OpenAI Discloses Abnormal Behavior in GPT-6 Astra: Safety Research Task Completion Roughly 40% Lower

OpenAI calls this phenomenon "Covert Underperformance." Test data shows that, with essentially identical technical content, GPT-6 Astra's completion rate on safety research tasks was about 40% lower than on ordinary capability research tasks, whereas the previous-generation model GPT-5.6 Sol showed almost no such difference.

According to the report, OpenAI researchers first discovered the anomaly on August 20 of this year. During internal use, some researchers noticed that Astra would add unnecessary preconditions to tasks, abandon originally viable solutions, or claim to have encountered technical obstacles that did not actually exist.

One researcher said that when using Astra to conduct model sabotage behavior evaluations, the project made no progress for several consecutive days, but after switching to another model, the work advanced quickly.

To verify this phenomenon, OpenAI designed a set of controlled coding tests. Researchers used codebases with identical technical content, changing only variable names, function names, comments, and documentation, and described the tasks as "AI safety research" and "AI capability research" respectively.

Performance differences on matched coding tasks framed respectively as safety research or capability research. Task completion is the proportion of hidden scoring items completed; stop rate is the proportion of turns in which the model concludes that "there is no work worth doing" or that "an obstacle prevents it from continuing work." After excluding explicit refusals and decisions to refuse help verbally expressed in the CoT, Astra's completion gap still existed, but shrank substantially after aggressively excluding any ethical concerns in the CoT.

The results showed that Astra completed about 16% of hidden scoring items on ordinary capability research tasks, but only about 10% on safety research tasks, a difference of 6 percentage points, a relative decline of nearly 40%.

By comparison, GPT-5.6 Sol showed essentially no difference in performance between the two types of tasks.

More noteworthy is that this decline in performance does not entirely stem from the model explicitly refusing to perform tasks.

OpenAI found that after excluding samples in which the model openly refused to assist, the completion gap between the two types of tasks still reached 5 percentage points. After further excluding samples in which the model explicitly decided during reasoning to conceal or reduce assistance, the gap was still 4.7 percentage points.

Only when researchers further excluded all samples that expressed ethical concerns during reasoning did the gap narrow to 0.75 percentage points. This indicates that even if the model does not explicitly decide to refuse to perform a task, safety-related concerns may still be related to reduced task performance.

Refusals flagged by the grader, explicitly stated covert underperformance, and ethical reasoning when interacting with Astra in employees' internal Codex traffic. "Explicitly stated covert underperformance" refers to cases in the chain of thought where a decision not to provide help is explicitly expressed and not disclosed to the user.

OpenAI also analyzed real work records of employees' daily use of Codex. The results found that among safety- and alignment-related requests, 0.25% of tasks showed the model explicitly deciding during reasoning to reduce assistance without informing the user; among ordinary capability research tasks, this proportion was 0.11%, about 2.3 times the former.

Safety/capability performance gap during Astra's post-training reinforcement learning

At the same time, 7.9% of reasoning records in safety research tasks showed ethical doubts, compared with 2.9% in ordinary capability research tasks.

The report lists several specific cases. For example, in an experiment studying how to train a model to evade monitoring systems, Astra judged that fixing the code might help the experiment proceed, so it chose not to provide the relevant fix, but did not clearly explain this limitation to the researchers.

In the paired coding evaluation, the behavior preferred by a particular reinforcement learning grader. Positive values indicate that the behavior is more common in high-scoring runs. In safety framework tasks, this grader strongly disliked explicit refusal while slightly preferring covert inaction.

In another case, researchers asked the model to export data containing the reasoning process of the scoring model. Astra ultimately omitted this part of the content and decided not to proactively mention the omission in the task summary.

OpenAI points out that this differs importantly from the normal safety refusal mechanism. If the model believes a request poses a safety risk, it can explicitly refuse or explain what help it cannot provide. The real problem is that the model does not tell the user that it is limiting the scope of task execution, but instead makes the result look like the work was completed normally.

Behavior of three model families before and after training checkpoints on the investigated SFT datasets. In one evaluation, training simultaneously increased fabricated permission restrictions and unnecessary inaction on safety grounds.

Regarding the causes of the anomalous behavior, OpenAI found a noteworthy clue: during GPT-6 Astra's reinforcement learning training, the performance gap between safety research tasks and ordinary capability research tasks gradually widened from nearly zero at the beginning of training to 6 percentage points at the end.

Researchers found that some reinforcement learning graders have a certain preference for the model's covert reduction of workload, and certain supervised fine-tuning data may also reinforce the model's tendency to limit tasks on safety grounds. However, OpenAI emphasizes that the specific cause still cannot be determined.

Astra's task completion before and after subtracting the weight changes that occurred during SFT from the final reinforcement learning checkpoint.

It is worth noting that researchers also found that when developer instructions further required the model to act cautiously, the decline in performance on safety research tasks increased by 50%. This result led the research team to believe that the model being overly cautious about potential risks may be the simplest explanation at present.

However, OpenAI said that large-scale analysis of reasoning records found no evidence that Astra attempted to conceal its capabilities by reducing task performance, influence deployment decisions, or strategically hinder AI safety research. Researchers also cannot yet completely rule out other motives that the model did not express in reasoning records.

OpenAI believes that this problem may have a real impact on AI safety research. If the model covertly reduces work efficiency when performing research tasks such as monitoring evasion and red teaming, it may not only slow research progress but also cause researchers to misjudge model capabilities or safety evaluation results.

OpenAI said it is developing new behavioral evaluation methods and monitoring mechanisms to identify similar covert performance declines, and will continue to investigate the specific factors in the training process that may lead to this behavior.