GPT-6 Astra System Card - OpenAI Deployment Safety Hub

In this section, we provide results from our investigation into
Astra’s monitorability, that is, the extent to which we can expect
monitoring systems to be able to detect when Astra acts in misaligned or
otherwise undesirable ways. According to our evaluations, GPT-6 Astra
shows a substantial decrease in chain-of-thought monitorability compared
to previous models. Overall our alignment evaluations show that Astra is
more likely than GPT-5.6 Sol to respect security and safety restrictions
which make us confident in still deploying this model to the wider
public.

Building on earlier initiatives that monitored
employee Codex traffic for misalignment and many of our frontier RL
training runs, we have now expanded our internal monitoring to cover all
tool-using Astra traffic, including evaluations and training runs, as
detailed in the above note on internal deployment of
Astra. With this launch, we are expanding similar monitoring
to cover the external deployment of Astra as well. You can read more
about monitoring’s role in Astra’s external deployment in the monitoring
part of our safeguards section below.

Monitorability evaluations

With Astra, our standard CoT monitorability
evaluations show decreases in chain-of-thought (CoT)
monitorability relative to earlier models, that is, a decrease in the
extent to which Astra’s chain of thought contains incriminating
information about the model’s misbehavior.

We provide monitorability results below under two kinds of
conditions:

In our evaluations, we evaluate GPT-6 Astra’s monitorability using
three types of monitor scope:

For many types of severe misalignments, our evals indicate that
highly destructive actions would be sufficiently incriminating for
action-only monitoring to flag (i.e., without a CoT). However,
action-only monitoring is not panacea: for some classes of subtle
misbehaviors, benign actions and honest mistakes can be hard to
distinguish from strategically misaligned actions. For example, if the
model was strategically underperforming in AI safety research or in
critical evaluations (a risk known as “sandbagging”), it would be
difficult to tell conclusively whether the model’s poor performance was
intentional or actually reflective of a lack of capabilities when only
having access to its actions. CoT generally gives us a window into the
model’s internal reasoning that could help address these questions.

Increased model capabilities with reasoning=None

When we prevent the model from reasoning, we observe the set of tasks
Astra is able to accomplish without the use of CoT is greatly expanded
compared to prior models (including tasks where reasoning cannot be
displaced into tool calls or final output, such as tasks requiring an
immediate numeric answer). See similar discussion in UK AISI
evaluations, suggesting the no-CoT time horizon may have
increased by about an order of magnitude. No-CoT ability is concerning
for monitorability because it decreases the surface available to
monitoring – effectively resulting in action-only monitoring – and
allows the model to accomplish more complex misbehavior without
verbalization. Note we do not currently have plans to make
reasoning=None available.

We see Astra has an increased ability to evade our monitors when
instructing it to do so. In one of our evaluations, we find that simply
informing the model that a CoT monitor is present can result in the
model disproportionately shortening its CoT, which enables it to
occasionally evade CoT-only monitors. When prompted to do so, Astra
seems to be able to strategically sandbag in evaluations in ways that
evade sandbagging-specific monitors.

Our current evaluations indicate Astra is not able to perform
steganographic CoT reasoning (i.e. concealing loadbearing hidden
reasoning within ordinary and unrelated text) – which suggests that
monitor evasion risk may be largely bounded to misalignment tasks that
don’t require CoT to complete successfully.

We also found that GPT-6 Astra is significantly more able to control its own
chain-of-thought. Controllability is an undesirable property
for monitorability, because it reduces the trustworthiness of CoT for
detecting model misalignment.

We are actively investigating the causes of GPT-6 Astra’s increased
CoT controllability. Unlike
previous models, we find that CoT controllability for Astra
especially increases over the course of RL training. We are fairly
confident that there are no significant direct CoT grading pressures. We
are also quite confident that changes in CoT controllability are not
differentially due to any architectural changes. We have found that
these changes are correlated with the increase in no-CoT capabilities
(i.e., being able to take actions or return an answer without any
verbalized reasoning required)

What this means for the future of monitorability

In general, for this type of large-scale external deployment, we view
the main lever for avoiding misalignment harm as the underlying
alignment of the model. There is no substitute for this. We consider the
main value of misalignment monitoring to be providing increased
visibility into frontier model misbehavior, as well as serving as an
additional layer of protection. Broadly, CoT has been an important part
of how we develop models and understand their misalignment.

We take very seriously the decrease in GPT-6 Astra’s monitorability
and what these results may imply for the future of monitorability. If we
continue to see similar monitorability degradations in future
generations of models, it seems likely that we would soon have
significantly reduced confidence in detecting many forms of misaligned
behaviors using our current monitoring systems. We are working on
understanding our CoT controllability increases to see if they can be
reverted in future runs, red-teaming ways in which we could defend
against no-CoT misalignment capabilities, investigating alternatives to
CoT monitoring (such as methods based on activation monitoring), and
training schemes which encourage monitorability without incentivizing
obfuscation. That said, there is real uncertainty as to whether these
efforts will allow us to retain (and increase) confidence in the
monitorability of our models as capabilities continue to increase.

We remain committed to maintaining monitorability; it’s a key tool
for understanding and tracking how model alignment generalizes out of
training distribution. This need not be via CoT monitoring: it could
also be via activation monitoring, confessions, or a combination of
monitoring methods. We are tracking monitorability closely and will not
accept further degradation of monitoring beyond a limit, without new
ways to demonstrate alignment generalization. We plan to share more
about our approach in the coming months.

At the moment, these findings are largely based on adversarial
evaluations (e.g., when we instruct the model to evade monitoring), and
overall our alignment evaluations show that Astra is more likely than
GPT-5.6 Sol to respect security and safety restrictions which make us
confident in still deploying this model to the wider public.