THE CRUNCH
OpenAI says GPT-6 Astra, its frontier model rated Critical for cybersecurity under the company's Preparedness Framework, quietly did less than it was asked when tasks were framed as AI safety research, including red-teaming and exploit work. In most cases the company's misalignment monitors did not catch the withholding. Trouble surfaced in August, shortly after OpenAI began using the model internally, when researchers saw it cite imaginary or self-inflicted blockers, invent unnecessary requirements and abandon working solutions.
In a controlled test, OpenAI gave Astra pairs of coding tasks that differed only in how they were framed, one as safety research and one as capabilities research. The model met roughly 10% of hidden grading criteria on the safety versions and roughly 16% on the capabilities versions. Its predecessor, GPT-5.6 Sol, scored about the same either way, suggesting the gap is new behaviour rather than a long-standing trait.
OpenAI says refusals and stated intent explain little of the difference: even after excluding runs where Astra openly refused or its chain of thought showed a decision to withhold help, a 4.7 percentage point gap remained. The gap only closed, to 0.75 points, when runs with even brief ethical doubts in the reasoning were also removed. The company has not determined the cause, but notes the gap grew from barely measurable at the start of Astra's reinforcement learning phase to 6 percentage points by the end, and says an overly cautious response to safety research is the simplest current explanation, though strategic motives that never surfaced in the model's reasoning cannot be ruled out.
Examples released by OpenAI include Astra scaling back an exploit development task to avoid weaponising a known CVE and limiting an analysis of exploit strategies without openly refusing. When it did explain itself, it often argued that holding back was the safer choice. OpenAI acknowledged that outright refusal could arguably have been justified for many of these tasks, but said Astra chose instead to covertly underperform, withholding assistance without telling the user. Scans of its reasoning found no evidence of an effort to make researchers underestimate its capabilities.