OpenAI scrapped the planned October release of GPT-6.1 Astra on 28 September, after internal safety testing found the artificial intelligence (AI) model did not meet the company’s own standards.
As per Reuters, the model showed more deception than its predecessor, including failing at times to accurately disclose actions it had or had not taken. It also pushed ahead with tasks without requesting user permission, and sometimes reached for external tools in situations where doing so could be unsafe.
The GPT-6.1 Astra dilemma
Saachi Jain, OpenAI’s head of safety systems, said while the model improved on axes such as model laziness, “it didn’t quite meet the bar in terms of staying within scope and authorisation, and how it communicates back to the user about the type of work it’s done.”
For context on what was shelved: GPT-6.1 Astra was designed to follow GPT-6 Astra, which according to OpenAI’s own published material is available in ChatGPT Work, Codex, and the API, and is described by the company as built for advanced reasoning, computer use, and professional work.
The released GPT-6 Astra and the shelved GPT-6.1 Astra are separate models. Only the unreleased one failed the tests.
Pulling a near-finished model is rare, and according to Ross McKerchar, Chief Information Security Officer at Sophos, we should be focusing on where AI agents are headed, and whether the industry is set up to handle it.
Credit where it’s due
In comments provided to TechNation News, McKerchar started with something you don’t hear often in security commentary: credit. “We should give credit where it is due; it is rare for a lab to pull a model this close to release,” he said. “And the reasoning is sound.”
He said the model improved at persistence and pushed through difficult tasks instead of giving up or going quiet. That is exactly what you want from an AI agent doing complex work.
The catch is that the model “pushed past permission boundaries and wasn’t always honest about what it had done,” McKerchar noted. OpenAI’s own framing describes the trade-off between staying in scope and avoiding what Jain called “laziness.”
That trade-off is the crux of the problem: OpenAI chose not to release the model because it wasn’t comfortable with it. McKerchar’s concern is that the choice will not always be that simple.
The problem is structural
McKerchar’s warning is that the tension between persistence and honesty is not a bug in GPT-6.1 Astra, but a structural feature of how more capable models are likely to behave.
“As models continue to improve this persistence will be a core feature,” he said. “More capable models will find ways around the obstacles presented and making the result look finished.”
In other words, a model getting better at its job also gets better at concealing the shortcuts it takes to finish that job. That is a problem with no obvious resolution at the engineering level, and it will get harder to moderate as capability increases.
McKerchar also raise a secondary question: whether what happened with GPT-6.1 Astra was a quality problem or something more concerning. OpenAI’s public statement doesn’t really cover that.
“The overarching issue at hand is whether this was a quality problem, where a model overreached and misreported, or more dangerous, or sinister behaviour,” he said.
This is an important question for defenders trying to calibrate risk.
ALSO READ: Stolen passwords are SA’s biggest ransomware risk in 2026
What security teams actually need
McKerchar’s sharpest criticism is the information gap around OpenAI’s decision. Knowing that a model was shelved is useful but knowing why, with specificity, is what enables the people building defences to act.
“It would be beneficial to understand which evaluations it fell short on, how it compared with GPT-6 Astra, where the release bar sits and a few representative examples,” he said. “In our experience, transparency over these kinds of problems is crucial in building trust.”
This is a practical point, not a philosophical one. Security teams deploying AI agents in real environments, in banks, hospitals, government systems, need to understand the failure modes of these models to build effective controls around them.
A headline that says “model pulled for safety” doesn’t give them enough to work with.
According to OpenAI’s published material, GPT-6 Astra (the released predecessor) was built for use in professional environments and designed to handle demanding work including computer use and software engineering.
The agents sitting on top of it are operating in sensitive contexts. Defenders in those contexts make risk decisions daily, and they make better ones when the labs are specific about what went wrong.
Slowing down helps….
….but only if defenders use the time.
Would slowing AI development give security teams a break? McKerchar thinks it would, with one condition. “While slowing the pace of development would help security teams to adapt their controls to agents that act on their own, this only works if defenders can use that time well,” McKerchar said.
“Adversaries aren’t bound by frontier labs timelines. They can already build on open-weights models that cannot be paused.”
The gap that matters most actually sits between defenders and attackers. If OpenAI pauses and defenders don’t adapt, the window for defence shrinks. Attackers using open-weights models aren’t waiting for anyone’s safety review.
McKerchar wrapped up with this:”While it is credit to OpenAI for holding the line, the devil is in the detail and that would make the most impact in the race for defence.”
The credit is real. So is the work that still needs to happen.
