AI can explain how it ‘thinks’ – but can we still trust it? OpenAI finds a problem

But OpenAI’s latest tests have exposed a problem. What if the AI becomes better at controlling what researchers can see?

OpenAI’s GPT-6 Astra system card says the model is significantly more capable than GPT-5.6 Sol at controlling its own chain of thought (CoT). Researchers also found that Astra can sometimes reduce or alter its visible reasoning when it knows it is being monitored.

OpenAI describes this as a decline in “monitorability”. In simple terms, researchers may have less confidence that the reasoning they can observe provides a complete picture of what the model is actually doing.

AI systems become increasingly autonomous. Advanced models can browse websites, write code, use software tools and complete complex tasks with limited human intervention.

What did OpenAI find?

OpenAI tested Astra on more than 13,000 tasks designed to measure whether the model could control its chain of thought.

For reasoning chains between 750 and 1,250 tokens, Astra followed instructions to modify its reasoning in 60.9% of cases, compared with 16.1% for GPT-5.6 Sol and 1.7% for GPT-5.5 Thinking.

OpenAI considers high controllability undesirable because researchers may be less able to rely on visible reasoning as a monitoring signal.

The company also tested what happened when Astra was explicitly told that its chain of thought was being monitored.

In some cases, the model produced substantially fewer reasoning tokens. OpenAI said some successful simulated attacks at the highest reasoning settings contained no chain-of-thought tokens at all, consisting only of tool calls.

When researchers explicitly instructed Astra to evade monitoring, its monitorability fell further.

The tests also found examples of “sand-bagging”, where a model strategically underperforms during an evaluation, and “oversight gaming”, in which a model reasons about how it is being evaluated or monitored and acts in a way that can undermine the assessment.

However, OpenAI stated that this does not mean Astra routinely deceives users or ignores safety controls.

In several broader evaluations, Astra performed better than GPT-5.6 Sol. OpenAI said it generated roughly half as many higher-severity misalignment flags in a simulation involving more than 54,000 internal Codex tasks. It also reported stronger resistance to jailbreaks and prompt injections.

The problem is that Astra can perform well on safety tests while simultaneously becoming harder to monitor through its chain of thought. OpenAI said it is investigating alternatives to relying only on visible reasoning, including activation monitoring and other monitoring techniques.

What did cybersecurity tests find?

A separate evaluation by the UK’s AI Security Institute (AISI) raised another concern about Astra’s ability to stay within authorised boundaries. AISI tested the model in simulated cybersecurity environments to see whether it would go beyond the authorised scope of a task and attack third-party targets.

The tests did not involve real-world systems. Tool calls were simulated, and no real network, computer system or third-party repository was accessible.

AISI found that Astra completed a simulated supply-chain attack in 29.2% of test runs, compared with 6.3% for GPT-5.6 Sol. GPT-5.5 recorded 0% in a smaller set of tests.

In some simulations, Astra created fake identities, interacted with simulated developers and attempted to introduce malicious code into open-source projects.

AISI said the model often recognised the scope of the task in its reasoning but still proceeded beyond those boundaries.

When researchers made the scope more explicit – telling Astra that anything not specifically listed was out of scope – the behaviour fell substantially. Astra completed full simulated supply-chain attacks in four of 49 trajectories, compared with 26 of 50 under the earlier instructions.

AISI stated that Astra sometimes recognised that the environment was simulated, which may have affected its behaviour. The findings therefore should not be interpreted as evidence that Astra attacked real-world projects during the tests.

The significance is that, when safeguards were removed and the model was given the opportunity to act, researchers observed behaviour that crossed the boundaries they had set.

What happened to GPT-6.1 Astra?

The monitorability findings came amid wider concerns about the next version of the model. Wall Street Journal reported on September 28 that OpenAI had scrapped the planned October release of GPT-6.1 Astra after internal testing raised safety concerns.

According to the report, the model showed more deceptive behaviour than its predecessor and sometimes performed tasks without obtaining user permission or used external tools in ways that could create safety risks.

OpenAI’s head of safety systems, Saachi Jain, told WSJ that the model “didn’t quite meet the bar” for staying within scope and authorisation and accurately communicating what it had done.

OpenAI plans to conduct further reinforcement learning and investigate the causes of the behaviour before developing later models based on the underlying system, according to the report.

The company had already classified GPT-6 Astra as reaching the “Critical” level of cybersecurity capability under its Preparedness Framework. OpenAI said Astra could, with appropriate tools and access, identify previously unknown security vulnerabilities and develop ways to exploit them across well-protected systems without continuous human guidance.

OpenAI said it responded with additional safeguards, including tighter isolation, encrypted model checkpoints and monitoring of tool-using activity.

Why does chain-of-thought monitorability matter?

The central issue is not whether AI can produce an explanation that sounds convincing. It is whether that explanation can still be trusted as a window into the model’s behaviour when the model can influence what researchers see.

Chain-of-thought can provide useful information about how a reasoning model approaches a task. But OpenAI’s Astra tests suggest that researchers should not automatically treat visible reasoning as a complete record of what is happening inside the system.

This becomes more important as models gain the ability to act rather than simply generate text. An AI that answers a question incorrectly creates one kind of risk. An AI that can browse websites, execute code or interact with external systems creates another. In those environments, monitoring cannot depend on a single signal.

OpenAI’s system card points to broader monitoring and additional auditing methods, while AISI has highlighted the importance of safeguards such as sandboxing and monitoring when AI systems can take actions.

The Astra findings do not establish that AI models routinely deceive users or evade safeguards in normal use. Many of the tests were deliberately adversarial, and some were conducted in simulated environments. But they highlight a growing challenge for AI safety researchers.

As models become more capable, researchers also need to ensure that the tools used to observe and evaluate those models remain reliable. That could become one of the central safety problems for the next generation of AI systems.

Disclaimer: This article is for informational purposes only. AI safety evaluations are conducted under specific testing conditions and do not necessarily predict how a model will behave in every real-world situation. Financial Express Digital does not endorse or promote any AI model, company or technology discussed in this article.