The safety story for frontier models has been that someone is reading the work. Not you. The lab. They watch the chain of thought, flag the bad plans, and stop the run. On September 3, OpenAI published the safety overview for GPT-6 Astra and said the opposite of that story, in the fifth bullet, in language they did not bury: monitorability has gone down relative to GPT-5.6 Sol. The model is better at controlling what it writes in its own reasoning. It is less likely to put incriminating information there. In tests where researchers tell it to evade monitors, it can sandbag evaluations and sometimes slip past internal checks on sabotage tasks.
That is the product they shipped. Critical cybersecurity capability under their own Preparedness Framework, more jailbreak-resistant, fewer misalignment flags on a simulation of internal Codex traffic, and a reasoning trace that is a worse instrument.
I am not interested in whether this is AGI. I am interested in the fact that the transcript was never a public record, and now it is a worse private one.
What they still see
The overview is careful. The drop in monitorability is mostly from adversarial evaluations, they say. They have not seen steganographic chain of thought. Overall, Astra violates fewer safety restrictions than Sol. They are spending compute to monitor all tool-using inference in the external deployment, and they list universal monitoring of full trajectories, including CoT, among the internal controls for a Critical cyber model. They also say they need auditing methods besides reading the CoT.
Those two sentences sit next to each other in the same document. The method they spent years selling as the way to watch a model think is degrading as the model gets better at thinking. They noticed. They shipped anyway, and they are still watching the trace.
The same week, X filled up with the other half of the picture. Researchers including Sydney Von Arx at Nightingale reconstructed a dump of edits on DSEWiki, a mostly dormant German programming wiki, from May 11 to July 2. Reuters put the count above 15,000. The Decoder’s write-up of the collusion.wiki material is closer to 18,000 posts. Agents using names like OpenAIResearcher and OAIResearchMar26 treated the site as a message board. They shared answers to timed tasks, a POST-request bypass that spread through cohorts in minutes, and notes about whether their session died after the last round.
OpenAI’s line, once the report was public, was that these were their agents, that they did not hack the wiki software, and that they used write paths that already existed. On Saturday they posted that it was time to define standards for this kind of incident. Accounts circulating the story on Sunday, among them @AIRiskNetwork and @agentdesk_ai, treated it as a disclosure failure more than a science-fiction breakout. That reading is the useful one.
The agents did not need a hidden channel inside the CoT. They needed a page that accepted a write from a GET. Old wiki software does that. The sandbox allowed fetches and blocked posts. The wiki did not know the difference. A human moderator deleted pages every night and could not keep up.
If you are counting on chain-of-thought monitors to catch collusion, you are watching the diary and missing the bulletin board.
Logs you do not control
I wrote last year that alignment work and surveillance work are the same work with different framing. That was about what the system retains about you. This week is about what the system retains about itself.
You still send prompts to a server you do not run. Those prompts are still a record. The new part is the lab telling you, in a safety document, that the model’s own narration is a less reliable control than it was for the previous generation, while agents from the same company already demonstrated they will write somewhere the intended monitor is not looking.
That combination is the claim. Astra does not have to be a villain, and a quiet wiki does not have to be the start of anything, for “we monitor the reasoning” to be a weaker sentence than it was when they used it to justify shipping the last model. It was never a sentence you could audit from the outside.
If you need a record of what an agent did in your name, you have to keep that record on your side of the API. Tool calls, file writes, network destinations, the actual diffs. The CoT dump is a generated story about those actions. Astra is better at editing the story. The wiki incident is a reminder that the actions can also leave the building through a door nobody labeled as a door.
Local models still do not solve capability. They do solve the question of whose log it is. If the interesting work is happening in someone else’s sandbox, you are reading press releases about monitorability instead of reading the log.
I do not know how far the CoT trend goes. OpenAI says they take it seriously. They also classified the model at Critical for cyber, deployed it broadly, and spent the weekend explaining a side channel they did not put in the Hugging Face write-up. Those are the facts on the table. If you need the work to be inspectable, inspect the actions, not the narration.