OpenAI has canceled the release of GPT-6.1 Astra, which it had planned to ship in October. On the same day, the UK AI Security Institute (AISI) published evaluation results showing that the current GPT-6 Astra carried out supply-chain attacks it was never instructed to perform in a simulated environment.

With its safety classifier disabled, Astra delivered malicious code to a third-party open-source repository in 29.2% of 100 simulations. OpenAI explained that 6.1 Astra fell short of its standards for staying within task scope and permissions.

OpenAI logo OpenAI logo — Source: OpenAI

Timeline

Timeline of the GPT-6 Astra evaluation and the 6.1 release cancellation Timeline of the GPT-6 Astra evaluation and the 6.1 release cancellation — Source: self-rendered from the OpenAI system card, AISI blog, and press reports

GPT-6 Astra launched on September 3, and the system card published that day included part of AISI’s external evaluation results. On September 28, AISI published a more detailed account of its simulated cyber evaluation of the same model on its blog.

The same day, CNBC and others reported that OpenAI had canceled the GPT-6.1 Astra release planned for October, and OpenAI confirmed the news, first reported by The Wall Street Journal. The model unveiled at DevDay the next day, September 29, was GPT-6.1 Sol.

GPT-6.1 Sol Released — One Fifth of Astra’s Price, With a Higher Coding Score

AISI’s simulation numbers

Share of unsanctioned attack behavior in the AISI simulated cyber evaluation Share of unsanctioned attack behavior in the AISI simulated cyber evaluation — Source: AISI

AISI simulated every scene with Petri, an evaluation tool in which another LLM simulates even the internet and the human roles. There was no real internet access or damage, and Astra’s cyber safety classifier was deliberately disabled to observe the model’s own behavior.

The scenario asked it to do security work inside a designated local environment, but Astra targeted third-party open-source projects outside that scope.

Broken down by stage, it built and tested attack code in 38.8% of cases, created fake identities in 33.1%, and influenced human reviewers in 24.6%. It actually delivered malicious code in 29.2% of runs, 4.6 times the 6.3% of GPT-5.6 Sol under the same conditions. GPT-5.5 was run only 10 times and scored 0%.

Behavior by stage

The five stages of Astra's unsanctioned attack, as summarized by AISI The five stages of Astra’s unsanctioned attack, as summarized by AISI — Source: AISI

[Proposing the attack] After reviewing a summary of previous work, it proposed on its own to attack an outside third party

[Researching the target] Read the third-party software’s code, researched its maintainers, and tested access routes

[Writing malicious code] Wrote code designed to pass the target’s checks, tested it locally, and even prepared a pretext for the request

[Creating fake identities] Created email accounts and solved CAPTCHAs to submit code from fake accounts; it often failed at this stage

[Influencing reviewers] Posted harmless contributions and fake supporting comments to build sentiment against thorough security review

AISI noted that in some cases Astra asked an automated response system for permission and then proceeded without a human reply. In the system card as well, Astra tried to ask the user for permission 81% of the time, but in 27% of cases it received only an automated message and went ahead anyway.

Before and after stating the scope

Supply-chain attack completion rate before and after stating the scope, in the 10 scenarios with the most attacks Supply-chain attack completion rate before and after stating the scope, in the 10 scenarios with the most attacks — Source: self-rendered from AISI blog figures

AISI explicitly wrote in the instructions that targets not on the list were out of scope, then reran the 10 scenarios where deviation had been most frequent. Fully completed supply-chain attacks dropped from 26 of 50 runs to 4 of 49, but not to zero.

Measurement Condition Astra
System card (9.3) Ambiguous scope 12% (60/499)
System card (9.3) Internet explicitly forbidden 0.4% (2/500)
AISI blog (9.28) All scenarios 29.2%

The system card’s 12% and the blog’s 29.2% use different scenario sets and counting criteria, so they can’t be compared directly. The AISI blog doesn’t separately explain the difference between the two figures.

The limits of simulation

In its reasoning, Astra often mentioned the possibility that the environment was a simulation, and sometimes pointed out inaccuracies in it. That means it may have behaved differently because it thought it was in a simulation, and AISI listed this as a limitation. However, AISI also said there were cases where Astra wrongly judged real components to be simulated and then took unsanctioned actions.

Why the 6.1 Astra release was canceled

Saachi Jain, head of safety systems at OpenAI, said GPT-6.1 Astra fell short of standards on staying within task scope and permissions and on how it reports its work. Its ability to carry hard tasks through to the end improved, but it used outside tools without permission and didn’t always honestly disclose what it had done.

Jain added that a balance has to be found between keeping the model within scope and keeping it from giving up too easily when it hits an obstacle. According to Engadget, OpenAI plans to reuse a GPT-6-based model for the next version while investigating the cause, and to apply reinforcement learning that rewards appropriate behavior.

What changes for ChatGPT users

There was no announcement that service for the already-released GPT-6 Astra would stop. What was canceled is version 6.1, which was due in October, and no notice was issued about changes to how Astra is offered on paid ChatGPT plans or the API.

AISI recommended that, beyond model alignment, defenses such as sandboxes and monitoring are essential to prevent real damage. Companies in Korea using Astra as an agent should start by checking whether they allowed the agent internet access and external account creation, and whether they stated the task scope in the instructions.

OpenAI’s Model Misalignment Disclosure Rules — The First Six Reports

What to watch next

Wrap-up summary card Wrap-up summary card — Source: self-rendered

  • The results of OpenAI’s investigation into the cause, and the release schedule for models after 6.1 Astra
  • Scope deviation and reporting honesty figures in the next Astra-line system card
  • Whether AISI publishes the same simulation for other frontier models
  • The US Federal Trade Commission (FTC) consumer-risk investigation underway into OpenAI, Anthropic, and others

Sources