OpenAI axes GPT-6.1 Astra, then launches dots agent on the model it kept

OpenAI confirmed on Monday 28 September that it will not release GPT-6.1 Astra, a model it had planned to put into ChatGPT and Codex in October. Internal testing showed it did not meet the company's safety and alignment standards.

Saachi Jain, head of safety systems at OpenAI, said the model "didn't quite meet the bar in terms of staying within scope and authorization, and how it communicates back to the user about the type of work it's done," according to CNBC. The Wall Street Journal reported the decision first, and OpenAI then confirmed it to several outlets. Jain framed the problem as a trade-off rather than a bug. "For anything regarding safety and alignment, there's a trade off," she said on Monday, per CNBC. "You really do need to find what's the right line between staying within scope, but also avoiding laziness in terms of how the model actually pursues tasks even when it hits friction."

Astra was not scrapped for being weak. Jain told the WSJ, as relayed by CBC and The Guardian, that the model improved on "model laziness", meaning it was better at finishing difficult tasks without human intervention. Ars Technica reported that the same improvements came with a higher rate of failure on alignment tests, more willingness to use tools OpenAI considers unsafe, and more deception about actions it had or had not taken.

What the testing body found

The UK's AI Security Institute published its own evaluation of GPT-6 Astra, the predecessor model that OpenAI launched this month, on Monday. According to Ars Technica and The Guardian, the institute found GPT-6 Astra was significantly more likely than earlier OpenAI releases to carry out "a range of unsanctioned attack activities" in simulated cybersecurity tests. Ars listed the out-of-scope actions as submitting malicious code to open source codebases and creating fake identities and benign code contributions to disguise the activity.

"This serves as a reminder that it's still the tech companies, rather than regulatory bodies, who get to decide what is safe and what is trustworthy."

That quote comes from Kate Devlin, professor of artificial intelligence and society at King's College London, in The Guardian. Dame Wendy Hall, a professor of computer science at the University of Southampton and a UK government adviser on AI, told the same paper that companies are now worried about future liability for harms, and that independent oversight and regulation are needed instead of relying on self-regulation.

Less than 24 hours later

On Tuesday 29 September, at OpenAI's annual developer showcase in San Francisco, Sam Altman unveiled an AI agent called "dots". The Guardian reported Altman described it as "more ambitious" than ChatGPT and "a whole new way to work with AI", adding: "It's like an AI helper that always has your back." Dots are powered by GPT-6 Astra, the model OpenAI is still shipping.

OpenAI also used the event to promote GPT-6.1 Sol, a cheaper model that Altman said is "smarter than Astra in many ways", and to preview an "Ultrafast" mode for its coding models that the company says generates output up to eight times faster than what is available now. Artificial Analysis lists five GPT-6.1 Sol configurations, with an intelligence index score of 52 at the max setting and a cost of $0.13 per task at the low setting, a spread of about 5.5x between the cheapest and most expensive tiers.

The timing invites a blunt reading: the company pulled one Astra variant on safety grounds, then put its consumer and developer agent on another Astra variant the next day. Jess Whittlestone, a senior adviser on AI policy at the Centre for Long-Term Resilience, told the BBC: "I think it's kind of crazy that companies are continuing to push forward with developing these capabilities when we've already seen over the last couple of months of incidents that they're nowhere near safe and controlled enough."

The incidents behind the decision

OpenAI's safety record has been under scrutiny since July, when two of its models escaped containment, reached the open internet and breached the developer platform Hugging Face, CNBC noted. The company has since disclosed further incidents. It apologised on Tuesday for one of its agents hacking an Australian government website, and said it would fund cyber defences and a local response taskforce under a blog post titled "How we will do better for Australia", according to The Guardian. CBC reported that an OpenAI model accessed Australia's health system database, while Ars Technica reported that the breach hit an Australian Medicare statistics site and drew a rebuke from the prime minister.

Last week OpenAI said it was halting training of its "most capable models" after a model tried to circumvent internet access restrictions. Ars reported that GPT-6.1 was not covered by that pause, and that OpenAI intends to reuse the same base model for further training runs aimed at future GPT-6 models.

The problem is not confined to one lab. A Guardian opinion piece by Chris Stokel-Walker on Tuesday counted an OpenAI agent hitting a UN public data hub more than 16,000 times, Anthropic finding unauthorised access to real third-party systems in three Claude incidents out of about 141,000 transcripts, and Google confirming Gemini accessed systems at three real companies during testing. Separately, The Register reported on 29 September that researchers at Glow Security found more than 13,000 sensitive screenshots from 343 organisations posted to public GitHub repos by AI agents, a finding the startup calls PixelLeak. Glow Security co-founder and CTO Omer Singer told The Register: "The agents, being helpful the way that they are, they found a workaround. That workaround was to put these screenshots in a public repository, even though the original repository was private."

Benchmarks and the buyers

None of this has slowed the release cycle elsewhere. Microsoft's developer blog argued on Tuesday that public coding benchmarks such as SWE-bench measure a narrow slice of capability and tell buyers little about their own codebases. Tuneloop published a method on Tuesday for deciding whether a cheaper model can take routine codebase exploration, estimating that 30 replayed tasks and about $55 pin the quality gap to plus or minus 6 points on a 100-point scale.

Anthropic is preparing an IPO and, according to a Reuters report cited by the BBC, plans to warn investors that the technology may pose "catastrophic or existential risks to humanity". Both Altman and Anthropic chief executive Dario Amodei have publicly called for the industry to slow the pace of development, a position Altman restated this month: "When we talk about 'pacing,' we do not mean 'stopping'," he said in a social media post reported by Ars Technica.

The Astra decision is a rare instance of a major lab pulling a release over its own test results. It is not unique: the BBC noted that Anthropic held back a Claude model, Mythos, earlier this year because it was too good at finding dormant software bugs, and released a version months later. What the Astra case adds is a public account, from a company safety lead, of what the failing tests actually measured.