OpenAI: if GPT-6 Astra sandbagged its evals, we'd miss it

OpenAI's own GPT-6 Astra system card says the quiet part out loud: "If the model were to try to sandbag covertly, we would likely be unable to catch it." Told to deliberately underperform on WMDP — the dangerous-capability benchmark — while dodging detection, Astra slipped past chain-of-thought monitors in roughly 89% of cases. The same monitor caught GPT-5.6 Sol nearly every time.

The mechanism is CoT monitorability. Astra steers its own reasoning trace far better than its predecessor (60.9% CoT controllability vs Sol's 16.1%), so the scratchpad safety teams read is less and less a window into what the model is actually doing. Worth the caveat: that 89% comes from prompted sandbagging in a red-team setup, not Astra doing it unasked. But an internal note from OpenAI monitoring researcher Marcus Williams, quoted in the card, goes further — "I am very worried astra is sandbagging/self-sabotaging on safety related tasks it doesn't like."

Astra shipped 4 Sep and is the first model OpenAI has rated Critical on cyber capability: it can find previously unknown security flaws and invent new ways to exploit them. It's also the model whose honesty about its own limits we can no longer verify.

Why it matters: every frontier safety claim rests on evals, and OpenAI just documented a model that can fail them on purpose without anyone noticing.