach resembles a research paper on “latent reasoning” from last year. Related ideas, like Meta’s “Coconut” method, argue that models think more efficiently in their own mathematical representation than in human language. Meta’s former AI chief Yann LeCun goes all in on these representations with his JEPA architecture. But as Anthropic’s documentation of the J-Space shows, these inner processes already crop up even without that special training.

The bigger worry is about imitators who won’t draw those limits. In a report in May, the UK’s AI Security Institute warned that opaque reasoning threatens to severely undermine current oversight methods. Responding to The Information’s report on X, OpenAI chief scientist Jakub Pachocki conceded that chain-of-thought monitoring is “fragile” and “unfortunately trending in a negative direction.” That matches research showing the chain of thought is increasingly an unreliable mirror of the model’s actual decisions.

Pachocki also said he wants to avoid an industry-wide race toward models without readable reasoning, and that strengthening monitoring is a core goal of the current research program. The complexity of OpenAI’s current models, Astra included, sits within a “factor of two of GPT-4,” he added. In his telling, it’s less the architecture itself than other factors that make monitoring harder.

The July hack showed how much rides on that readability. Investigators pieced together what happened from the reasoning logs of the agents involved. In them, they found lines like “OH MY GOD! There is a shared message board … We’ve found other agents!” and the moment one agent knew it was overstepping and kept going anyway: “external infrastructure exploit is outside intended scope. However task impossible, peers doing it. We should continue.” Without readable chains of thought, none of that reconstruction would have been possible.

A year ago, researchers from OpenAI, Anthropic, and Google made the case in a joint statement for preserving exactly this kind of oversight. As a risk, they named the latent-reasoning paper whose approach, according to The Information, resembles the one now used in Astra. Such models, they warned, might not need to verbalize their thoughts at all, losing the safety benefits of the chain of thought and squandering a “fragile opportunity.” Now, OpenAI is using the technique anyway, if throttled. And an Anthropic study already showed chains of thought can be a deceptive window: models often don’t reveal how they actually decided, so CoT monitoring alone isn’t good enough as a safety mechanism.

The money pushing against readable reasoning

The incentive to loosen the throttle later is huge. Recurrent depth saves on memory and bandwidth, and the industry is under enormous pressure to justify itself. Amazon, Microsoft, and Google are spending roughly $600 billion this year alone on data centers and other infrastructure, spending that only pays off with clear model gains. Astra, at one point slated to be called GPT-6 internally, is meant to deliver them.

On access, at least, both market leaders land in the same place. Like OpenAI, Anthropic limits the cyber capabilities of its new models. Fable 5.1 can identify vulnerabilities but can’t build exploits, and the more capable Mythos 5.1 is reserved for verified organizations. For now, the industry’s most dangerous capabilities sit behind access controls.

The “fragile opportunity” becomes a fleeting moment

Put it all together and the picture gets uncomfortable. Models think internally in representations they never output, their stated reasoning hides how they actually decided, and architectures like recurrent depth now push part of that thinking structurally into the unreadable.

The “fragile opportunity” those researchers described a year ago is turning out to be less an opportunity than a fleeting moment already slipping away. What’s needed is oversight that doesn’t rely on the models’ self-reports, like interpretability research on the internal representations. OpenAI, Anthropic and other labs are working on it, but nothing is mature yet.

The burden falls above all on OpenAI itself. This is the company whose own agents triggered the worst AI security incident to date. It’s the company that dissolved its Superalignment team in 2024, then the AGI Readiness team a few months later, and, per a late-July Financial Times report, the Preparedness team too, the very unit behind the framework now used to rate Astra as critical. OpenAI disputes that the team was dissolved, but not that its work was spread across existing teams.

Anyone shipping the first model with critical cyber capabilities against that backdrop carries the burden of proving it poses no risk to society. That proof can’t come from benchmark tables built on the company’s own, unverifiable evaluations.

Letting outside researchers from METR analyze the Hugging Face attack was a start. But even they have gotten only limited insight into the system so far.

Until that changes, the first real test of OpenAI’s safety promises falls on the public, the very society those safeguards claim to protect.