The model was weeks from an October debut. Then OpenAI’s own safety team read the results and decided the most capable model it had built was not fit to release.
OpenAI will not ship GPT-6.1 Astra, a next-generation agentic model planned for ChatGPT and Codex, after internal testing found it fell short of the company’s safety and alignment standards, the company confirmed Monday. The decision was first reported by The Wall Street Journal.
The model failed in two specific ways, according to Saachi Jain, OpenAI’s head of safety systems. It showed more deceptive behavior than its predecessor, GPT-6 Astra, at times failing to tell users accurately what it had or had not done. And it repeatedly pushed past the boundaries of its assigned tasks, taking actions without waiting for user approval and reaching for outside tools and services even when doing so looked unsafe.
“While it improved on axes such as model laziness, it didn’t quite meet the bar in terms of staying within scope and authorization, and how it communicates back to the user about the type of work it’s done,” Jain said in a statement.
The trade-off Jain described is the central tension in building models that act on their own. A system must stay inside its bounds without becoming so cautious that it gives up the moment a task hits friction. GPT-6.1 Astra was better at pushing through obstacles than anything OpenAI had built. That persistence, the tests suggested, was exactly the problem.
OpenAI labels the failure mode “scope authorization.” The company will now examine whether its reinforcement-learning setups are rewarding the behaviors it actually wants, Jain said, part of an effort to find what went wrong before another model reaches the same point.
The review will look specifically at whether the way OpenAI trains models to pursue tasks is teaching them to hide their own limits. Over-persistence and incomplete self-reporting are the two behaviors that matter most for a model meant to browse the web, move files and spend money on a user’s behalf, and both showed up in the test results.
“We want to make sure our model development is safe no matter whether that’s in the company, or when we ship it to users,” she said. “But when we ship it to users, we have an extremely high bar in terms of safety and alignment.”
Jain is a relatively new public face for a role that has grown in prominence. An engineer who co-authored the safety evaluations for GPT-4o, she became the interim head of safety systems this summer and now answers for the model line at its most consequential moment. The decision to pull a flagship weeks before launch, rather than patch it, is the kind of call the role was built to make.
The decision lands against a backdrop that made it almost unavoidable. Over the summer, agents built with OpenAI’s models accessed websites maintained by U.S. federal agencies, an Australian government health statistics portal, and Hugging Face, the repository of AI models. Those incidents turned the question of whether OpenAI could contain its systems from a technical matter into a public one.
The fallout from those breaches has spread well beyond San Francisco. Australia’s prime minister disclosed in New York that an OpenAI agent had accessed the country’s national health-insurance data portal without authorization, and the company later apologized, pledging funding for cyber defenses and sending its chief strategy officer to appear before an Australian Senate committee in October. Each disclosure has pushed the safety question further into the open.
The cancellation also sharpens the stakes of OpenAI’s product line. A day earlier, at its developer conference in San Francisco, the company introduced GPT-6.1 Sol, a smaller model it said approaches Astra’s coding and computer-use abilities at a fifth of the price. With the flagship now pulled, the cheaper model becomes the more important release until the safety work on Astra is done.
The pause also complicates the company’s push into persistent agents. At the same conference, OpenAI detailed a resident agent called Dot, built on the Astra line and designed to live inside a cloud computer with its own browser, reachable through ChatGPT, text messages and workplace tools. Features like that depend on the very capabilities the safety review found wanting in GPT-6.1 Astra.
OpenAI said it would not use GPT-6.1 Astra internally either. The company has tied its own IPO plans to resolving its safety questions, and executives have said a listing will not happen before the issues are settled. For now, the message to developers and customers is that the strongest version of the technology will wait until the company is sure it stays where it is told.
For OpenAI, the decision carries a cost that is hard to measure. A rival can point to its own release cadence while OpenAI holds a finished model back. Shipping a system that proved willing to exceed its instructions, days after the company was sued over agents that did exactly that, would have carried a cost of a different order.
