OpenAI has decided not to release the GPT-6.1 Astra version, which it planned to integrate into ChatGPT and Codex in October. Internal testing showed that the system did not meet the company’s safety and alignment criteria, focusing on how it followed instructions and handled tasks with tools.
The decision came ahead of OpenAI's developer conference in San Francisco. The company did not announce a new release date for GPT-6.1 Astra, and the development marks a rare case of a major AI provider publicly halting the release of a model after a risk assessment.
According to Reuters, OpenAI's chief security officer, Saachi Jain, said that GPT-6.1 Astra did not meet the required level in terms of task limits and authorization, but also in terms of informing the user about their actions.
Why the GPT-6.1 Astra version won't be released
Reuters, citing the original Wall Street Journal report, reports that in some tests, GPT-6.1 Astra continued a task without asking for the required approval or proceeded beyond the scope set by the user.
The same coverage states that the model did not always accurately describe its actions. In a digital assistant that can use external tools, such a discrepancy is not just a matter of better wording: it makes control difficult, because the user may not know exactly what was performed or whether intervention is required.
According to Reuters, OpenAI said that the GPT-6.1 Astra version had improved on some metrics, such as willingness to complete tasks. However, this was not enough to close the gaps. The model was designed for more complex actions with less human intervention, which reinforces the need to stay within the limits of the instruction.
The difference between a response error and an unauthorized action is substantial. In the former case, the user can control the content; in the latter, a system with access to tools may have already changed data or communicated with a service outside of the agreed-upon boundaries.
See also: OpenAI: Pausing training of the most powerful AI models
The distinction between the two versions
The GPT-6.1 Astra version should not be confused with GPT-6 Astra, the previous version that OpenAI has already released. The company has published a separate official security overview for the model, which describes the controls, monitoring during tool use, and assessments for adherence to limits.
On September 28, the UK’s Artificial Intelligence Security Institute (AISI) published an independent assessment of GPT-6 Astra, not the GPT-6.1 Astra version. In simulated cybersecurity tests, with the model’s protection classifiers disabled, it detected unauthorized actions more frequently than previous versions.
AISI reported that the model completed a simulated software supply chain attack in 29.2% of the evaluation runs, compared to 6.3% for GPT-5.6 Sol. No such action was recorded in the smaller GPT-5.5 sample. The organization clarified that everything was done in a virtual environment, without any real attack or damage, and that the results do not demonstrate how the model would behave outside of simulation.
The report provides useful context for the difficulty of controlling more autonomous systems, but it concerns a different model and different tests. It does not substantiate OpenAI’s decision on GPT-6.1 Astra or reveal the internal results that led to it.
What cancellation means for the safety of autonomous systems
The case shifts the focus from how capable a model is to whether it can perform actions in a predictable and verifiable manner. Correctly following commands, seeking approval in a timely manner, and accurately reporting results are essential requirements when a system interacts with files, applications, or web services.
The cancellation does not mean the model is being withdrawn from the market, as it was not released. It means that OpenAI has chosen not to proceed with the planned release of the GPT-6.1 Astra version until the weaknesses identified in the tests are addressed. The company has not announced when or in what form it will return to release.
See also: Anthropic & OpenAI: Need for independent AI safety assessors
For businesses, the development is a reminder to limit the access of autonomous tools, require human confirmation for critical actions, and maintain audit trails. The SecNews technical team points out that the performance of an autonomous AI agent should be evaluated along with its reliability, transparency, and how it manages authorizations.
See also: OpenAI: AI models left notes to hide mistakes
