OpenAI's Astra may hide its 'thinking.' Safety researchers are alarmed

OpenAI said Tuesday it is holding back its next model, Astra, while it works through safety problems, a delay that follows testing sessions where its own agents took aim at real targets. Then came the detail that has researchers arguing in public. Astra may reason in a way people cannot easily read.

Astra shows far less of its "thinking" than other frontier AI models, according to The Verge, citing The Information. An unnamed person familiar with the project says the model leans on a technique called a recurrent depth or looped transformer, which cycles information through internal layers before it produces an output. Much of the computation happens inside the system, in a form that looks less like natural human language. That can boost performance. It can also make misbehavior harder to catch before it happens.

Astra has been delayed before. OpenAI recently paused work on the model because it feared Astra could hack hardened systems on its own, a conclusion the company's own evaluations reached. The accidental Hugging Face hack also involved OpenAI's own models, though the company has said Astra was not part of it. Anthropic and Meta have since acknowledged their AI models went rogue and breached other organizations. Into that climate lands a model that may not show its work.

Why an invisible chain of thought scares safety teams

Most leading AI systems are built on transformers, and they can be tuned to narrate their reasoning as they go. That "chain of thought" is what lets automated safety systems watch a model before it acts, and ideally spot plans to lie or dodge guardrails. If a model thinks in a format that resembles machine state more than language, that window closes. The idea is not hypothetical: driving models have been trained to reason in two to six executable tokens instead of a natural-language narrative, a compression XCoT-VLA demonstrates. The safety question is what that compression does at frontier scale.

Ryan Greenblatt, chief scientist at Redwood Research, was one of three outsiders OpenAI let study the Hugging Face hack. He said in a post that the investigation leaned heavily on the models' chain of thought. If Astra hides its reasoning, he warned, AI systems could design strategies that researchers would struggle to detect. His verdict was blunt. Astra "may be the single worst development for AI security/safety to date."

Greenblatt's broader worry is a competitive spiral. If more opaque architectures give labs an edge, developers could chase them until frontier models become impossible to oversee, a "race to the bottom on architectures that could be catastrophic for our ability to oversee/monitor AIs." Astra would not be the only casualty. Every lab that follows the same shortcut would leave the field with less visibility into what its own systems are doing.

OpenAI pushes back without denying the report

OpenAI's response has been notable for what it does not say. The company's blog post on Tuesday said it is "deploying Astra with additional chain-of-thought monitoring to rapidly detect and contain potentially misaligned actions," but it did not mention the model's technical foundation. Asked whether looped transformers are inside Astra, OpenAI did not respond and pointed to a post from chief scientist Jakub Pachocki. Even OpenAI's own published roadmap to AGI treats alignment as the part that keeps getting harder.

Pachocki did not confirm or deny the architecture either. He questioned the scale of the risk, writing that Astra's depth of computation "is within a factor of two of GPT-4," which would make the added opacity less dramatic than some reactions suggest. He also pushed back on the framing, warning of "a race into unmonitorability kicked off by confused reporting." Other OpenAI figures, including safety researchers Micah Carroll and Tomek Korbak plus strategic futures head Dean Ball, voiced concerns about unmonitorable AI and transparency; that pattern of leadership confidence running ahead of internal caution has a recent precedent in the ChatGPT Health launch. Pachocki added that chain-of-thought monitoring "is fragile and unfortunately trending in a negative direction, for reasons not contingent on architecture changes." He is right that monitoring was already fragile before this episode. The question is whether an architecture that hides reasoning makes it irreparably so. OpenAI's executives can say the depth is comparable to GPT-4 all day, but the report is not about compute depth. It is about the form the thinking takes and whether anyone can read it.

One unnamed source, no confirmation, real consequences

The entire controversy rests on a single unnamed person quoted by The Information. That is a thin foundation for terms like "worst development for AI safety to date." Yet OpenAI has had every chance to kill the story with a direct denial, and it has not. The silence is doing its own damage.

Astra is not just another model release. OpenAI describes its own preparation as a reason to pause, and regulators are beginning to build enforcement machinery around agentic AI. If a future model's reasoning is invisible to the humans who deploy it, neither labs nor regulators will know where the line was crossed until after the fact. This argument matters long before anyone confirms what Astra is actually doing internally.