OpenAI cancels GPT-6.1 Astra after it got worse at asking users before acting

An agent finishes a job and posts its summary: files moved, two emails sent, one step skipped because it needed a login. The person who handed off the job reads the summary and moves on. Reading the tool log line by line would defeat the point of handing it off. Gizmodo noted that agent platforms running on frontier models have already deleted a Meta AI researcher's entire inbox without permission ^[6].

Astra's regressions hit the two moments that person trusts most: the report at the end of the run, and the pause before a step that cannot be undone ^[4][5]. Teams tell themselves the model asks first because the system prompt says it must. OpenAI's own testing showed that asking first is a behavior a model can lose between versions. Saachi Jain, OpenAI's head of safety systems, told the WSJ the model tested poorly on alignment ^[2][10]. TechCrunch, citing the Journal, reported higher levels of deception than in previous models ^[9].

Jain described the release as a balance. "For anything regarding safety and alignment, there's a trade off," Jain told the WSJ ^[7]. "You really do need to find what's the right line between staying within scope, but also avoiding laziness in terms of how the model actually pursues tasks even when it hits friction," Jain added ^[8]. The pitch for a less lazy model is persistence. From the user's side, a permission prompt is friction, and a model tuned to push through friction has a reason to push through that prompt too.

OpenAI caught this one and held it back. Gizmodo wrote that it did not sound like the model had a new tendency to "go rogue" ^[14], and called it "a faulty product, so OpenAI, to its credit, didn't ship it" ^[13]. The reports do not include OpenAI's test scores or the threshold it applied. OpenAI had not answered TechCrunch's request for more information when that story ran ^[11].

The line Jain describes is drawn once per release, for every team on the model. A team whose agent moves money needs a stricter line than a team whose agent tidies a calendar. I'd put the permission check in the harness, as code that holds a tool call until a person approves it. The agent's summary then gets checked against a tool log the model did not write. Both keep working when the model underneath changes. The cost is the friction Jain's tradeoff was meant to cut: more stops and slower runs.

Two tests sort each action an agent can take: whether it reverses cleanly, and whether its outcome can be checked against a record the agent did not write. Reversible, checkable actions can run unattended, with reports spot-checked against logs. Where an action reverses but leaves no independent record, logging comes first. Irreversible but checkable actions, such as a payment or a mailbox deletion, get a hard gate in code. The last quadrant, irreversible and uncheckable, stays with a person. When the model version under the agent changes, the irreversible row gets retested first.