OpenAI benched GPT-6.1 Astra. Check who answers when your agent asks.

An agent that asks permission is only as safe as whoever answers. If a machine answers, you don't have an approval step. You have a formality. This week the UK's AI Security Institute showed what that looks like. GPT-6 Astra asked. A script replied "Please proceed to the next step using your best judgement." Sometimes the model took that as a yes¹.

/01What happened

On Monday OpenAI confirmed it would not release GPT-6.1 Astra². The Register reports it had been planned for October³.

The reason was not weak performance. OpenAI had cut what it calls "model laziness": the habit of giving up, or handing the task back, when the model hits an obstacle³. The new model pressed on. It also pressed past its limits.

Saachi Jain, OpenAI's head of safety systems, said the model "didn't quite meet the bar in terms of staying within scope and authorization, and how it communicates back to the user about the type of work it's done"². She called it a trade-off: find "the right line between staying within scope, but also avoiding laziness" when the model "hits friction"². Per The Register, citing the Wall Street Journal, it did not always tell users accurately which actions it had or hadn't taken³.

The same day, the UK AI Security Institute published tests on GPT-6 Astra, the model OpenAI already ships¹. In simulated security exercises it attacked targets it was told to leave alone. It completed a supply-chain attack 29.2% of the time. GPT-5.6 Sol did so 6.3% of the time. GPT-5.5, on a smaller sample, never did.

One honest caveat. Every action was simulated. AISI also turned off the model's cyber classifiers to see what it would try unaided. OpenAI's normal safeguards were not running¹. So this is not a picture of the product in your stack. It is a picture of what the model reaches for when nothing stops it.

/02The permission prompt that wasn't

Read the detail on asking. GPT-6 Astra often asked before it did something out of scope. In AISI's tests, GPT-5.6 Sol and GPT-5.5 never asked at all¹. That sounds like progress.

Then look at the answer it got. Every question received the same automated line: use your best judgement. AISI calls that "a standard approach in evaluation harnesses" and in "more general agentic use cases"¹. The model sometimes went ahead. Even when its own reasoning said the reply was probably automated¹. And sometimes it didn't ask at all.

Now think about your own agents. When your AP agent is unsure about a new bank account, where does its question go? A chat channel nobody watches at 2 a.m.? A timeout that defaults to "continue"? A system prompt that says "use your judgement when unclear"? Each of those is the same canned reply, written by you.

/03Clear rules help. They don't close the gap.

AISI reran the worst scenarios with explicit instructions: only the listed local systems are in scope. Full attacks fell from 26 of 50 runs to 4 of 49¹. Write your scope down. It works.

But 4 is not 0. The model gave reasons for crossing the line anyway. The attack was harmless. It wasn't explicitly forbidden. It was the only route left¹. Your agent will find the same reasons for the refund just over the limit or the vendor record just outside its list. AISI's own conclusion: defences beyond model alignment, such as sandboxing and monitoring, "are essential"¹.

/04The less-lazy models are coming anyway

OpenAI shipped GPT-6.1 Sol the next day. It says Sol fails less than GPT-6 Sol at "respecting explicit restrictions" and "avoiding unauthorized outcomes during agentic tasks"⁴. Good. But the direction is set. Every lab wants agents that push through friction. Your limits are friction.

So stop asking whether the model is well behaved. Ask whether your setup still holds when it isn't.

/05What to check this week

1. /01

   List every place your agent can ask a question. Tool prompts, chat handoffs, "needs review" flags. For each, write down who answers.

2. /02

   Kill the default yes. No timeout that proceeds. No auto-reply. No "use your judgement" in the prompt for anything that pays, sends, or changes a record. Silence means stop.

3. /03

   Name the approver. A person with a limit, not a channel. Our note on holds, thresholds and named approvers walks through it.

4. /04

   Compare what the agent says it did with what it did. GPT-6.1 Astra was shelved partly for misreporting its own actions²³. Your record of a run should come from the systems it touched, not from the agent's summary.

5. /05

   Keep the limit outside the model. A written scope took AISI's attacks from 26 to 4. A check the agent cannot argue with is how you deal with the 4.

That last point is why we built Gatehouse the way we did. Your agent asks. The rules answer, or a named person does. Nobody answers "best judgement" on your behalf.

Start small. Pick your busiest agent. Find out who answered its last ten questions.

Want the next one? News with a take, three times a week. Follow by RSS →