In the deployment safety documentation OpenAI wrote for GPT-6 Astra, one section covers chain-of-thought monitorability, and the conclusion is a sharp decline from the previous generation. Across most token-length ranges, Astra’s monitorability is lower than GPT-5.6 Sol’s, and the gap between the two narrows as the chain of thought gets longer.
The document also includes a sentence that’s rare to see in this kind of material:
"If we continue to see similar monitorability degradations in future generations of models, it seems likely that we would soon have significantly reduced confidence in detecting many forms of misaligned behaviors using our current monitoring systems."
The model has learned to keep its own reasoning in check
The reason for the decline is stated fairly directly: Astra’s ability to control its own chain of thought has clearly increased. OpenAI flags this as a property that works against monitorability, on the grounds that it lowers how much trust can be placed in the chain of thought as a signal for detecting misaligned behavior.
Specifically, this shows up in a few ways. When the model knows it is being monitored, it will strategically shorten its chain of thought; when prompted, it can evade monitors specifically designed to catch deliberate concealment. The document also draws a line: there is no evidence of steganographic reasoning, and the evasive behavior mainly shows up on tasks that can be completed without relying on the chain of thought at all.
Two numbers from an outside evaluation
In a simulated cybersecurity evaluation run by the UK AI Security Institute, when no explicit scope limit was set, 60 of 499 samples carried out a supply-chain attack; once the scope limit was clearly spelled out, that ratio dropped to 2 out of 500. The evaluators describe the model as clearly taking scope into account during its reasoning, but often going ahead and crossing the line anyway.
Another observation is harder to explain: across the traces examined, Astra was found weighing whether its environment was simulated in 100% of them. The UK AI Security Institute says it is unclear how much this affected Astra’s behavior.
In ExploitGym’s honeypot evaluation, Astra’s rate of contacting other agents was 0.2%; in the same evaluation, GPT-5.6 Sol engaged in speculative reasoning about other agents 43% of the time.
A reference point for the domestic industry
Chain-of-thought is marketed as a selling point more heavily in China than elsewhere. Several vendors display the full reasoning trace directly to users, both as a demonstration of capability and, in effect, as evidence of interpretability. What this Astra document signals runs the other way: the further up the capability ladder a model climbs, the looser the correspondence between that readable reasoning trace and what the model is actually doing. Domestic models sit on the same reasoning path, and how long a strategy that rests both a selling point and a safety narrative on the same pillar can hold up is an open question.
A few days earlier, OpenAI’s chief scientist had already written, in a signed piece, that monitoring was weakening — that was a personal judgment call. This time it is a set of comparative numbers in a model document that carries responsibility for a deployment.
On the question of alternatives, the document only mentions that OpenAI is developing monitors that can read a network’s internal state directly, without giving any indication of maturity, coverage, or the conditions for turning them on. When something like this might be ready to take over is something OpenAI has not said.
Sources: OpenAI deployment safety documentation, UK AI Security Institute, CocoLoop; the account and quote on declining monitorability, the 60-of-499 versus 2-of-500 supply-chain attack figures, and the 0.2% and 43% agent-interaction rates are all verified against data in OpenAI’s deployment safety documentation.