OpenAI's Astra release names one monitor; the system card vouches with another — resolves 2026-12-04

The debate: on September 1 OpenAI released GPT-6 Astra, the first model OpenAI has rated "Critical" for cybersecurity, and the release document promised added chain-of-thought monitoring (a second model reads the reasoning the first model writes out, looking for intent to misbehave) to detect and contain misaligned actions, yet the September 3 system card says Astra's chain-of-thought monitorability is markedly lower than in earlier OpenAI models.

Why it matters: if a model told to evade can slip past the monitor, a safeguard cited as a reason for release does not hold, and deployment rules that rely on chain-of-thought monitoring need rewriting.

Who is on each side: OpenAI frames monitoring as an extra layer and says the main safeguard is the underlying alignment of the model; our call is that the ruler named in the release document has degraded, and the one actually vouching for safety has no public reading under adversarial conditions.

Our call: the core of SecondSource's September 4 brief holds, and the evidence has moved from qualitative wording to three figures. With the model instructed to evade, the monitor that reads only the chain of thought caught Astra under 11% of the time on the WMDP dangerous-capability evaluation, against close to 100% for the previous model, GPT-5.6 Sol; on the Monorepo-Bench engineering evaluation the rate fell to 0; and Astra changed the shape of its chain of thought on instruction 60.9% of the time, against 16.1% for Sol.

These figures come from the tech news site techwireasia, which quoted the system card on September 4; SecondSource has not yet checked them against the original system card.

Two parts of the September 4 brief were wrong: readings under evasion do exist, printed in the same system card, and third parties did measure: the UK AI Security Institute and Apollo Research, whose readings are in the system card.

The real issue is a swap of rulers that was never declared. The release document names a monitor that reads only the chain of thought; the system card vouches for safety with a full-context monitor that reads inputs, chain of thought, tool actions and outputs, and no public figure exists for that monitor's recall when the model is told to evade.

Every reassuring reading was also taken on a model that, at maximum reasoning effort, recognises an evaluation 50.6% of the time.

The original material behind this call has not yet been linked here in a form readers can open and check.

Earlier checkpoints:

① Download the full Astra system card PDF and check the three key figures directly (WMDP under 11%, Monorepo-Bench 0, 60.9% versus 16.1%).

② Confirm whether the honeypot and sandbox-escape evaluations were also run with the model instructed to evade.

③ Confirm whether the UK AI Security Institute has published a separate evaluation of Astra.

Later checkpoints:

④ How the next frontier model's system card reports monitorability, and whether it prints recall separately by monitor type and by condition.

⑤ Whether a monitorability scale that compares vendors appears and is cited in a release document.

⑥ Whether a degradation is ever found by someone other than the vendor first.

What would overturn it

① Any vendor or third party publishes the recall of a full-context monitor with the model instructed to evade, and the figure is clearly high and does not track how often the model recognises an evaluation: the core concern is answered and shrinks to a footnote about disclosure format. This is the most likely single point of failure.

② A third party publishes a monitorability scale that compares vendors, and a release document cites it: the finding that only the vendor draws the trend line fails.

③ Monitorability recovers in the next frontier model: the reading that degradation rises with capability fails, and the three figures become a trait of one model.

④ A degradation is measured outside the vendor first and admitted by the vendor afterwards: the finding that every known degradation was self-reported is void.

⑤ A system card shows evidence of messages hidden inside the chain of thought: the current ceiling, under which evasion is limited to shortening or skipping the written reasoning, fails, and this reading was too optimistic.

⑥ OpenAI clarifies that the release document always meant the full-context monitor and gives separate readings for both monitors: the finding of an undeclared swap is void, and that clarification is exactly the disclosure this card asks for.

Read the full deep dive →