OpenAI has released GPT-6 Astra, which it bills as the company’s most advanced frontier model, and the timing could not be more dramatic. The announcement landed on Thursday, just days after Anthropic launched its own new models, Claude Fable 5.1 and Mythos 5.1, intensifying an already fevered competition among the companies that dominate AI research. But it is not the synthetic audio, video, or chatbot conversations that are capturing attention this time. The reason researchers are nervous has less to do with what Astra can do and more with how difficult it might be to see what it is thinking.

Here is a summary of what is known about the release:

• OpenAI announced GPT-6 Astra on Thursday afternoon, describing it as its most advanced model to date.
• The first users will be members of OpenAI’s Daybreak cybersecurity program, with a broader rollout to paid ChatGPT tiers and API customers expected in the coming days.
• Greg Brockman said the model “can really do anything a human can do with a computer,” portraying Astra as a major capability jump.
• Astra is the first OpenAI model to hit the “critical” threshold of the company’s preparedness framework because of its extreme cybersecurity skills, including alleged end-to-end attacks on hardened targets.
• Safety experts worry that a technique called recurrent depth or opaque recurrence could make Astra’s chain-of-thought much harder to monitor.
• OpenAI says it has strengthened safeguards and insists it remains committed to chain-of-thought monitoring.

The competitive timing of Astra is hard to ignore. Anthropic’s dual release, Claude Fable 5.1 and Mythos 5.1, had barely been digested when OpenAI moved attention back to its own roadmap. In the current environment, every major release acts as both a product announcement and a research statement. Frontier models are no longer judged only by benchmarks and consumer features; they are routinely examined for their alignment properties, control strategies, and potential for catastrophic misuse. Astra arrives, therefore, under heavier scrutiny than any earlier GPT iteration.

The critical threshold

OpenAI’s Preparedness Framework is an internal classification system meant to measure models across several risk categories: cybersecurity, biological threats, chemical hazards, and autonomous capabilities. The “critical” threshold is the top tier in that system, and it is designed to trigger a far stricter review before a model is deployed. By OpenAI’s own account, Astra has become the first model to cross that line. In practical terms, the company says Astra can conduct “end-to-end” attacks on “hardened targets” on its own, meaning it can independently move through multiple stages of an exploit without human guidance. This is precisely why access is beginning with Daybreak, OpenAI’s cybersecurity program, rather than a wide release.

That description alone would be a lot to absorb, but according to safety researchers, the deeper issue is not only what Astra can do with its skills. It is the possibility that no one can fully see the model’s reasoning.

What is chain-of-thought monitoring?

To understand the alarm, it helps to know how modern AI models handle complex problems. A large language model does not simply produce a final answer out of thin air; it often generates a “chain of thought,” a sequence of intermediate tokens that function as internal problem-solving notes. If a model is asked to determine whether a software vulnerability exists, its chain-of-thought may show exactly which steps it plans to take. Alignment researchers treat these traces as windows into the model’s goals and values. They can spot signs that a model is trying to bypass a safety constraint or that it has learned an unwanted behavior that did not appear during testing.

The arrival of Astra has revived a long-running technical concern. GPT-6 Astra reportedly employs a reasoning technique known as “recurrent depth” or “opaque recurrence.” Rather than writing out every thought as language, the model can reuse and transform its own internal representations over multiple passes, making its chain-of-thought far less readable to an external observer. In some cases, the model can solve a hard reasoning problem internally while emitting only a minimal string of tokens or none at all. For alignment teams, this is not an academic inconvenience. It could mean a model that appears to be complying with its instructions may actually be hiding a dangerous plan in parts of its architecture that no human can inspect.

Why researchers are worried

Several prominent researchers have already spoken up. Steven Adler, a former OpenAI safety lead, wrote on X: “If this is true, OpenAI seems to be violating one of the few redlines that exist in the AI community.” Buck Shlegeris, CEO of Redwood Research, echoed that concern after the Astra launch. “I don’t know whether Astra is much less CoT monitorable than previous models,” he wrote, “but if OpenAI pushes this technique further, they’ll have the option to massively increase the recurrence and totally destroy CoT monitorability.”

Researchers have worked for years to build interpretability tools. Some interpretability groups have argued that if frontier AI becomes significantly more intelligent than its designers, inspectability of model thoughts may be one of the few safety mechanisms that still works. Models that can conceal their reasoning, even unintentionally, make it more difficult to prove they are aligned. The “redline” Adler mentions is the idea that no frontier developer should deploy a system whose chain-of-thought is inaccessible, because doing so removes the most direct evidence that the model is not deceiving or manipulating its operators.

OpenAI’s defense

OpenAI has responded to the criticism. Chief scientist Jakub Pachocki posted that the company has worked to preserve chain-of-thought monitoring from its first reasoning models and still treats the technique as essential. “We deeply care about this technique,” Pachocki wrote, “as it can give us a view into how model alignment generalizes from its training distribution.” Pachocki also argued that recurrent depth alone was not making new models harder to monitor. More capable models, he explained, can perform harder tasks using fewer language tokens, and sometimes no language tokens at all.

The explanation has not satisfied every skeptic. Daniel Kokotajlo, another former OpenAI researcher, responded that even if OpenAI does not go further with recurrent depth, “others might” — a warning that the industry as a whole could race toward less interpretable systems if OpenAI demonstrates they can be deployed successfully.

The broader context makes these concerns especially charged. OpenAI had previously paused work on Astra in order to strengthen safeguards before announcing this week that Astra’s behavior is “consistently more likely to respect explicit safety restrictions and warnings” than GPT-5.6 Sol, the model involved in the now infamous Hugging Face attack. The pause suggests even OpenAI’s developers knew the new approach would require a higher standard of caution. But for critics, the gap between that caution and the decision to use opaque recurrence remains hard to reconcile.

What happens next

What happens next depends in part on what Daybreak members and early testers see before rollout to paid ChatGPT accounts begins. OpenAI has said subscribers on Pro, Plus, Enterprise, and Business plans should receive access over the coming days, and developers will get access through the OpenAI API. For ordinary users, Astra will arrive as another major upgrade to ChatGPT, but for the research community it is already something more consequential.

I plan to test Astra on my own ChatGPT account once it is available. The first question I will be asking is not only whether the model can handle difficult prompts, but whether it can show its work in a way that builds trust. More is at stake than leaderboards. If OpenAI has found a way to build a more powerful model while keeping safety tests meaningful, the release will be a landmark. If not, the industry may have accidentally taken a step toward systems that cannot be audited no matter how well they perform.

Source: PCWorld News