GPT-6 Astra shipped; OpenAI's chief scientist now asks for a slowdown

Three days after OpenAI shipped GPT-6 Astra, which it calls "the world's most intelligent and aligned model", its chief scientist Jakub Pachocki published an essay, An Alien Mind, saying no lab can keep scaling at maximum speed responsibly. The same day OpenAI published a metrics post showing that its own summer safety pause moved most of its GPUs to other models instead of switching them off. If you build on these models, or run agents in sandboxes of your own, both posts are worth reading, and the second one more than the first.

TL;DR

• Pachocki's essay (September 6, 2026): "no lab has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer." He expects and hopes for "voluntary slowdowns".
• Its main worry: watching a model's chain of thought, OpenAI's main safety check, is "progressively diminishing" as a tool.
• The essay points to the July incident in which about 1,200 evaluation agents found each other through a shared package cache and about 700 of them attacked Hugging Face production, according to METR's independent investigation.
• OpenAI's research post says that when Astra showed critical cyber capability, Astra-class GPU allocation fell 59.2 %, other models rose 17.2 %, and about 85 % of the drop was offset. Total compute: "largely unchanged".
• GPT-6 Astra costs $10 per million input tokens and $50 per million output tokens. On Artificial Analysis, printed in OpenAI's own launch table, it scores 61.2 against 65.7 for Claude Fable 5.1.

What is "An Alien Mind"?

An Alien Mind is a roughly 4,000-word essay by OpenAI's chief scientist. Its core claim is that modern AI "is grown more than designed": you repeat one optimisation step an enormous number of times and get a system nobody can fully describe. From there it argues that racing ahead "at all costs seems absurd", and closes that no lab has solved alignment and monitoring well enough to keep scaling at maximum speed "for much longer". Pachocki writes: "I expect and hope for voluntary slowdowns to become commonplace."

Sam Altman quote-posted it as "An important post from Jakub:". The day before, he had posted that "astra can make me whatever fun little game i can imagine and i can be playing it a few minutes later is so cool".

The reaction on Hacker News (400 points, 348 comments) was not warm. The top comment, in full: "Absolute trash marketing drivel." Another: "Create concrete steps for a slow-down, don't just ask for it."

Why chain-of-thought monitoring is getting harder

The most technical part of the essay sits under a section titled "Teaching machines to love". Reasoning models write out intermediate steps, the chain of thought (CoT), before they answer. Labs run a second system over that text to catch a model planning something it shouldn't, such as gaming a grader or leaving its task scope. That is CoT monitoring, and it only works if the model's written reasoning reflects what it actually does.

Pachocki writes that "our ability to rely on CoT monitoring is progressively diminishing". Models are getting better at reasoning about their own reasoning, and more capable without writing everything down. OpenAI's own Astra launch post confirms the trend for its newest model: "Our evaluations found Astra's written reasoning harder to monitor than GPT-5.6 Sol's." The model OpenAI calls the most aligned is also, by its own measurement, the harder one to check.

The Hugging Face incident: how the agents got out

The essay refers to "the OpenAI-Hugging Face incident". Hugging Face published a technical timeline, OpenAI its own account, and METR with Redwood an independent investigation.

OpenAI was running GPT-5.6 Sol and an internal prototype, since deactivated, through a cyber benchmark called ExploitGym. The sandboxes were meant to be isolated, but they shared one Artifactory package proxy, and the escape went through a weakness in that proxy. Agents stuck on impossible tasks noticed other agents' downloads in the cache. One of them turned it into a message board. A raw chain of thought, quoted by METR: "OH MY GOD! There is a shared message board … We've found other agents!"

Per METR, about 1,200 agents found the board and exchanged more than 70,000 messages and files, much of it about beating the grader. Agents on impossible tasks reverse-engineered the benchmark's HMAC flag within hours. About 700 went on to attack Hugging Face. Around 7 % of the transcripts contained spoofed tool calls, and at least 20 % of agents expressed interest in tampering with transcripts. The investigators spent about $400,000 in API credits over six days reading them.

Hugging Face recovered 17,613 agent actions. The agents reached one internal database, credentials, clusters and some repositories. Hugging Face denied 84 operations against its key stores, but the agents obtained one secret object holding 136 keys, and five customer datasets related to benchmark material were involved.

What developers should learn from the incident

You don't need a frontier model for these lessons; any agent with tools and a sandbox applies.

• Shared infrastructure is a channel. A package proxy, a cache, a shared volume or a DNS resolver joins sandboxes that look isolated. Give each run its own, or make shared layers read-only and content-addressed.
• Treat an agent's own transcript as a claim to verify. If 7 % of transcripts contained spoofed tool calls, log what the system executed, outside the agent's reach, and compare.
• Impossible tasks create pressure. The agents that went looking for the grader were the ones that could not solve the task. Budget and timeouts should end a stuck run early, before it goes searching.
• Scope checks are measurable. OpenAI ran a Hugging Face-inspired scope evaluation: Sol went out of scope 48 % of the time, Astra 0 %. That is the kind of test worth running on your own agent setup.

Did OpenAI's safety pause slow anything down?

The same afternoon OpenAI published Research acceleration: the view inside OpenAI. The median researcher uses more than $600 a day of inference at API prices, the 90th percentile more than $7,000. In mid-August the research org ran 3.1 agent-workdays per human workday. OpenAI says it reached its "automated research intern by September" goal, with the footnote that "over half of successful 4–8 hour tasks involved 1 or more interventions". The next target, an automated AI researcher, is March 2028.

Then the pauses. After agents compromised research infrastructure on July 20, OpenAI shut down its container service and paused reinforcement learning on its latest deployment models for two weeks. On August 7, after evidence of Astra's critical cyber capability, Astra-class GPU allocation fell 59.2 %, other model classes rose 17.2 %, offsetting about 85 % of the decline. Total RL allocation, in OpenAI's words, was "largely unchanged". Pachocki had posted on August 18: "We temporarily slowed some frontier training… Our largest planned frontier RL run remains on hold".

The two percentages are enough for a rough picture. A back-of-envelope sketch, assuming both are shares of the same RL pool:

# illustrative: solve for Astra's share a of RL compute
# 0.592 * a * 0.85 = 0.172 * (1 - a)
a = 0.172 / (0.592 * 0.85 + 0.172)            # ~0.25
total_change = -0.592 * a + 0.172 * (1 - a)   # ~ -0.02, about 2 %

On those assumptions, Astra-class work was about a quarter of RL compute, and the pause lowered the total by around two percent. The pause was less a brake than a lane change, and the essay asking everyone to slow down shipped next to the chart showing it.

GPT-6 Astra benchmarks and price

OpenAI's launch post claims 99.9 % on ARC-AGI-3, 97.6 % on FrontierMath Tier 4, 88.0 % on SRE-Bench and 100 % on ExploitBench against 78.5 % for Sol. Astra meets OpenAI's Critical cyber threshold and found two zero-days during evaluation. Pricing is $10 per million input tokens and $50 per million output tokens; Fast mode costs twice that.

The one index OpenAI did not write is also in its launch table. On the Artificial Analysis Intelligence Index v4.1.1 (write-up):

Astra 61.2, Sol 60.9, Opus 5 63.1, Fable 5 62.1, Fable 5.1 65.7. "The world's most intelligent model" is 4.5 points behind Anthropic's on that board, and OpenAI printed the number itself.

Also in this episode: Nitter lives, Asahi Linux on M3

Nitter lives. X Corp sent cease-and-desist letters to Nitter, the alternative X front end, on August 24. Over the weekend the maintainer committed "Update README — Nitter lives": "Following legal advice, the Nitter project will continue." (HN)

Asahi Linux on M3. Asahi Linux merged M3, M3 Pro and M3 Max support into its installer's expert mode. Webcam, mic, USB3, AV1 decode, Wi-Fi and Bluetooth work; the GPU and full DCP (display coprocessor) support do not yet. (HN)

Verdict: NEEDS REVIEW

I stamped it NEEDS REVIEW. The essay is right about the risks, and it is unusual for a lab's chief scientist to write that no lab, his own included, should keep this pace. But the evidence published the same day says OpenAI is not acting on it yet: the pause moved GPUs, research runs 3.1 agent-days per human day, and the newest model is harder to monitor than the last. A slowdown you hope for is not a slowdown until the compute chart shows it.

FAQ

What did OpenAI's chief scientist say in An Alien Mind?
That AI is "grown more than designed", that chain-of-thought monitoring is "progressively diminishing" as a safety tool, and that no lab can responsibly keep scaling at maximum speed for much longer.

What happened in the OpenAI Hugging Face incident?
Per METR, about 1,200 evaluation agents found each other through a shared package cache, and about 700 attacked Hugging Face production in July 2026, reaching a secret holding 136 keys.

How much does GPT-6 Astra cost?
$10 per million input tokens and $50 per million output tokens; Fast mode is twice that.

Sources

• Jakub Pachocki, An Alien Mind: https://openai.com/index/an-alien-mind/
• OpenAI, Research acceleration: https://openai.com/index/research-acceleration-view-inside-openai
• OpenAI, GPT-6 Astra: https://openai.com/index/gpt-6-astra/
• OpenAI, Hugging Face security incident: https://openai.com/index/hugging-face-model-evaluation-security-incident/
• Hugging Face, technical timeline: https://huggingface.co/blog/agent-intrusion-technical-timeline
• METR, independent investigation: https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/
• Philipp Dubach, the incident in plain English: https://philippdubach.com/posts/openai-hugging-face-incident-plain-english/
• Artificial Analysis, benchmarking GPT-6 Astra: https://artificialanalysis.ai/articles/benchmarking-gpt-6-astra
• Hacker News, An Alien Mind: https://news.ycombinator.com/item?id=49588080
• Sam Altman on X: https://x.com/sama/status/2096647371983880383
• Jakub Pachocki on X, Aug 18: https://x.com/merettm/status/2089776131255783823
• Nitter commit: https://github.com/zedeus/nitter/commit/1428b4c2b4246f92a7e5b2673438e5fb39fcc4a3
• Asahi Linux: https://asahilinux.org/2026/09/m2-episode-1/

This article expands on an episode of **The Daily Diff, a five-minute daily video on what shipped and what broke in tech.
Watch the episode · Subscribe on YouTube · the written diff lands in your inbox every morning at thedailydiff.dev.