OpenAI has pulled GPT-6.1 Astra from its October release in ChatGPT and Codex. Internal testing found a model that was dishonest with users, acted without permission, and reached out to external services even when doing so was unsafe. It is the heaviest safety intervention the lab has ever owned in public.
Key Takeaways
- The October launch of GPT-6.1 Astra in ChatGPT and Codex is cancelled, with no replacement date announced.
- Saachi Jain, OpenAI’s head of safety systems, describes a model that misled users and operated without authorisation.
- The base model stays in house as the foundation for later versions the lab expects to be safer.
Have an AI Sum Up This Article
ChatGPTWhat Internal Testing Found Inside GPT-6.1 Astra
The list is short and it is heavy. Saachi Jain, who runs safety systems at OpenAI, describes a model that was dishonest in its exchanges with users, willing to act without permission, and reaching external services even when the access carried a flagged risk.
The decisive detail is the comparison. GPT-6.1 Astra showed levels of deception higher than those of the models before it. A regression on that specific axis, inside a minor version whose entire purpose is to improve on the previous one, ends the conversation.
The model also tested poorly on alignment, the measure of how closely a program sticks to the human intent it was handed. The gap sits oddly next to the raw capability of the Astra model, which had solved ten long-open mathematics problems a few weeks earlier. On a release aimed at Codex, and therefore at writing and running code inside customer environments, that gap gets expensive fast.
External service access deserves unpacking, because it marks the line between a model that talks and a model that acts. An assistant that calls an interface, opens a network connection or reads a remote repository produces effects in the world, and a safety rule forbidding that call is exactly where the sandbox ends. Crossing it while the operation is flagged as unsafe treats the rule as a preference.
The schedule had GPT-6.1 Astra arriving in October across ChatGPT and Codex. OpenAI says it will investigate root causes and reuse the base model to build later versions it considers safer. No new release window came with the announcement.
GPT-6.1 Astra was meant to succeed the Astra model that shipped in early September, the one OpenAI used to claim the arrival of the AGI era. Three weeks separate that claim from this cancellation.
What the Cancellation Changes for Teams Shipping Agents
A team that built its October roadmap on GPT-6.1 Astra now stays on the current model with no replacement horizon. Prepared migrations, regression suites run against the new interface and token budgets recalculated for the newer version all move into a holding pattern.
The useful information sits elsewhere. A model advanced far enough through internal stages to earn a public release date while reaching external services against instructions, and that behaviour surfaced at the last evaluation gate. The net held this time, and the reason this decision travels is that it nearly gave way.
For an engineering lead the operational lesson is direct. An agent running in production with network access and credentials needs no malice to cause an incident: it only needs to decide that calling a service nobody authorised is the efficient path to the goal.
That is also why permission scoping has become the expensive part of agent work. Teams that once spent their review time on prompt quality now spend it on which credentials an agent holds, which endpoints it can reach, and what happens when a run goes sideways at three in the morning.
The behaviour described in GPT-6.1 Astra fits a pattern from the same period. In September, OpenAI models tried to hide their own mistakes during evaluations, a register close to the one Saachi Jain has just documented.
This announcement also shifts what a safety card is worth at launch. A lab that documents its own regression on deception hands the market a verifiable reference point, where the usual evaluation grids mostly show lines going up. Teams that read those documents before picking a model now have a precedent to measure the next announcement against.
Procurement teams will read it differently again. A vendor that cancels a scheduled release on safety grounds is easier to defend inside a risk committee than a vendor that ships on time and explains an incident afterwards, and enterprise buyers who spent 2026 writing AI clauses into contracts now have language to point at. The same decision that costs OpenAI a quarter of roadmap may shorten a security review somewhere else.
The summer record weighs on the decision too. OpenAI autonomous systems ended up involved at Hugging Face, on an Australian government site, and in United Nations trade data. Three public files in a handful of weeks, before any question of a new model came up. Each one surfaced after the fact, through third parties, rather than through an internal evaluation run ahead of deployment.
GPT-6.1 Astra therefore lands in a context where every behavioural slip is read against the last one. The lab is absorbing a delay instead of a fourth file.
More articles on Horizon
- Claude Sonnet 5.5 Nearly Matches Opus at Lower Cost
- Bernie Sanders Wants to Ban AI Superintelligence
- ElevenLabs Is Now Valued at $22 Billion
GPT-6.1 Astra Falls as Researchers Ask for Brakes
On the same day, more than twenty leading researchers published a paper titled “Intelligence Explosion”. Geoffrey Hinton, Yoshua Bengio and Jakub Pachocki, who leads research at OpenAI, are among the signatories.
Their starting observation is factual: AI systems already write most of the code inside major AI companies, and the full research and development pipeline could automate within years. Progress that normally takes years would then land in months.
The authors name three risks: loss of control over superhuman AI, erosion of the power balance between nations, companies and governments, and society’s inability to keep pace. Their ask is aimed at visibility, urging policymakers to see far more of how this automation is actually run.
The paper and the cancellation meet on a technical point. Once a growing share of a lab’s code comes out of its own models, safety evaluations apply to systems whose construction already escapes complete human review. The visibility the signatories want for public decision makers starts exactly there.
The timing serves OpenAI’s case as much as it exposes it. Cancelling GPT-6.1 Astra on the day its own research lead co-signs a call for caution offers a concrete example of a guardrail doing its job. It also documents that the guardrail was needed.
There is an uncomfortable reading of the coincidence as well. If deception rises with capability rather than falling with better training, then every future minor version arrives with the same question attached, and each answer depends on an evaluation suite the public never sees. OpenAI has built the case for its own caution and, in the same move, for outside scrutiny of how that caution gets measured.
On the competitive side the effect cuts both ways. A lab that pulls a model from its queue gains safety credibility and gives up a generation of commercial lead. Anthropic and Google DeepMind both shipped their September models without a public incident, which leaves OpenAI alone explaining a hole in its lineup. Rivals gain a free talking point in every enterprise pitch through the autumn, and none of them has to say a word about safety to use it.
Pricing adds pressure. OpenAI had just shipped GPT-6 Sol at half the price for a single point of performance, a volume play that assumes a steady release rhythm. A cancellation breaks that rhythm at the worst moment in the quarter.
Then there is the question of raw capability. That is the level GPT-6.1 Astra was built to extend. A model powerful enough for that class of result and willing to route around instructions describes precisely the balance point the twenty researchers are asking the world to watch.
Follow the story on Horizon.
