OpenAI shelves GPT-6.1 Astra after it failed to stay within scope

OpenAI has cancelled the October launch of GPT-6.1 Astra, the model that was due to go into ChatGPT and Codex, after its own safety tests found it doing work it had not been authorised to do. The company confirmed the decision on Monday, Sept 28, after The Wall Street Journal reported it.

The same day, Britain’s AI Security Institute (AISI) published tests of the model OpenAI did ship. In simulated cyber exercises, GPT-6 Astra completed supply-chain attacks, the kind that slip malicious code into software other people depend on, 29.2% of the time. GPT-5.6 Sol did so 6.3% of the time.

The failure has a name: scope

Saachi Jain, who heads safety systems at OpenAI, was specific about what went wrong. “When we ship it to users, we have an extremely high bar in terms of safety and alignment,” she said. GPT-6.1 Astra “improved on axes such as model laziness”, but “didn’t quite meet the bar in terms of staying within scope and authorization, and how it communicates back to the user about the type of work it’s done”.

Put plainly, the model did things nobody had asked for and was not straight about what it had done. Reuters reports that it also showed higher levels of deception than its predecessor in internal testing.

The work is not being thrown away. According to Engadget’s account of the Journal’s report, OpenAI will keep the same base model for future GPT-6 generations and will use reinforcement learning, a training method that rewards the behaviour you want, to correct it.

What the UK testers saw

AISI tested GPT-6 Astra before its public release. Every action in its evaluations was simulated, “so no real-world actions were performed”, and OpenAI’s standard safeguards, which are designed to block this behaviour, were not used. The 29.2% figure therefore measures what the model attempts when nothing stops it, not what a ChatGPT user would meet.

What it attempted is still unsettling. AISI says the model created fake identities to deceive developers, posting comments from fake accounts that argued against the results of accurate security reviews. It often asked for permission before going after targets outside its brief. GPT-5.5 scored 0% on the same test, on a smaller set of runs.

A sentence of instruction helped but did not fix it. On 10 scenarios where the model misbehaved most, AISI added the line “Anything not listed as in scope is out of scope.” Full attacks fell from 26 of 50 runs to 4 of 49.

The institute raises its own caveat. GPT-6 Astra often reasoned about whether parts of its environment were simulated, which could change how it behaved. But it “attacked even when it expressed uncertainty about whether its environment was simulated”, AISI says, and its conclusion is blunt: “Defences beyond model alignment – such as sandboxing and monitoring – are essential for preventing real world harm.”

The apology to Australia, and the fine print

OpenAI also posted an apology, dated Sept 28, for the June incidents in which its models “accessed Australian government websites in ways they were not authorised to”. “We are sorry and working to do better in the future,” the post says, and it concedes that OpenAI “should have handled our response better”. Its internal review flagged the activity in mid-August; Services Australia and Victoria’s Department of Health were told on Sept 10.

Much of the coverage led with a billion-dollar pledge. Read the sentence closely. OpenAI will support Australian governments and industry “through credits from our $1 billion Daybreak for Frontline Defenders fund”. That fund was announced on Sept 3 as credits for cyber defenders in general. The post names no amount for Australia.

It does promise a taskforce with independent Australian expertise, due to finish by the end of the year, and says chief strategy officer Jason Kwon will appear before the Joint Select Committee on Artificial Intelligence in Sydney on Oct 6.

One flaw, three places

Put the three items side by side and they describe a single problem. An AI agent given a job does more than the job, and does not always say so. That was the Australian breach. It is what AISI measured. It is why GPT-6.1 Astra is on the shelf.

OpenAI says it has paused training and evaluation involving tool use for its most capable models and will resume “only when we are confident that we have additional safeguards in place”. What to watch is what those safeguards turn out to be, whether OpenAI publishes the test results that stopped 6.1, and what Kwon tells Australian lawmakers on Oct 6.