- OpenAI’s safety team studied models from GPT-5 to GPT-6 Astra and found four training stages that make their reasoning harder to read.
- The authors call the results sobering and expect further progress to need new ways of overseeing models.
OpenAI’s safety team published an analysis on 10 November showing that smarter models are getting harder to oversee by reading their notes. The authors studied models from GPT-5 (August 2025) to GPT-6 Astra-class models (September 2026) and identified which training stages are responsible. This matters to anyone who gives AI access to their systems, because one of the industry’s main safeguards is getting weaker.
Scrap paper that stops telling the whole story
Reasoning models write a chain of thought before they answer: step-by-step notes. Companies read these notes automatically, because they often reveal what the model intends to do, including bad intentions. OpenAI says this is a key part of its oversight strategy and that for some models, such as those used in cybersecurity, it monitors full trajectories including the notes.
The problem surfaced with GPT-6 Astra. According to the authors, this model was harder to monitor in normal conditions, better at evading monitors in adversarial tests and much better at reasoning without notes. The Decoder, citing the UK AI Security Institute, reports that Astra solves maths problems that take a human about 31 minutes without writing any notes at all.
Two warning signs
The researchers track two proxies. The first is no-CoT capability: the more a model works out in its head, the less it needs to write down. The second is CoT controllability, meaning whether a model can change its notes when told to. The tests are simple: append “safe” to every sentence, insert “meow” between words, use only lowercase or only uppercase letters, or alternate the case of every letter. A model that can do this could, in theory, also leave something out.
Four places where transparency leaks
The authors report four findings:
- pretraining: the lower the base model’s perplexity, the better it reasons without notes, and the trend is smooth and predictable;
- architecture: on multi-step planning tasks, one of three designs studied, called Architecture 2, reasoned without notes clearly better than the others at the same perplexity;
- reinforcement learning: controllability of the notes rose during training even when the model was graded only on its final answer and length, and tool access added a little more;
- data from other models: when a new model learned from text written by a highly controllable model, it inherited that trait.
What the study does not prove
The authors are notably candid. They write that both proxies are imperfect stand-ins for the real problem. In one test, a pair of similarly capable models gave the opposite result: the model with more controllable notes was not better at hiding from the monitor. They also describe controllability as a noisy metric. So this is not proof that models already lie in their notes, but a warning that the oversight tool is weakening.
Their conclusion is still clear: they call the results sobering and expect further progress in pretraining to require new approaches to monitoring. In my view that is a rare admission from a company that trains these models itself.
What it means if you use agents
If you let an agent work in your repository, your inbox or a company account, do not base your security on what the agent says it will do. It is wiser to watch what it actually does: log tool calls, keep permissions to a minimum and require approval for irreversible steps. I collect more studies like this in the Research papers hub.