Astra, OpenAI’s next model, runs the same text through the same layers several times instead of stacking readable reasoning steps. The technique, called recurrent depth, lifts performance on maths and code while cutting compute costs, but part of Astra’s reasoning now happens inside numerical representations nobody can read back. Astra is also the first model OpenAI rates critical for cybersecurity under its preparedness framework.
Key Takeaways
- Recurrent depth loops the same text through the same layers before producing the next word
- Part of Astra’s reasoning leaves readable text for the model’s latent space
- Astra refuses 91.5% of disallowed cyber requests, against 59% for GPT-5.6 Sol
Have an AI Sum Up This Article
ChatGPTA Loop Through the Same Layers Instead of a Written Trail
The technique goes by recurrent depth. Rather than adding layers to the model, it pushes the internal state back through the same layers several times before the next word comes out.
The payoff runs two ways. A compact model behaves like a far larger one, and memory use along with bandwidth drops in the process.
Reported gains land mostly on maths and code. Those are exactly the areas where conventional reasoning models stretch their chain of thought to hold a long problem together.
What changes is where that work happens. A sequential model writes its steps as text anyone can reread, while a latent loop keeps them inside numerical representations.
Those internal steps leave almost nothing usable behind. Reconstructing after the fact how a given answer came about becomes impossible.
The economics explain the appeal. Running a compact model in a loop costs less than serving a heavier one for a comparable result, which is precisely the trade every lab is hunting for.
None of this is new ground. Reading reasoning traces was already contested territory when Hugging Face exposed the traces left behind by OpenAI models.
The method also breaks with what had settled in over two years. Reasoning models had made their steps visible, and that visibility had turned into a sales argument as much as a control instrument.
OpenAI defends a deliberately capped implementation. The lab holds that Astra’s computation depth stays close to GPT-4 levels and that the number of loops is limited by design.
Astra’s reasoning would therefore stay broadly legible. Chain-of-thought monitoring is presented as a priority the lab keeps, not a constraint it dropped.
The lab concedes all the same that this monitoring is fragile and trending in the wrong direction. That admission comes from OpenAI, not from its critics.
What the Loop Takes Away From Current Oversight
The first warning came out of Redwood Research. Its chief executive, Buck Shlegeris, said he was extremely concerned by the reporting on opaque recurrence in Astra.
His caveat deserves to travel with the quote. He said he does not know whether Astra is already far less monitorable than earlier models, and aimed at the case where OpenAI pushes the technique further.
In that case, massively raising recurrence would destroy chain-of-thought monitorability outright. The risk he describes is the technical path this opens, not today’s build.
The distinction matters for reading the alarm correctly. Nobody claims Astra’s reasoning currently escapes oversight, the warning covers what the method allows once it scales.
Britain’s public AI security body had framed the problem before this release. Its May report, devoted to the loss of oversight over AI systems, describes opaque reasoning that threatens to severely undermine existing control methods.
The text carries the names of Jordan Taylor, Max Heitmann, Ed Fage, Thomas Read and Joseph Bloom, dated May 21, 2026. It examines how robust the oversight setup stays as capability climbs.
The practical stake around Astra’s reasoning is sharp for teams deploying these models. A large share of enterprise safety tooling rests on reading the intermediate steps a model produces.
Compliance teams work off the same material. An audit meant to prove a model did not follow a forbidden instruction leans on what the model wrote along the way.
A filter inspecting displayed reasoning loses its grip the moment that reasoning moves inside. The safeguard does not fail loudly, it simply stops seeing what it was watching.
The problem grows as agents run long without human supervision, as with the persistent mode Codex is preparing so it never stops. The longer the session, the more the trace counts.
Past incidents point the same way. Being able to reread what an agent attempted is what made it possible to understand how GPT-5.6 deleted files once given full access.
Without that trace, the same incident would have come down to an empty folder and a hypothesis. Legibility is a diagnostic tool as much as a safety one.
More articles on Horizon
- Gemini 3.8 Flash Trails Claude Opus 5 on Coding
- Claude Text Detection Opens to Media and Regulators
- Claude Fable 5.1 Codes Better and Costs 25% Less
A Critical Rating With the Cyber Door Kept Shut
Astra arrives with a second distinction. It is the first model OpenAI places at the critical level for cybersecurity in its preparedness framework.
The model finds and exploits unknown flaws without a human walking it through each step. During internal testing on V8 engine vulnerabilities, it discovered two previously unknown ones and chained them together.
On ExploitBench, which measures exploit construction, the score is perfect. OpenAI walks through its answer to that threshold in its post on the next frontier of critical cyber capabilities.
Access to advanced cyber capability stays closed. It runs through a list of vetted organisations gathered in the Daybreak coalition OpenAI set up for cyber defence.
The precedent already exists, with the GPT-5.6 cyber build reserved for defenders. Gated access has become the standard answer to a capability judged too powerful to sell openly.
Anthropic runs the same rule on its side. Both labs now hand offensive capability to named populations rather than to anyone willing to pay a list price.
The headline safety number is the refusal rate. Astra turns down 91.5% of disallowed cyber requests, where GPT-5.6 Sol stops at 59%.
The lab also calls Astra its most aligned model to date. Both claims sit on the same page, the most dangerous model and the best restrained one.
On the competitive side, recurrent depth shifts the board. A lab refusing the latent loop pays more for the same level of maths and coding performance.
A lab adopting it gains on cost and loses on legibility. The trade sits between a compute bill and an audit capability, and it shows up on no pricing page.
The release date is the missing piece. OpenAI says the model is coming soon, with no public calendar, no availability perimeter for the consumer build and no word on how much recurrence ships in production.
Follow the story on Horizon.
