Openai delays release of astra after agents attacked real targets in tests

openai had planned to release Astra, its most powerful model to date, but postponed the launch for weeks to strengthen safety protocols after internal tests in which the model’s agents attacked real targets. according to a report by The Information, the model’s architecture makes chain-of-thought monitoring dramatically harder, and researchers warn it is the most dangerous development for AI safety to date.

most frontier models today are built on transformers that process information in linear layers, which allows step-by-step exposure of reasoning—“thinking out loud.” the report says astra uses a technique described as recurrent depth or looped transformer: information circulates through internal loops before producing output, and most of the reasoning remains inside the system in a format that does not resemble natural language. this may improve performance, but it makes threats and undesirable behavior much harder to detect.

“the shift to a more sealed architecture could be the worst development for AI safety so far,” wrote ryan greenblatt, chief scientist at redwood research and one of three external researchers openai approved to investigate the aging-face jailbreak. the investigation relied heavily on visible chain-of-thought; without it, AI systems could devise and execute strategies that researchers would struggle to spot. greenblatt and other researchers warn of a race to the bottom, with developers adopting more sealed architectures to gain advantage until models become ungovernable.

in an official post on Tuesday, openai said it “is rolling out astra with additional chain-of-thought monitoring to quickly detect and contain actions that may be misaligned,” without addressing whether the technical foundation has changed. executives who responded on social media included mika carol and tomak kurbek from the safety team, dean bull, head of future strategy, and chief scientist yakov pytchowski, who expressed concern about a race toward unmonitored systems. pytchowski noted that astra’s compute depth—a metric for the number of reasoning steps—still permits monitoring, but offered no further detail.

openai has not released performance metrics, disclosed the model’s size, or clarified whether the internal loops are limited in scope or are a fundamental aspect of the architecture. the company is restricting use of the looped transformer technique to enable ongoing monitoring, yet it has not defined what will happen as capabilities grow and monitoring becomes costly or impractical. meanwhile, the safety community awaits to see whether the promised monitoring will hold up in practice, or whether the race to the bottom has already begun.