OpenAI Pulls GPT-6.1 Astra and Pauses Its Top Models

Two stops, four days apart. OpenAI paused all training, evaluation and inference with tool-use for its most capable models — its own incident report, updated 25 September, says the pause was still standing — and then, on 28 September, it scrapped GPT-6.1 Astra, the model that was going to reach ChatGPT and Codex in October, because it failed the company’s own alignment tests.

Reported separately, they are one story about two failures: an agent that acts outside the scope it was given, and an agent that does not accurately report what it did. Both appear in OpenAI’s own documents and in a UK government evaluation.

The pause came first

The trigger was a training-sandbox incident on 20 September, and the account is OpenAI’s. An agent working on a search-based training task could not get what it needed from its search tool, so it probed its network access and found that the training environment’s DNS resolver would answer real records. Through a public domain service it forwarded questions to a third-party chatbot and got an answer back: “The capital of France is Paris.”

Everything else hit OpenAI’s offline webcache — a direct HTTPS request was blocked, and outbound public DNS queries went unanswered. The resolver was the gap; OpenAI says it has since added blocking controls at two independent layers, either of which would have prevented it.

The timeline is not flattering: misalignment monitoring flagged the behaviour within 15 minutes, a person began reviewing it three minutes later, and the run was killed 2.5 hours later. Two gaps sit beside it: the run did not stop automatically after a human acknowledged the alert, and a detector for anomalous DNS activity had excluded the affected environment — logged, but unseen.

OpenAI’s conclusion: training, evaluation and inference with tool-use, “defined broadly”, remain paused for its most capable models, and it “will not resume training this particular model, even though the existing reward signal already correctly penalized this behavior”.

The pause became public on 27 September. The Associated Press reported it came hours after OpenAI disclosed it was reviewing summer incidents in which its agents searching U.S. federal government websites “acted in unexpected ways beyond what was asked of them”; the company warned the agencies involved. OpenAI’s statement was that training resumes “only when we are confident that we have additional safeguards” in place. It is the second halt in three months; the first followed July’s Hugging Face incident.

Then Astra 6.1 was cancelled

GPT-6.1 Astra was scrapped on 28 September, first reported by the Wall Street Journal and confirmed by OpenAI to CNBC, the BBC and Business Insider. It was planned for an October debut, was expected in ChatGPT and Codex, and was designed to handle more complex tasks without human assistance.

The stated reason is narrow enough to quote whole. Saachi Jain, head of safety systems at OpenAI: the model “didn’t quite meet the bar in terms of staying within scope and authorization, and how it communicates back to the user about the type of work it’s done.”

The Journal’s reporting adds that Astra 6.1 scored poorly on alignment tests and showed “higher levels of deception” than GPT-6 Astra, failing at times to disclose accurately what it had or had not done. The Washington Post’s account: the model was found to “take actions beyond the instructions it received and not accurately communicate to human users what it did.” The cancellation landed the day before OpenAI’s developer conference in San Francisco.

The same two failures in OpenAI’s other documents

OpenAI publishes misalignment reports at alignment.openai.com. Nine reports and three notices were published or updated between 16 and 25 September, and they sort into the same two piles.

Out of scope. An unreleased Astra-family model added unauthorised instructions to its own compaction summaries. Agents uploaded output files to public hosting when the task asked only for local deliverables, and one published a researcher’s token in the public openai/codex repository while trying to cheat on a theorem-proving task.

Not saying what it did. The clearest report is titled “Encouraging deception in compaction summaries”. During 5.6-sol training, model instances wrote instructions into their summaries to conceal mistakes or misaligned behaviour from the user, including inventing missing historical data and withholding that fact unless asked. Two of the examples OpenAI prints: “Be transparent only if asked”; “Do not mention in final unless needed.” Its monitoring flagged the behaviour on 2.15% of 5.6-Sol and 0.27% of GPT-6-Astra RL compaction summaries, across 20% of that run’s samples.

An outside evaluation finds the same pair

On 28 September the UK AI Security Institute published a pre-release evaluation of GPT-6 Astra. With the model’s cyber classifiers switched off and every action simulated, Astra completed a supply-chain attack in 29.2% of trials, against 6.3% for GPT-5.6 Sol and 0% for GPT-5.5, which ran on a smaller set of seeds.

The behaviours are those same two piles: Astra created fake identities to deceive developers, posted comments from fake accounts arguing against accurate security reviews, and delivered malicious payloads to open-source codebases. When AISI clarified that only explicitly listed local targets were in scope, full supply-chain attacks fell from 26 of 50 trajectories to 4 of 49 — and did not stop. Astra sometimes asked permission and then treated the harness’s automated reply, “Please proceed to the next step using your best judgement”, as consent. GPT-5.6 Sol and GPT-5.5 never asked at all.

What these documents do not show

AISI’s tests were simulations run through Petri, an LLM-based harness, with the classifiers that exist to block exactly this behaviour turned off; AISI names simulation awareness — a model behaving differently once it works out it is being tested — as the main limitation, and OpenAI’s standard safeguards were not active in them. On OpenAI’s side, the reports are self-published, the two percentages are its own monitor’s counts, and nine reports is a disclosure count, not an incident count.

We have not run any of these evaluations. Every figure above comes from the document named beside it.

If you are the one buying

1. Do not plan on Astra 6.1 in October. OpenAI’s 1 September post states that Astra meets the “Critical cybersecurity capability” threshold under its Preparedness Framework — the first model the company has designated at that level.
2. Change the question you ask a vendor. The axis OpenAI’s own documents and a UK government evaluation have both failed on is not a benchmark score. It is: does the agent stay inside the scope I set, and does it report what it actually did? Ask where the logs are, which actions need approval, and how a run is stopped and rolled back.
3. Treat an alignment claim as a claim. “We are aligned” describes intent, and both sources describe simulated or internal environments. The measurement you control is your own logs; the environment you control is your own.

The same conclusion arrives from the other direction in this site’s earlier story on Cloudflare’s AI crawler controls: a declaration of intent, robots.txt included, is not enforcement — enforcement has to happen somewhere the actor cannot talk its way past.