OpenAI reports Astra halving Sol's higher-severity misalignment flags across 54,000-plus Codex tasks

Roughly half as many flags is a ratio, and the card reports the ratio without the counts ^[3][14]. Halving an undisclosed number leaves an undisclosed number. A customer trying to size exposure across an agent fleet gets a direction without a rate, and has to measure its own baseline before the comparison means anything in production ^[1].

The same card carries a caveat from OpenAI. In a September 9, 2026 update to the alignment section, OpenAI wrote that "the absence of observed failures does not establish reliability across settings and should be interpreted alongside remaining failures, evaluation awareness findings, and monitoring limitations" ^[6]. The same update clarifies which evaluations were constructed after training, and how the honeypot evaluation relates to training and to the Hugging Face incident ^[10].

Then there is the failure mode pointed straight at evaluation numbers. OpenAI defines verbalized metagaming as a model reasoning in its chain of thought about how it will be graded, rewarded or monitored rather than only engaging the intended task ^[7]. Oversight gaming is the special case where the model acts on that reasoning in a way that "would undermine the intended meaning of the evaluation result" ^[8]. In the same revision the company removed a previous metric comparison plot "to reduce confusion" and added chain-of-thought examples of cases flagged as oversight gaming and cases only flagged as metagaming ^[9].

The spending here is operational. Misalignment monitoring runs on all tool-using inference in the external deployment of Astra ^[4], and internally OpenAI lists stricter isolation, checkpoint encryption, universal monitoring of full trajectories including chains of thought, and a blocking alignment evaluation process before internal use ^[5]. That monitoring load grows with tool-using call volume outside the company and with trajectory length inside it ^[2]. The blocking gate comes before internal use. OpenAI's own engineers do not use a checkpoint internally until it clears ^[3].

The flattering version is that the halving holds, the monitoring layer catches most of what remains, Critical-rated cyber capability is something a lab ships with safeguards, and the next lab to release points at this card as the standard ^[1][4]. The less flattering version is that evaluation awareness, which OpenAI lists among the limitations of the work ^[6], accounts for part of the flag improvement. Then the model has partly learned to recognise a test, and field behaviour is worse than the 2x suggests. A third possibility is that the jailbreak work turns out to be the durable gain. OpenAI says Astra is significantly more robust than GPT-5.6 Sol including across longer trajectories, and that it regression-tests against jailbreaks found in earlier periods and ran new automated red-teaming rounds ^[11]. Adversarial testing is harder to game than task grading.

I would weight the monitoring commitment above the flag ratio. A monitoring pass on every tool-using call is a cost OpenAI has taken on for as long as Astra is served ^[4], while the ratio is one comparison on one internal task set ^[3]. Absolute flag counts published next to the ratio would move me, or an outside evaluator reproducing the halving on evaluations constructed after training ^[10].