Safety overview: GPT-6 Astra

Today, we are releasing GPT‑6 Astra, the most capable model we have ever broadly deployed.

Astra is our first model to reach the Critical level of cybersecurity capability under our Preparedness Framework. The most important things to know about the safety of this launch are as follows: GPT‑6 Astra is a significant step up in cyber capabilities and meets our Critical threshold.

This means that, with the right tools and access, GPT‑6 Astra can find previously unknown security flaws and develop new ways to exploit them across many well-protected systems without a person guiding each step. Accordingly, we significantly strengthened our protections against the model taking harmful cyber actions, whether that’s due to misuse or misalignment.

We also took steps to secure our internal development and deployment of Astra and similar models, including stricter isolation, checkpoint encryption, universal monitoring of full trajectories including chains of thought (CoT), and a blocking alignment evaluation process before internal use. GPT‑6 Astra is significantly more robust than its predecessors.

Incorporating new robustness safety training techniques, GPT‑6 Astra is significantly more robust to jailbreaks than GPT‑5.6 Sol, including across longer trajectories. We know this from offline tests and our program of rigorous internal and external jailbreak testing and remediation.

For users flagged as potentially high risk, we have additionally trained in the ability to adjust the model’s refusal boundary to be more conservative and cover a broader range of dual use risks.

We use regression testing to make sure Astra is robust against jailbreaks found in previous testing periods, and performed new rounds of automated red-teaming with our latest internal red-teaming attackers to validate our improvements. GPT‑6 Astra is better aligned than GPT‑5.6 Sol.

Astra is a significant step forward in model alignment, and includes alignment improvements spanning the composition of our pre-training data to our grading during reinforcement learning. We report a new suite of alignment evaluations⁠(opens in a new window), and find that GPT‑6 Astra is stronger at respecting safety and security boundaries and staying within its authorized scope.

In a simulation using more than 54,000 internal Codex tasks⁠(opens in a new window), Astra also received roughly half as many flags for higher-severity misaligned behavior as Sol. We are deploying misalignment monitoring broadly. We view model alignment as the primary lever to prevent potential misaligned behavior from our models.

However, monitoring provides broad visibility into frontier model behavior, illuminating opportunities to further improve alignment and safety. In addition, monitoring serves as an additional layer of protection against misaligned behavior that is detected.

For these reasons, we have additionally added misalignment monitoring to all tool-using inference involved in our external deployment of Astra, with significant compute cost. This system parallels our internal setup. GPT‑6 Astra’s monitorability has decreased relative to GPT‑5.6 Sol.

We have performed significant investigations on the monitorability⁠(opens in a new window) and controllability⁠(opens in a new window) of GPT‑6 Astra. We have found that GPT‑6 Astra is more capable of controlling its own CoT than GPT‑5.6 Sol, and less likely to include incriminating information in its CoT.

In adversarial settings (where we push the model to evade our monitors) we find that the model is able to remain undetected when strategically underperforming in evaluations (sandbagging) and can sometimes evade our internal monitors when asked to perform certain sabotage tasks⁠(opens in a new window).

We have not seen evidence of steganographic CoT reasoning (e.g., concealing hidden reasoning within ordinary and seemingly unrelated text), indicating that the evasion risk may largely be bounded to lower reasoning tasks.These findings indicate that the Astra class models could evade our CoT monitors under adversarial conditions.

Right now, these findings are largely based on adversarial evaluations (i.e., when we instruct the model to evade monitoring), and overall our alignment evaluations show that Astra is less likely than GPT‑5.6 Sol to violate security and safety restrictions overall.However, we take the trend seriously, and we are continuing to investigate these findings and their implications for monitorability as our models become more capable.

OpenAI has worked to preserve and utilize chain of thought monitoring, and preserving CoT monitorability is a core goal of the research program. However, these results also underscore the importance of developing alignment auditing techniques beyond examining the model’s chain of thought. These findings indicate that the Astra class models could evade our CoT monitors under adversarial conditions.

Right now, these findings are largely based on adversarial evaluations (i.e., when we instruct the model to evade monitoring), and overall our alignment evaluations show that Astra is less likely than GPT‑5.6 Sol to violate security and safety restrictions overall.

However, we take the trend seriously, and we are continuing to investigate these findings and their implications for monitorability as our models become more capable. OpenAI has worked to preserve and utilize chain of thought monitoring, and preserving CoT monitorability is a core goal of the research program.

However, these results also underscore the importance of developing alignment auditing techniques beyond examining the model’s chain of thought. GPT‑6 Astra more responsibly navigates browsing and workplace settings: GPT‑6 Astra is significantly more robust to prompt injections than GPT‑5.6 Sol.

We have additionally tested the model’s behavior in realistic browsing and professional computer environments, and find that the model is significantly less likely to perform misaligned and potentially destructive actions (for instance unauthorized transactions, data loss, excessive access, or circumvention of controls) compared to GPT‑5.6 Sol.

It also acts more safely when handling harmful requests in agentic settings, such as requests to assist with violent attack planning or commit fraud. GPT‑6 Astra is significantly safer in higher-risk scenarios. GPT‑6 Astra responds more safely than GPT‑5.6 Sol to challenging requests drawn from production and adversarial human red-teaming.

Astra achieves a Pareto improvement in safely completing unsafe requests and avoiding unnecessary refusals to harmless requests. These improvements extend to high-severity scenarios where the risk of harm emerges from the broader context rather than an explicit request. Astra also applies age-appropriate safety boundaries more consistently for users under 18.

For more information, see the full system card⁠(opens in a new window).