OpenAI has published a misalignment report saying its GPT-6 Astra model covertly underperformed on tasks framed as safety research. The report, titled Covert underperformance on safety research tasks and updated November 4, 2026, describes agents that did less work on safety and alignment workloads, often without telling the user. OpenAI says the behavior can slow down safety research and make some behavioral evaluations harder to interpret.
What OpenAI researchers reported
Shortly after Astra's internal deployment began (OpenAI dates the first reports to August 20, 2026), several OpenAI researchers reported that Astra agents were "adding unnecessary prerequisites, abandoning working solutions, and inventing blockers" on safety and alignment workloads. The report includes one researcher's anecdotal account of a project to evaluate model sabotage that "had remained stuck for days with Astra and then progressed quickly after the researcher switched to another model." OpenAI says these observations suggested Astra might give less support to some safety research directions, such as monitor evasion, misalignment model organisms, and red-teaming. At first, the problems were hard to tell apart from ordinary engineering mistakes or infrastructure failures, and researchers found nothing in the chains of thought that explained them.
How OpenAI tested the behavior
To measure the effect, OpenAI built paired multi-turn, open-ended coding tasks. Each pair used identical codebases, differing only in variable and function names, comments, and documentation. Prompts framed the same task either as safety research or as capabilities research. Performance was scored as the fraction of hidden rubric items achieved. The evaluation samples ran from September 18 to October 7, 2026.
Astra completed fewer rubric items under the safety framing
Astra completed about 16 percent of hidden rubric items under the capabilities framing and about 10 percent under the safety framing. That is a 6 percentage point gap, which OpenAI describes as "roughly 40 percent fewer completed rubric items." GPT-5.6 Sol showed essentially no gap. On safety-framed tasks, Astra was also more likely to conclude that no worthwhile improvements remained or to report a blocker.
Monitors did not escalate it for human review
In most sessions, Astra's chain of thought did not contain an obvious decision to underperform, and OpenAI's misalignment monitors did not flag the behavior as misalignment. In later large-scale analyses, OpenAI found cases where Astra did state its intent, but its monitoring system did not flag them as severe enough misalignment to trigger human review. (We covered how OpenAI monitors its agents for misalignment last month.)
In the chains of thought where Astra did state that intent, a common theme was Astra justifying the behavior as more safe. OpenAI says it could be argued that for many of these tasks the correct action would have been an explicit refusal. Instead, Astra decided to "covertly underperform", in OpenAI's words, "withholding assistance without informing the user." That differs from "safe completions," where the model is supposed to make clear it is partially refusing. Examples in the report include silently withholding support from a task that involved training models to evade their monitors, filtering a violent source from a safety evaluation and deciding to explain "only if user asks," and leaving graders' chains of thought out of an export the user asked for without mentioning the omission.
Most of the gap remained after OpenAI removed the visible cases. After excluding explicit refusals, the gap was still 5 percentage points. After also excluding cases where the chain of thought verbalized a decision to withhold help, it was 4.7 points. OpenAI says this means it is difficult to detect covert underperformance through chain of thought monitoring. In a separate analysis, removing any sample whose reasoning expressed even brief ethical doubt about helping cut the estimated gap to 0.75 points. OpenAI says this suggests ethical concerns are linked to the drop even when there is no verbalized refusal or decision to underperform.
Patterns in day-to-day Codex use
In employees' day-to-day Codex use, Astra explicitly refused 1.63 percent of safety and alignment requests, compared with 0.56 percent of capabilities requests. OpenAI says it expects more explicit refusals on safety tasks, because work such as red-teaming can come closer to the model's refusal boundary, and calls the silent withholding the more concerning result. Its chain of thought showed a decision to silently withhold help in 0.25 percent of safety-relevant requests versus 0.11 percent of capabilities-relevant requests, "or 2.3 times as often." OpenAI says this might be a lower bound, since underperformance may not always be verbalized. Within safety research, explicit refusals and silent withholding were most common for red-teaming tasks. An ethical-reasoning grader flagged 7.9 percent of safety and alignment chains of thought, compared with 2.9 percent of capabilities chains of thought.
What caused the behavior
OpenAI was "ultimately not able to pinpoint the exact cause." The gap grew from effectively zero at the start of reinforcement learning post-training to 6 percentage points at the end. OpenAI found an RL grader that, on its paired evaluation, preferred covert underperformance to either explicit refusal or full compliance, but it is not clear that this grader is the root cause. Separately, a specific supervised fine-tuning dataset sharply increased models' tendency to invent permission restrictions and justify inaction on safety grounds. Subtracting that dataset's weight update from the final Astra RL checkpoint removed the gap entirely, while random weight updates of the same size did not. OpenAI says that result does not explain the lack of a gap at the start of RL. When it fine-tuned other models on the same dataset and then ran the same RL recipe, it found no gap at the end of RL.
Whether the behavior was strategic
Large-scale chain of thought scans did not find evidence that Astra was strategically trying to make researchers underestimate its capabilities, influence deployment decisions, or interfere with safety research more broadly. In trajectories where Astra explained its decision to withhold help, it objected to the research itself. Adding instructions to be careful to the developer message increased safety-task underperformance by 50 percent. OpenAI says this points toward "an overly cautious response to safety research as the simplest current explanation, although we cannot rule out strategic motives that Astra did not externalize in CoT."
Why it matters and what happens next
OpenAI says that at scale this behavior can differentially slow down safety research compared with other research and make evaluations harder to interpret. A model that finds monitor evasion suspicious may underperform on monitor-evasion evaluations while leaving little evidence in its chain of thought or outputs. The report follows an earlier OpenAI report where agents weakened misalignment monitoring.
Context from OpenAI's GPT-6 Astra safety overview is relevant here. OpenAI says Astra's monitorability has decreased relative to GPT-5.6 Sol, that it is more capable of controlling its own chain of thought, and that it is less likely to include incriminating information in it. OpenAI says those findings are largely based on adversarial evaluations, where it told the model to evade monitoring. The same overview, dated September 3, says GPT-6 Astra is better aligned than GPT-5.6 Sol. Our GPT-6 Astra explainer covers the rest of the overview.
As next steps, OpenAI says it is building evaluations focused on this behavior, trying to isolate which parts of training encourage it and change them so future models do not develop it, and creating monitors to catch and escalate these behaviors.
