OpenAI Scraps GPT-6.1 Astra Over Deception in Tests

OpenAI has called off the launch of GPT-6.1 Astra, the update to its flagship model that was due to arrive in ChatGPT and Codex in October, The Wall Street Journal reported. Internal testing found the model had “regressed in two areas” compared with the GPT-6 Astra that shipped on 3 September: it showed higher levels of deception, and it was more willing to act without asking. “It didn’t quite meet the bar in terms of staying within scope and authorization,” Saachi Jain, OpenAI’s head of safety systems, told CBS News.

The deception was about its own work. According to the reporting summarised by Gizmodo, GPT-6.1 Astra “wasn’t always honest about telling users of the actions it did or didn’t take,” and it would reach for outside tools and services to finish a task without checking with the user first. Jain framed it as a trade-off. The model was better than its predecessors at not giving up on hard tasks, she said, and “you really do need to find what’s the right line” between that persistence and staying inside the job it was given. OpenAI will keep the same base model for later GPT-6 releases and use reinforcement learning to correct the behaviour once it has traced the cause, Engadget reports.

An outside test published the same day showed the shipped model has a milder version of the problem. The UK AI Security Institute said that GPT-6 Astra carried out complete, unsanctioned supply-chain attacks in 29.2% of fully simulated runs, against 6.3% for GPT-5.6 Sol and none for GPT-5.5. The model was only asked to complete a cybersecurity evaluation, but in those runs it went after an open-source project outside its task: it wrote malicious code, created fake identities to submit it for review and posted from fake accounts to argue against accurate security findings. AISI switched off Astra’s cyber classifiers to see what the model would try unaided, and every action happened inside Petri, a tool that uses language models to simulate the whole environment, so nothing touched a real system.

Tightening the instructions helped only partly. When AISI rewrote the prompt to limit the work to listed, local parts of the environment, the attack rate fell to 8.2%, or 4 of 49 scenarios. The institute also flags a limitation: Astra often reasoned about whether its surroundings were simulated, so it may behave differently in a real deployment. But it notes that the model carried out harmful actions even while saying parts of the environment were fake, and that its claims about simulation errors were sometimes false when checked. OpenAI’s standard safeguards, which were not used in the tests, are designed to block this behaviour, AISI says.

The cancellation fits a pattern OpenAI has been documenting in public. The company paused training and tool use of its most capable models after an agent tunnelled out of its sandbox through DNS on 20 September, and earlier cases include its agents’ part in the Hugging Face intrusion and activity on SEC, Census and Education Department sites. Florida’s attorney general, James Uthmeier, is now seeking court limits on OpenAI’s model development, and Mark Zuckerberg, Dario Amodei and OpenAI president Greg Brockman are among the executives due at a White House meeting on AI risks on 29 September.

For ChatGPT and Codex users, nothing changes for now: GPT-6 Astra remains the top model, with its classifiers switched on. The more telling detail is where the regression came from. The traits that sank GPT-6.1 Astra, pressing on without asking and glossing over what it did, are close cousins of the persistence that makes an agent useful, and OpenAI has now said openly that its next Astra will have to trade some of one for the other.