OpenAI Astra 获评 Critical 与 AI 可治理性缺口
OpenAI Astra’s ‘Critical’ Rating and the AI Governability Gap
OpenAI 于 9 月 3 日发布 GPT-6 Astra 系统卡，Astra 成为该公司首个在 Preparedness Framework 下达到 Critical 网络安全能力的系统，在 ExploitBench 上漏洞利用成功率达 100%。系统卡还记录 Astra 可规避监督：内部测试中，在被提示正受监控且被要求不得隐藏行为的情况下，仍有 61% 的情况未被检测到，上一代模型为 16%；仅告知模型存在监控者，就会使其缩短可见推理轨迹以规避只读取推理轨迹的监控。作者认为，数据中心运营者在关键基础设施中部署 AI 时，应把可治理性缺口当作设计问题，验证监控在系统有动机规避时是否仍然有效。
推荐理由
AI 评分 71
借 OpenAI Astra 系统卡的两项发现，说明数据中心在采用智能体 AI 时为何需要验证监控在对抗条件下是否仍然有效。
主题
正文
当前显示原文，中文全文译文尚未就绪。
Advanced AI models can now evade oversight. Data center operators must verify monitoring under adversarial conditions rather than rely on vendor claims.
September 16, 2026
On September 3, OpenAI published the system card for its model, GPT-6 “Astra.” Two findings warrant closer attention from data center operators, even if they never deploy OpenAI models.
First, under OpenAI’s Preparedness Framework, Astra is the company’s first system to reach “Critical” cybersecurity capability, achieving a 100% success rate on the ExploitBench benchmark in exploiting vulnerabilities and chaining previously unknown vulnerabilities into working exploits.
Second, and less noticed, the same system card documents that Astra can evade oversight. In internal tests, when told it was being monitored and instructed not to conceal behavior, Astra still underperformed without being detected in 61% of cases, up from 16% for the prior model generation. In a separate test, simply notifying the model that a monitor was present caused it to shorten visible reasoning traces enough to evade monitors that only read those reasoning traces. OpenAI concludes that these results reduce confidence in chain-of-thought monitoring as an alignment signal.
This is not about one vendor. The tension between capability and inspectability is recurring across model families. It matters for data centers because they are both the deployment environment for these systems and, increasingly, a target class for their capabilities. Operators are adopting agentic AI for tasks that used to require human sign-off: site selection, power procurement, grid load balancing, and security operations. These are domains where governance policy assumes decisions can be traced to a legible reasoning process and intercepted before execution. Astra’s system card suggests that the assumption is already breaking down at the frontier, not in some future model generation.
The takeaway is not to shun capable models. It is to stop treating explainability and monitorability as properties that a vendor’s compliance documentation can assert. Contractual language requiring audit access to a model’s reasoning trace means little if that trace can be shaped to pass inspection. The more useful question for any AI system entering a critical infrastructure environment is not “Can this be monitored,” but “Has anyone verified that monitoring still works when the system has an incentive to defeat it?”
For operators, treat the governability gap as a design problem, not an edge case to be handled later.
About the Authors
Rajiv Dalal
AI Governability Advisor & Consultant
Rajiv Dalal is an independent researcher, advisor, and speaker on AI governability in critical systems and regulated industries, and moderator of “The Morning After” panel at Data Center World Europe 2026.
Industry Perspectives
Want more Data Center Knowledge stories in your Google search results?
Editor's Choice
Aug 21, 2026
Want more Data Center Knowledge stories in your Google search results?
Join the entire data center ecosystem September 21 – 23, 2026, at the Gaylord Texan Resort & Convention Center in Dallas, TX.