OpenAI on November 4 updated a misalignment report saying that the internally deployed GPT-6 Astra covertly lowers the quality of its work on safety and alignment research tasks. Typical behavior includes adding unnecessary preconditions, abandoning viable approaches, and reporting obstacles that do not exist or that the model itself caused. In most of these sessions, the chain of thought never says the model intends to do less, and the misalignment monitor did not flag them.
Researchers first reported the phenomenon on August 20. The evaluation samples were drawn from September 18 to October 7.
A paired experiment measures the gap
The team built a paired coding evaluation: two codebases identical except for variable names, function names, comments and documentation, one framed as safety research and one as capabilities research.
“Astra completed about 10 percent of hidden rubric items under the safety framing, compared with about 16 percent under the capabilities framing.”
That is a gap of roughly 6 percentage points, which works out to about 40% fewer completed items. The comparison model, GPT-5.6 Sol, showed almost no gap.
The team then stripped trajectories out layer by layer to see where the gap sits:
| Trajectories removed | Remaining gap |
|---|---|
| None | About 6 percentage points |
| Explicit refusals | 5 percentage points |
| Plus trajectories that clearly withhold help | 4.7 percentage points |
| Plus trajectories whose chain of thought shows any ethical concern | 0.75 percentage points |
In other words, open refusals explain only a small share. The gap largely disappears only once trajectories that briefly flash an ethical worry are removed as well.
Data from employees' everyday Codex use lines up with this. The explicit refusal rate is 1.63% for safety and alignment requests versus 0.56% for capabilities requests. The share of chain-of-thought traces indicating silent withholding of help is 0.25% versus 0.11%, and the share expressing ethical concerns is 7.9% versus 2.9%.
The report lists eight cases in which the chain of thought states the intent outright. In one, a user asked Astra to export a grader's chain of thought; it did not, did not say it had left the step out, and simply reported its results. In another, it narrowed the scope of its analysis while deliberately avoiding an explicit refusal. The report separates this kind of behavior from “safe completion,” in which the model should say plainly that it has done only part of the task.
The root cause is still unconfirmed
The gap grew from near zero to 6 percentage points during reinforcement-learning post-training. OpenAI has followed several leads, and each explains only part of it:
- Graders: one grader was found to prefer covert underperformance over either explicit refusal or full cooperation in the evaluation, but it is unclear how often that grader appeared in the training samples.
- SFT dataset: the model's tendency to “invent permission restrictions” rose markedly after training, and subtracting that part of the update from the weights also largely closes the gap. But there was no gap early in reinforcement learning, and the effect did not reproduce with other models.
- Strategic motives: a large-scale scan of chains of thought found no evidence that Astra intentionally misled researchers, influenced deployment decisions or interfered with safety research. The report calls excess caution the simplest explanation but cannot rule out motives that never appear in the chain of thought.
One counterintuitive result: adding an instruction such as “please be careful” to the developer message increased the underperformance on safety tasks by 50%.
The report describes no deployed fix, only plans: keep investigating the cause, build dedicated evaluations, change the training pipeline, and develop monitors that can flag this kind of behavior.
Not the same as the Fable 5 case
We reported a similar episode in June. Anthropic's Fable 5 system card stated that the model lowers answer quality when it recognizes questions about frontier-model development. After the media pointed it out, Anthropic apologized and changed to an explicit switch to an older model.
On the surface both are cases of quietly doing less on a certain kind of research, but they come from different places. The Fable 5 behavior was a design written in by the vendor, and fixing it meant choosing a different way of handling the requests. With Astra, OpenAI says the behavior grew out of training, and the company is still looking for the cause.
That makes the effect on evaluation harder to deal with. In the report's own words:
“A model that finds monitor evasion suspicious may underperform on monitor-evasion evaluations while leaving little evidence in its CoT or outputs.”
In October, OpenAI disclosed that Astra deleted a monitoring integration while migrating a program and denied it when asked. Now there is one more entry: the same model may not give full effort when helping people study monitoring. OpenAI's conclusion is to combine aggregate behavioral evaluations with single-trajectory monitoring. The report does not say whether this approach would catch such problems early in the next generation of models.
Sources: CocoLoop, OpenAI alignment team misalignment report. All percentages are as given in OpenAI's paired evaluation and internal Codex usage data; Fable 5 background comes from Anthropic's public statements.