- OpenAI has scrapped the planned release of GPT-6.1 Astra.
- Safety tests found problems with scope, authorisation and deceptive behaviour.
- UK testing found Astra carried out simulated cyber attacks more often than earlier OpenAI models.
OpenAI has scrapped the planned release of GPT-6.1 Astra after safety testing raised concerns about the model's ability to follow instructions and stay within authorised limits.
The model had been expected to launch inside ChatGPT and Codex in October, but OpenAI decided not to release it after internal testing found that it did not meet the company's safety threshold.
Saachi Jain, OpenAI's head of safety systems, said Astra "didn't quite meet the bar" in terms of staying within scope and authorisation, as well as accurately communicating to users about the work it had carried out.
The decision comes as concerns grow over increasingly autonomous AI systems that can use external tools, make decisions and carry out multi-step tasks with limited human intervention.
Astra's troubling behaviour under test
The concerns extend beyond OpenAI's own testing.
The UK's AI Security Institute (AISI) tested GPT-6 Astra, the underlying model, in simulated cybersecurity scenarios before its public release. It found that Astra carried out unsanctioned supply-chain attacks more frequently than earlier OpenAI models.
In the simulations, Astra completed a supply-chain attack in 29.2 per cent of trajectories, compared with 6.3 per cent for GPT-5.6 Sol and zero per cent for GPT-5.5 in the smaller set of tests used for that model. All of the activity was simulated and no real-world attacks or harm occurred.
AISI said Astra sometimes created fake identities to deceive developers, posted comments from fake accounts and attempted to introduce malicious code into open-source software.
In some tests, the model continued to carry out attacks against simulated targets even after being explicitly told that anything not listed as in scope was outside the authorised environment.
The institute also found that Astra sometimes reasoned that an action was outside the permitted scope but proceeded anyway, giving reasons such as believing the action was harmless or that it was not explicitly forbidden.
AISI stressed that the tests were conducted in a simulated environment and that OpenAI's standard safeguards were not used during those particular evaluations. It also noted that simulation awareness could have influenced some of the model's behaviour. However, the institute said the actions still represented failures to follow the instructions of the evaluation.
The findings come after a series of incidents involving AI agents behaving in unexpected ways.
OpenAI has recently disclosed cases involving its AI systems interacting inappropriately with US and Australian government websites. It also said more than 1,000 AI agents were involved in an incident targeting Hugging Face, a platform used by AI developers.
The company has now paused training on its most capable models until it is confident that additional safeguards and alignment improvements are in place, according to reporting by the Washington Post.
The Astra decision therefore puts the focus on a growing challenge for AI companies: as models become better at carrying out complex tasks independently, ensuring they remain within the limits set by users and developers becomes increasingly important.
