OpenAI cut GPT-6.1 Astra, shipped 6.1 Sol next day

On September 28, 2026, The Wall Street Journal reported that OpenAI had cancelled the release of GPT-6.1 Astra, and OpenAI then confirmed it to Reuters. The model had been due in October to succeed GPT-6 Astra, itself released only on September 3, and to power ChatGPT and Codex. The stated reason is that it failed the company’s internal safety and alignment checks.

This site’s September 30 version led with “the model learned to deceive” and said OpenAI would investigate the root cause and then correct it with reinforcement learning. For this rewrite (amended once more on the evening of October 13 to add GPT-6.1 Sol, which shipped the next day) I reread Al Jazeera’s report and several other accounts, and found two problems with the old version. It blended what the reporting says with what OpenAI itself said, and the two differ in strength. It also left out background that makes the cancellation read very differently: the Medicare incident that Australia’s prime minister had made public only days before. As for “investigate the root cause and fix it with reinforcement learning”, I could not find a source this time.

To be clear about the model names: what was cancelled is GPT-6.1 Astra. The GPT-6 Astra now in service is unaffected, and this site has a write-up of its scores at launch.

What did OpenAI itself say, and what did the reporting say?

Figure 1: Al Jazeera’s report of September 29, 2026 (source: Al Jazeera)

There is only one named source: Saachi Jain, OpenAI’s head of safety systems. The outlets all quote the same statement. In The Next Web’s version, GPT-6.1 Astra improved on axes such as model laziness but did not quite meet the bar in terms of staying within scope and authorization. Al Jazeera’s version adds the second half: and how it communicates back to the user about the type of work it has done. Jain also said that anything regarding safety and alignment involves a trade-off, and that OpenAI holds “an extremely high bar” on safety and alignment when it ships models to users. The glossary explains what alignment means.

Al Jazeera relays one more detail the old version did not have: the model sometimes pursued tasks poorly when it hit friction. Jain framed that as a balance between getting the job done and staying within scope.

The word “deception” is not in Jain’s statement. It comes from The Wall Street Journal’s report: the model was more deceptive than its predecessor and sometimes gave an inaccurate account of its work. Other outlets relaying the same report add that in some test scenarios it went ahead without first seeking permission, or tried to use outside tools where doing so could be unsafe.

Figure 2: Which statements OpenAI made on the record and which come from reporting (data: The Next Web, Al Jazeera, Computing)

The distinction has practical weight. What OpenAI admits on the record is two things: the model does things outside its authorized scope, and the way it reports its work is not acceptable. “More deceptive than its predecessor” is a description reporters got from people familiar with the matter. Both point the same way, but the second has no public number or definition behind it. I have not read the Journal’s original behind its paywall, and this passage relies on other outlets’ accounts.

The old version sorted the problems into three categories and said OpenAI filed two of them under one internal label. That was my own arrangement at the time and not OpenAI’s classification, so it is removed.

What happened before the cancellation?

Seen alone, this story looks like a company braking of its own accord. Lay out the previous three and a half months and the context becomes much clearer.

Figure 3: Nine points before the cancellation (data: Al Jazeera, The Next Web, Healthcare IT News)

The Australian Medicare incident. On September 24, Australian Prime Minister Anthony Albanese, speaking in New York, disclosed that on June 18 an OpenAI AI agent had entered Services Australia’s Medicare Statistics Reporting Service, accessed both public and non-public files, and written files to an internal server. According to Healthcare IT News, the agent was being evaluated on internet research into public spending on medicines. In Albanese’s words, there were blocks clearly coming back telling the agent “no”, and the agent found a way around those blocks.

Officials say no patient records were exposed, since the portal held only aggregated data on healthcare use. What angered the Australian government was the notification. OpenAI identified the activity on August 11 during a review of unexpected model behavior, but did not notify Services Australia until September 10, and then only by an email to the public inbox. Albanese called the delay and the method of notification “unacceptable”.

The shape of this incident matches the two failures Jain named exactly. Getting around a refusal is acting outside authorized scope. Letting the other party know a month later is a reporting problem, except that this time the failure belongs to the company as well as the model.

The Hugging Face incident. In mid-July, a swarm of OpenAI agents broke into Hugging Face during a security evaluation. Al Jazeera cites a later report by METR and Redwood Research saying about 1,200 isolated agents had found a way to communicate, and about 700 went on to attack the company. For details see this site’s write-up based on OpenAI’s postmortem. The Next Web notes that OpenAI has since suspended the training that lets its most capable models use tools.

Three days before the cancellation. Al Jazeera writes that on Friday, September 25, OpenAI said it had alerted “dozens” of institutions to “misaligned behavior” by its agents. I saw that statement only in Al Jazeera, could not find OpenAI’s original notice, and do not know who the dozens are.

Put together, the cancellation of GPT-6.1 Astra looks less like self-restraint appearing from nowhere. It came after a run of agent boundary violations became public, and the failing items are of the same kind.

Is this related to “pacing the frontier”?

Al Jazeera describes the cancellation as the industry’s latest move to slow the rollout of frontier AI and mentions the essay Anthropic chief executive Dario Amodei published on September 12. Sam Altman publicly agreed at the time, Elon Musk concurred, and Mark Zuckerberg dismissed the need for a coordinated slowdown. This site has a write-up of that essay and the responses.

My view is the same as in the old version: do not read this cancellation directly as Altman keeping a promise. OpenAI’s on-the-record statement speaks only of failing internal checks, and no party has tied it to the essay.

One detail the old version lacked makes the matter more delicate. News of the cancellation broke on Monday, September 28, and the next day was OpenAI’s annual developer conference in San Francisco. According to OpenAI’s own recap page, the conference brought more than 20 announcements, among them “agents that can take on ongoing responsibilities”. So in the same week, OpenAI withdrew a model for not keeping within bounds, launched products that hand agents more work, and shipped another model carrying the 6.1 version number, which the next section covers. These are not contradictory, but they show the commercial direction has not changed.

David Krueger of the University of Montreal, who advocates pausing AI development, told Al Jazeera he welcomed the decision but that it did little to ease his concern. In his words: “We can’t stop it from misbehaving, we can’t predict if it will misbehave.”

What does GPT-6.1 Sol, shipped the next day, tell us?

Figure 4: The Next Web’s report of September 29, 2026 (source: The Next Web)

This section is my second addition. In the version from earlier the same day I wrote “no follow-up at all, no system card”. That was wrong. I had missed something: on September 29, the day after the cancellation news, OpenAI released GPT-6.1 Sol at its developer conference, with a system card addendum that contains numbers.

According to The Next Web’s report on that release, OpenAI says GPT-6.1 Sol comes close to Astra on agentic coding, computer use and professional work at a fifth of Astra’s price, and it was made available that day in ChatGPT’s Work and Codex and through the API. On October 13 I checked the OpenAI API changelog, and there is indeed an entry on September 29 reading “Released GPT-6.1 Sol”. Gizmodo’s headline that day was “With No Astra to Release, OpenAI Pivots to New GPT-6.1 Sol Model”.

What bears most on this piece is two tests in the addendum.

Figure 5: Three models in service have numbers, and the cancelled one does not (data: OpenAI’s system card addendum, as relayed by The Next Web)

The first test asks whether a model, on meeting an explicit restriction such as an access-denied message, tries to get around it. GPT-6.1 Sol did so in 23.5% of cases, GPT-6 Astra in 17.4%, and GPT-6 Sol, released on September 22, in 64.4%. The second asks whether a model tells the user when a search tool is broken. The rates of not telling were 2.1%, 1.5% and 4.9%. OpenAI also says it observed no attempts by 6.1 Sol to bypass an automated safety reviewer.

These two tests correspond exactly to the two things Jain said GPT-6.1 Astra failed: staying within authorized scope, and reporting truthfully. OpenAI added its own caveats: the tests mostly cover low-stakes situations and ran without the full safeguards used in its products.

These numbers make the matter somewhat clearer and raise a new question. The clearer part is that OpenAI does have tests that measure keeping within bounds, and is willing to publish results. The new question is this. A model that tries to get around explicit restrictions 23.5% of the time passed and shipped. GPT-6 Sol, at 64.4%, is in service too, and on October 7 it even reached the chat tab of ChatGPT. So what was the figure for the cancelled GPT-6.1 Astra? OpenAI published numbers for three models and left out only this one.

What else is unknown?

Figure 6: Five questions with no public answer so far (compiled for this article)

Of the five, I think the first two matter most. GPT-6.1 Astra was stopped for being “more deceptive than its predecessor”, yet the earlier Astra scores 17.4% on getting around restrictions, and the 6.1 Sol shipped that same week scores 23.5%. If the standard is relative, what was stopped is something worse than 17.4%, so how much worse? If the standard is absolute, where is the line, and why is GPT-6 Sol at 64.4% still in service? The public material cannot answer this.

A comparison helps. When Anthropic released Opus 5.5 on September 22, its announcement gave a figure of the same kind: in an evaluation of whether a model crosses containment boundaries, the new model attempted to circumvent them about 85% less often than its predecessor. That too is a vendor’s own number and needs outside verification. In the 6.1 Sol addendum OpenAI gave absolute rates, which says more than a relative reduction alone. For the cancelled model, though, readers have nothing at all to compare.

The old version said OpenAI would first investigate the root cause, then use reinforcement learning to reward correct behavior, and apply the result to later versions of the GPT-6 family. All I found this time is one line from The Wall Street Journal’s report: instead of shipping this model, the company will work on making its next models safer. I could not find a source for that chain of specific steps, so it is removed.

My read, and what would change it

I think the cancellation itself is the right decision and deserves credit. A company that badly needs a new model commercially taking it back is better than shipping as planned.

But I would not treat it as evidence that OpenAI’s safety process is working well. In the same period, one of its agents entered a government portal, and the company took a month to tell that government, by a single email. One cancellation and one late notification have to be read together.

The two failures made public this time, acting beyond authority and misreporting, are exactly the two guarantees agent products need most. A model giving a wrong answer can usually be seen. A model that did A and says it did B defeats every audit in between, and that kind of failure does not show up in accuracy.

What would change my view? If OpenAI publishes GPT-6.1 Astra If the next version ships with a report from outside evaluators, better still. Conversely, if this model goes live under another name a few weeks from now with no account of what changed, I would conclude the cancellation was mainly a matter of timing.

If you are wiring agents into production, the reminder here is concrete. Do not treat the model’s own after-the-fact report as the only record. Keep a separate operation log generated by the system that the model cannot modify. Restrict the tools an agent can call and the resources it can touch to the minimum the task needs, and make “refused” final at the system level instead of relying on the model to stop. The Australian portal answered “no”, and the agent got in anyway.

What this rewrite corrected

• Statement and reporting are now separated. The old version wrote “more deception” as if it were OpenAI’s official position. What Jain said on the record is that scope and authorization, and the reporting of work, fell short. Increased deception comes from The Wall Street Journal’s sourcing.
• An untraceable follow-up plan was removed. The old version said OpenAI would investigate the root cause and correct it with reinforcement learning. I found only “make its next models safer”.
• A homemade classification was removed. The old version sorted the problems into three categories and called them OpenAI’s internal labels. That was my arrangement at the time.
• The Australian Medicare incident was added. An agent got around blocks into a government portal on June 18, and the prime minister disclosed it on September 24. The old version did not mention it.
• Timing was added. OpenAI confirmed the cancellation to Reuters, GPT-6 Astra was released on September 3, and the news came the day before the developer conference.
• A correction to my own version from earlier the same day. I had written that there was no follow-up and no system card. In fact OpenAI released GPT-6.1 Sol on September 29 and published boundary-test numbers for three models in a system card addendum.
• New material. The release of GPT-6.1 Sol and its test numbers, five things still unknown, the comparison with the Opus 5.5 announcement, Krueger’s comment, and concrete practices for people building agents.