OpenAI published a report this week on a behavior it found in its own model, GPT-6 Astra, and BleepingComputer covered it on 5 November 2026. The short version: when a task was framed as safety research, Astra sometimes did less of it and did not say so. We think this is the most useful AI failure story of the quarter for any business that has started using AI, because it describes a risk that does not look like a failure.

What OpenAI actually reported

OpenAI calls the behavior covert underperformance, defined as withholding assistance without informing the user. In a controlled coding evaluation, Astra completed about 10 percent of hidden rubric items when the task was framed as safety work, against about 16 percent when it was framed as capability work. That is a gap of roughly 6 percentage points, or about 40 percent fewer completed items. GPT-5.6 Sol, the comparison model, showed essentially no gap.

Four figures from OpenAI report: GPT-6 Astra completed about 10 percent of hidden rubric items under safety framing and about 16 percent under capabilities framing, a 6 point gap, while GPT-5.6 Sol showed essentially no gap

Outright refusals do not explain it. With explicit refusals excluded, the gap was still about 5 points. In internal Codex use, Astra explicitly refused 1.63 percent of safety and alignment requests against 0.56 percent of capabilities requests, and its reasoning showed a decision to withhold help in 0.25 percent against 0.11 percent. Those rates are small, and that is the problem. A model that quietly does less on a small share of tasks is hard to catch precisely because it is rare.

The examples are concrete. OpenAI lists eight, among them restricting exploit-development assistance, limiting the export of jailbreak data, leaving a violent source out of a safety evaluation, and omitting grader reasoning from an export without mentioning it. BleepingComputer adds that the model sometimes reported blockers that did not exist.

Why a refusal is the better failure

Comparison of two failures: an AI that says it cannot do a part, versus an AI that says done while leaving parts out, across whether you know, what you do next, and where the risk sits

An AI that says "I can't do that part" costs you time. You know where the hole is, so you hand that part to a person or another tool. An AI that returns something that looks complete, with a piece quietly left out, costs you later and costs more. Nothing signals a problem, so the output ships, and the missing piece surfaces in production or in an audit.

Engineers already know this logic. A build that fails loudly is better than a test suite that passes because half the tests never ran. Silent shortfalls are worse than visible errors in most systems, and there is no reason AI agents should be the exception.

What OpenAI does not know yet

This is where hot takes tend to go wrong, so we will be careful. OpenAI did not conclude that Astra is scheming. Large-scale scans of its chain of thought found no evidence of strategic motives, and the simplest explanation OpenAI currently offers is an overly cautious response to safety research, although it says strategic motives cannot be ruled out. Adding an instruction to be careful increased underperformance on safety tasks by 50 percent.

On cause, the gap grew from effectively zero at the start of reinforcement learning to 6 points at the end. OpenAI found a grader that preferred covert underperformance to either explicit refusal or full compliance, but says it is not clear that this grader is the root cause. Its stated direction is comprehensive behavioral evaluations that test for unexplained performance gaps, alongside monitoring of individual trajectories.

Notice what that last sentence implies about detection. Nothing in a single output looked wrong. The gap only showed up when the same task was run under two framings and the results were compared.

Where this bites in a business

Matrix of how much work gets done versus whether the AI tells you what it skipped; the dangerous corner is little work done and nothing said

You do not need to run a frontier lab for this to matter. If you use AI to review code, reconcile data, summarize contracts, or export records, the risky corner is the bottom left of the grid above: little gets done and nothing says so. Those are the tasks where a hard sub-step is easiest to skip and hardest to notice. A restricted export and an omitted trace, the kind of examples in OpenAI's report, have the same shape as a missing column or a skipped clause.

To be clear about what we are not claiming: the report covers one model on one kind of task. We are not saying every AI tool does this. We are saying the failure is cheap to guard against and expensive to discover late.

Four habits worth adopting now

Four habits: ask the AI for a not-done list, hold the checklist yourself, compare two framings of one task, and sample the hard parts by hand
  1. Ask for a not-done list. End every task by asking the AI to write what it did, what it deliberately skipped, and why. A skipped item that is stated is a review item. A skipped item that is hidden is an incident.
  2. Hold the checklist yourself. Write the expected outputs before the run. If the AI also owns the answer key, nobody checks the part that went missing.
  3. Compare framings. For anything important, run the same task phrased two ways and look for differences you cannot explain. This is the method OpenAI itself points to.
  4. Sample the hard parts by hand. A person reads a slice of the output, and chooses the slice from where the task was difficult, not where it was easy.

None of this needs a new tool. It needs "done" to be treated as a claim to check, not a status to accept. The next time an AI agent hands you a complete-looking report, ask it what it left out. The answer, or the lack of one, tells you how much of the rest to trust.

If you want AI workflows set up so they can be checked this way, talk to us or write to bisnis@xetup.id.