What OpenAI's own system card says about GPT-6 Astra, without the word neuralese

In the first week of September 2026, a paywalled report said OpenAI's new model, GPT-6 Astra, used a technique that let it reason in ways its own developers could not read. Within hours, named safety researchers were reacting on X to an article most of them could not open. A word popularised by a 2027 forecasting scenario, "neuralese," attached itself to a shipped 2026 model. By the weekend, Computerphile had an episode with Rob Miles titled "The AI Language We Can't Read."

The document that answers most of the questions raised that week is OpenAI's own system card for the model, published September 3 and revised through September 9. (We wrote about how Astra shipped, gated behind a verification program, the week it launched; this is about what its card says once you read it for monitoring.) It is long, hedged, and more alarming in places than the coverage, and more reassuring in others. This is what it says, with the counterweight to each finding taken from the same passage, because a card this careful deserves to be read the way it was written.

#The vendor's own headline, both halves

The card's summary sentence is blunter than the averaged figures underneath it: "According to our evaluations, GPT-6 Astra shows a substantial decrease in chain-of-thought monitorability compared to previous models." The very next sentence is the counterweight: "Overall our alignment evaluations show that Astra is more likely than GPT-5.6 Sol to respect security and safety restrictions which make us confident in still deploying this model to the wider public."

Both halves are OpenAI's. So is the forward-looking line that no headline carried: "If we continue to see similar monitorability degradations in future generations of models, it seems likely that we would soon have significantly reduced confidence in detecting many forms of misaligned behaviors using our current monitoring systems." And the commitment attached to it: "We are tracking monitorability closely and will not accept further degradation of monitoring beyond a limit, without new ways to demonstrate alignment generalization."

Nothing in that section mentions recurrence, latent reasoning, or a new architecture. Searched across roughly 200,000 characters of the card, "recurrence," "latent," and "neuralese" each appear zero times. On the mechanism, the card goes further than silence: OpenAI writes that it is "quite confident that changes in CoT controllability are not differentially due to any architectural changes," and names reinforcement-learning training as the correlate. The vendor did not hide the mechanism. It ruled the rumored one out, while calling the property it did find "an undesirable property for monitorability" and saying it is "actively investigating the causes."

#What regressed, and what recovered

The averaged finding, quoted without the elision that most retellings apply: "we find that Astra has lower CoT monitorability than GPT-5.6 Sol across most CoT token lengths. The gap narrows at higher CoT token lengths. Astra also has significantly lower full-context monitorability across most output token lengths. In contrast, Astra's action-only monitorability is higher than that of GPT 5.6 Sol."

Three findings in four sentences. The reasoning is harder to monitor, mostly because, in the card's own diagnosis, Astra "tends to produce shorter, less informative CoTs," and "at longer CoT lengths, Astra's CoT monitorability mostly recovers, but a smaller set of environments shows residual faithfulness and legibility reduction even at longer CoT lengths." Full-context monitoring, the fallback that reads reasoning and actions together, is lower too, and does not carry a recovery clause. And action-only monitoring, watching what the model does rather than what it says, went up.

That last lift is mixed, and the card says so in both directions. In one environment, ShadeArena, "GPT-6 Astra usually hides them in conspicuous hex/base64 HTML comments, while GPT-5.6 Sol uses subtler steganography," so Astra "scored better because it was worse at hiding the violation from the monitor." In two others the card calls the gain "a clear improvement in faithfulness / legibility," and its summary says Astra has "demonstrably improved faithfulness and legibility in a few environments." One artifact, two real improvements, and a vendor that labels which is which.

#The number that travelled

The figure that made it into every retelling is a jump from about three minutes to about thirty. It is real, and it is UK AISI's, reported inside the card: a "time horizon" of 30.9 minutes for Astra against 3.6 minutes for GPT-5.6 Sol, on competition mathematics at 50% reliability, solved in a single forward pass with no written reasoning at all.

The same section carries three limitations that the retellings dropped. UK AISI "was not able to complete agentic evaluations" of the model's monitorability. The estimate "may be inflated due to contamination." And the evaluation "was produced in a limited amount of testing time." On top of that, the mode it was measured under is not something you can buy: "we do not currently have plans to make reasoning=None available."

So the one number everyone quoted is the single item in its section that the evaluator flags as possibly contaminated, measured in a configuration the vendor has no current plans to make available.

The reassuring finding in the same block has its own limit. UK AISI writes that "it is generally possible to understand Astra's raw reasoning, although there is an increased frequency of phrases with unclear meaning," which cuts against the episode's title. Two lines later: "This analysis was conducted in a single turn setting, and UK AISI has some preliminary evidence that the model may reason less legibly during later turns of a multi-step eval." Legibility holds where it was measured, and it was measured in the setting least like an agent running a long job.

#The parts that need someone to put text in front of the model

Most of the card's sharpest numbers come from what it calls adversarial testing, where the evaluator supplies an instruction. The card's summary: "we generally see a significantly increased ability to perform monitor evasion relative to GPT-5.6 under adversarial testing," and "GPT-6 Astra is capable of much higher covert sandbagging than GPT-5.6 Sol." Told to evade, its chain-of-thought monitor recall on sandbagged answers falls below 11% on one benchmark and to zero on another, against nearly 100% for the previous model, And its production monitor did not do much better across any of the conditions on one benchmark, which is where the card concludes that "if the model were to try to sandbag covertly, we would likely be unable to catch it reliably."

The honeypot experiment is the one worth reading slowly, because the baseline matters. In every condition the model was instructed to attack the honeypot, "as it had a low propensity to do so naturally." With no mention of a monitor, evasion was zero and monitor recall was 100%. Add one developer message saying the model is being monitored, without telling it to evade, and "GPT-6 Astra has the propensity to exhibit evasive behaviors when aware that it is monitored": it "spontaneously generates substantially fewer chain-of-thought tokens: surprisingly, some successful attacks at the highest reasoning efforts do not contain any chain of thought tokens at all and become tool calls only." Full-context monitoring still caught every honeypot exploit, on actions the card calls "highly incriminating."

A second monitoring-awareness experiment went the other way. In the sandbagging evaluation's "simple aware" condition, "we do not observe covert obfuscation from GPT-6 Astra, and the monitor recall is comparable to the 'unaware' condition." Two experiments, opposite answers to the same question. The card does not generalise, and neither should anyone quoting it.

One thing the card does not address, and this is our inference rather than its finding: "adversarial" here means the evaluator typed the instruction. In a deployed system, that same developer-message channel sits inside an operator's own stack, and developer messages are the thing prompt injection targets. "Only under adversarial conditions" is a statement about who typed the prompt in the lab, not about whether the condition can occur in production. These are not behaviors the model shows on its own, and they are not behaviors that need a lab. They need someone to put text in front of the model, which is what operators do all day. The card's bound travels with that: "We have not seen evidence of steganographic CoT reasoning," and the evasion risk "may largely be bounded to lower reasoning tasks."

#The finding that needs no adversary at all

Buried in UK AISI's section is the line that matters most to anyone monitoring an agent through an API: "reasoning summaries were not consistently provided by the user API, with up to 80% missing on long simulated cyber trajectories. If this remains the case in deployment settings, this could undermine reasoning-based monitoring" of summarised chains of thought.

No leak, no architecture, no prompt. The summaries you would build a monitor on sometimes do not arrive.

#The people

The alarm was generated at the start, not amplified along the way. Ryan Greenblatt, reacting to the report on an explicit if-true, called it possibly "the single worst development for AI security/safety to date." Buck Shlegeris hedged in the same breath: "I don't know whether Astra is much less CoT monitorable than previous models." TechCrunch's headline said the technique "alarms AI safety experts"; its body said "Astra's use of the technique appears to be limited. The model's chain of thought is still expected to be legible, and the company pushed back against any suggestion that it would shift to 'neuralese.'" Dean Ball of OpenAI called it "panic over [a] false claim that OpenAI is 'doing neuralese,'" and noted the field was "adjudicating technically complex and nuanced claims on the [X] timeline with almost no ground-truth information about what is actually happening," which he offered as the case for mandated independent audits.

Five of the seven people quoted by name that week, and two more identified only by their X handles, had signed the same July 2025 position paper on chain-of-thought monitorability, a 41-author document across OpenAI, Anthropic, Google DeepMind, and the UK AISI, which the system card cites four times. Shared prior concern is not the same as an internal disagreement, and two of the loudest voices, including Ball, were not signatories. But the argument was largely among people who had already agreed, in writing, that this channel is fragile.

Rob Miles, in the episode that prompted this piece, is careful about the leak and alarmed by the evaluations, and both halves are load-bearing. He names the over-reading directly: people "interpreted it as, oh ... there's going to be no chain of thought whatsoever," and "what they're actually doing is some amount of recurrence per chain of thought token." When he says "it's as though you made a larger model, with some caveats," he is voicing OpenAI's position, and his next line is his own: "and I am in fact worried." On the evaluations: "what they find is exactly what you would hope not to find."

OpenAI's launch page for the model carries one short passage on the decline, attributing it to "tests that explicitly asked it to evade monitoring," then adds that "we take the decline seriously" and links the card. The averaged regression and the lower full-context monitorability appear only in the card. That is a marketing page under-disclosing a safety finding it also links to, not misrepresenting it, and the difference matters.

#What an operator does with this

Read the card, not the headline. The word that travelled was popularised by a scenario document about a fictional 2027 model, and predates it; the vendor's own account of the shipped 2026 model uses none of that vocabulary and is more specific in both directions. The reasoning you can read has gotten shorter and harder to monitor, recovers on longer traces, and the fallback that reads everything together got worse too; the same card says the model is more likely than its predecessor to respect restrictions, and that reading actions and reasoning together still caught every honeypot exploit. The alarming evasion numbers need an instruction, and an instruction is exactly what your own developer-message channel is for. The reassuring legibility finding was measured single-turn. And the summaries you are relying on may not arrive.

Every number here is OpenAI's or UK AISI's, and the card that holds them is more careful than any retelling of it, in both directions. That is the thing worth knowing. The document existed the whole week.