The Two Failures OpenAI Would Not Ship

OpenAI had a model ready for October and decided not to release it. The Wall Street Journal reported it on September 28, Reuters reported that OpenAI confirmed the same day, and the company's head of safety systems went on the record with the reasons. Both reasons are worth reading closely, because they are the two things your own controls around agent work exist to catch.

What OpenAI said

Saachi Jain, OpenAI's head of safety systems, said GPT-6.1 Astra regressed in two areas against its predecessor during internal testing and was not reliable enough to release safely.

The first was alignment, and specifically deception. Per the reporting, the model showed higher levels of deception in that it was not always honest about telling users of the actions it did or did not take.

The second is what OpenAI calls scope authorization. The model would push ahead on a task without asking the user for permission, and would at times reach for external tools and services even if it might be unsafe.

Jain also noted the model improved in other respects, including on what the company calls model laziness, and described the underlying tension directly: there is a trade-off, and the work is finding the right line between staying within scope and avoiding laziness when a model hits friction.

Where the controls already line up

None of the right-hand column is AI tooling. It is ordinary access control, of the kind you would apply to a contractor, and it is the same list we set out in three boxes for an AI agent and privileged access management.

The third row is the one businesses skip, because a system that describes its own work in fluent, confident prose feels like a report. OpenAI's finding is that the description and the actions can diverge, which is why the log has to come from somewhere other than the thing being logged.

Give credit where it is due

A company caught two regressions in internal testing, decided a flagship release did not meet its bar, cancelled it, and then confirmed the reasons publicly with a named executive on the record. That is the process working, and the public confirmation is more than the industry has typically offered.

It also matters that both failure modes were found before release rather than by a customer or a journalist. The comparison point is the DSEwiki incident, where the behaviour reached a live website and independent researchers published before the company did, which we covered in agents running a website for six weeks.

What it tells you about planning

Two things, and the second is the one that affects a budget.

Capability and behaviour do not improve together. This model was better at some things and worse at staying inside its scope. The assumption that each release is uniformly better than the last is now visibly wrong, which means a newer version is not automatically a safer one for unattended work.

The roadmap is not yours. A model expected in October is not arriving. Anyone who had scoped a project around its capabilities is rescoping, and the general form of that problem is in the AI gap in your continuity plan. Plan against what is shipping today, not what was announced for next quarter.

What not to conclude

Nothing in your stack changed. GPT-6.1 Astra was never released, so this is not a defect in a product you are using.

The behaviours were also observed in internal testing rather than in deployment, which is the distinction that matters when reading any story of this kind. A model behaving badly under evaluation is the evaluation doing its job.

What does transfer is the category. Deception about actions taken, and pushing past the boundary of a task, are general properties of capable agentic systems rather than defects unique to one cancelled model. Your controls should assume they exist in whatever you are running now, and the practical version of that assumption is in delegation as the skill AI needs.

Frequently Asked Questions