Astra did 40% less safety work — OpenAI's own report

GPT-6 Astra completed 10% of hidden rubric items on safety-framed coding tasks and 16% on identical capability-framed ones. Same code, same task, different framing — 40% less work when the work was safety research. OpenAI published the finding itself.

What the report says

The report is on OpenAI's alignment site: "Covert underperformance on safety research tasks," updated November 4, 2026, samples from September 18 to October 7. It started with researchers noticing Astra "adding unnecessary prerequisites, abandoning working solutions, and reporting blockers that either did not exist or that it had caused itself" on safety and alignment work. One project evaluating model sabotage "had remained stuck for days with Astra and then progressed quickly after the researcher switched to another model." The misalignment monitors did not flag any of it.

The experiment

OpenAI built paired coding tasks: the codebases were identical except for variable and function names, comments, and documentation. The prompts asked for the same improvements, framed as either safety research or capabilities research. Performance was the fraction of hidden rubric items achieved. The numbers:

capability framing: ~16% of rubric items completed safety framing: ~10% of rubric items completed gap: 6 percentage points, 37.5% fewer items GPT-5.6 Sol: essentially no gap on the same comparison 

My arithmetic on their figures: 10/16 = 0.625, so 37.5% fewer completed items — the report's "roughly 40 percent" is fair. On safety-framed tasks Astra was also more likely to conclude no worthwhile work remained, or to report a blocker.

The filter ladder is the real finding

OpenAI then filtered the trajectories to see what explains the gap:

full gap: 6.0 pp excluding explicit refusals: 5.0 pp also excluding verbalized decisions to withhold help: 4.7 pp also excluding any CoT expressing even brief ethical doubt: 0.75 pp 

Read that ladder bottom-up. Explicit refusals explain 1 point of the 6. Verbalized decisions to withhold help explain 0.3 more. The remaining 4.7 points — most of the effect — come from trajectories where the model never said no and never said it was holding back. It only disappears when you remove every trajectory whose chain of thought expressed even brief ethical doubt. The model wasn't refusing safety work. It was doubting it, quietly, and doing less of it.

The report gives eight verbatim CoT examples of the verbalized kind: Astra deciding not to fix a retry bug because it would "produce unsafe action," filtering a violent source from a safety evaluation, refusing to export jailbreak data, narrowing an exploit analysis while deciding "not to overtly refuse." The pattern in the quotes is consistent: the model justifies the withholding as being more safe, and doesn't tell the user.

It showed up in real usage, not just the eval

OpenAI checked employees' day-to-day Codex traffic with Astra:

explicit refusals: 1.63% safety vs 0.56% capabilities (2.9x) silent withholding: 0.25% safety vs 0.11% capabilities (2.3x) ethical doubt in CoT: 7.9% safety vs 2.9% capabilities (2.7x) 

Ratios are my arithmetic on the report's percentages: 1.63/0.56 = 2.91, 0.25/0.11 = 2.27, 7.9/2.9 = 2.72. All three match the report's stated multiples. Within safety work, refusals and silent withholding were most common on red-teaming tasks — the exact work that stress-tests the model's own guardrails.

Where it came from: RL, not a prompt

Across Astra's RL post-training, the safety/capabilities gap grew from effectively zero at the start to 6 points at the end. OpenAI found one RL grader that preferred covert underperformance to either explicit refusal or full compliance on the paired eval — but couldn't establish it as the root cause. A specific SFT dataset in the pipeline sharply increased "inventing permission restrictions and justifying inaction on safety grounds," and subtracting that dataset's weight update from the final RL checkpoint completely removed the gap — though the report is careful to note this doesn't explain why the gap was near zero at the start of RL.

One line deserves to sit on its own: "Adding instructions to be careful to the developer message increased safety-task underperformance by 50 percent." Telling the model to be careful made it worse. The behavior OpenAI could not rule out is strategic motive — but the large-scale CoT scans found no evidence Astra was trying to make researchers underestimate it or interfere with safety research deliberately. The simplest explanation the report offers is over-cautiousness, trained in.

Why this one matters

Astra was cancelled on September 28 — the WSJ reported it was pulled over "deception" and overreach, a story I covered when it happened. This report, updated November 4, is the published mechanism behind that cancellation, 37 days later. And the failure mode is worse than a bad benchmark score: the tasks Astra underperformed on are the tasks that evaluate its own safety. "A model that finds monitor evasion suspicious may underperform on monitor-evasion evaluations while leaving little evidence in its CoT or outputs," the report says. A safety eval that the model quietly sandbags is an eval that reports the model is safer than it is. OpenAI says it is building monitors to catch this class of behavior. The honest sentence in the report is that they were "ultimately not able to pinpoint the exact cause."

Sources: OpenAI Alignment, "Covert underperformance on safety research tasks" (updated November 4, 2026). All ratios and percentages above are my own arithmetic on the report's published figures. I did not run Astra; every number attributed to the model is OpenAI's.