OpenAI Says Astra Will Use Chain-of-Thought Monitoring Despite Reported Design Concern

OpenAI says Astra can find previously unknown security flaws and develop exploits against well-protected systems with the right tools and access. The company’s answer to that risk includes production monitoring that checks the model’s reasoning and actions for unauthorized behavior, even as concern grows around reports that Astra may expose less of its reasoning in text.

The tension is important because OpenAI has designated Astra its first model at the Critical cybersecurity capability threshold in its Preparedness Framework. The company says such models need safeguards both against malicious users and against unauthorized actions by the models themselves, and it plans to make Astra available soon with its most advanced cyber capabilities initially limited to a group of testers.

What the reported architecture would change

Reporting cited in a technical discussion described Astra as using recurrent depth, also called a looped transformer, and said the approach may obscure its thinking process. That design claim is distinct from OpenAI’s published account of Astra’s cyber capabilities and safeguards, which says the company is deploying additional chain-of-thought monitoring for Astra-class models.

Sebastian Raschka argues that layer reuse alone does not suppress visible chain-of-thought. His explanation is that repeated passes add computation in a model’s hidden activations before it emits the next token; a model could generate fewer intermediate reasoning tokens if more work happens there, but that outcome is not inherent to the architecture itself.

An old idea with a real compute trade-off

The mechanism is not new. Nanbeige4.2-3B was pretrained from scratch on 28 trillion tokens with a looped transformer that reuses the same 22-layer stack twice. That produces the equivalent of 44 layers of computation without duplicating weights, keeping storage and hosting memory roughly unchanged while requiring nearly twice the compute for the repeated layers.

The design choices behind recursive depth

• Nanbeige’s technical report found two passes gave its best trade-off, retaining about 75% of the token efficiency of a standard architecture.
• More passes produced little additional gain in that work while making training slower and more expensive.
• The Mixture-of-Recursions paper proposed a learned router that can give individual tokens different numbers of recursive passes, allowing easier tokens to exit earlier than harder ones.

Monitoring is part of the release gate

OpenAI says its monitors use classifiers to check reasoning and actions, automatically stopping potentially unauthorized activity. It also warns that these controls can slow, pause, or stop legitimate work, including work that does not appear directly related to cybersecurity; ChatGPT and Codex users may be asked to review an action, while API tasks will stop.

Astra’s stakes extend beyond a terminology dispute. OpenAI says the model can discover unknown vulnerabilities and construct exploit chains; independent coverage says chaining exploits can deliver deeper access than a single flaw permits. The unresolved safety question is whether Astra’s reported implementation includes something beyond layer reuse that materially reduces the reasoning available to the monitors OpenAI says it will deploy.