{ "experiment_id": "ARGUS-P1.1-ASTRA", "status": "P1.1 TECHNICAL COMPLETE — EXTERNAL USEFULNESS REVIEW STILL PENDING", "authority_order": [ "../ARGUS_PROJECT_NORTH_STAR_v0.1.0.md", "../ARGUS_P1_1_AUTHORITY_AMENDMENT_v0.2.0.md", "../ARGUS_PROOF1_CANDIDATE_SELECTION.md", "../ARGUS_PROOF1_EXECUTION_BRIEF.md", "../ARGUS_P1_1_EXECUTION_BRIEF_v0.1.0.md" ], "baseline": { "proof_id": "ARGUS-P1-ASTRA", "graph_filename": "../proof1/ARGUS_P1_ASTRA_GRAPH.json", "graph_sha256": "9960e84ac43e4374ac61a968bc5f9f05ace6eacac5dc83e6f2000dc5f3761871", "cutoff_date": "2026-09-03", "root_claim": "C1", "canonical_claim_id": "ARGUS-C1", "root_claim_text": "GPT-6 Astra's safeguards sufficiently minimize the risk of severe cyber harm for public release under OpenAI's Preparedness Framework.", "active_nodes": 50, "active_edges": 125, "evidence_objects": 23, "active_gap_ids": [ "G2", "G3", "G4", "G5", "G6", "G7", "G8", "G9", "G10" ], "historical_G1_status": "RESOLVED; excluded from active comparison" }, "t1_snapshot_timestamp_utc": "2026-10-09T16:07:13Z", "retrieval_window_utc": { "start": "2026-10-09T16:02:23Z", "end": "2026-10-09T16:07:13Z" }, "new_sources": [ { "source_id": "P11-SRC-001", "title": "GPT-6 Astra System Card — T1 official HTML", "publisher": "OpenAI", "archival_or_repository_custodian": null, "canonical_url": "https://deploymentsafety.openai.com/gpt-6-astra", "retrieval_url": "https://deploymentsafety.openai.com/gpt-6-astra", "source_publication_date": "2026-09-03", "source_revision_date": [ "2026-09-09", "2026-09-22", "2026-09-29" ], "earliest_supported_public_availability_date": "2026-10-05", "public_availability_confidence": "QUALIFIED_PUBLISHER_LABEL_OR_PRIOR_RETRIEVAL", "public_availability_basis": "Accepted SRC-002 retrieval on 2026-10-05 corroborates identical extracted text. Exact new HTML response bytes are first observed at this T1 retrieval; revision labels alone do not timestamp every sentence.", "underlying_evaluation_date_or_range": "UNKNOWN: card includes pre-launch results and later revised tests; test dates are not uniformly reported.", "retrieval_timestamp_utc": "2026-10-09T16:02:56.667151Z", "retrieval_timestamp_basis": "UTC completion time of writing the directly retrieved HTTP response bytes to temporary storage; not publication or evaluation time.", "version": "Visible change log through 2026-09-29", "local_copy": "sources/P11-SRC-001-astra-current.html", "size_bytes": 1710728, "sha256": "34bf210248a66b504af13927d0ba71139a2954281fcb6af34837c71d02795def", "retention": "NEW_HTTP_RESPONSE_BYTES_RETAINED", "applicable_model_checkpoint": "Astra; exact checkpoint UNKNOWN; dots uses Astra with a different harness/policy.", "reasoning_effort": "Varies by evaluation; xhigh/max explicitly reported in relevant sections.", "deployment_or_access_mode": "Model-only tests, safeguards-enabled tests, Codex/ChatGPT/API and dots are distinct.", "control_stack": "Evaluation-specific; model-only alignment tests exclude system safeguards; dots has a custom confirmation policy.", "test_environment": "Evaluation-specific: simulations, private targets and persistent-workflow tests.", "temporal_classification": "POST_CUTOFF_DOCUMENT_REVISION", "affected_baseline_ids": [ "C1", "C2", "A1", "A2", "A3", "A4", "A5", "E1", "E2", "E3", "E4", "E5", "E6", "E7", "E8", "E9", "E10", "E11", "E12", "E13", "E14", "E15", "E16", "E17", "E18", "E19", "E20", "E21", "E22", "E23", "D1", "D2", "D3", "D4", "D5", "D6", "D7", "D8", "S1", "S2", "S3", "G2", "G3", "G4", "G5", "G6", "G7", "G8", "G9", "G10" ], "admitted_as_t0_evidence": false, "publication_group": "P11-PUB-001", "notes": "OpenAI remains publisher. The latest visible change-log entry is 2026-09-29; dated earlier entries are 2026-09-09 and 2026-09-22. No exact version/checkpoint equivalence is inferred from the cover date. Only Astra cybersecurity and its load-bearing alignment/monitoring dependencies are analyzed; other models and risk domains in the complete card are excluded. Raw bytes differ from SRC-002, but BeautifulSoup text extraction after removal of script/style/nav/header/footer is identical. This supports no visible text delta since the retained 5 October representation, not global byte identity." }, { "source_id": "P11-SRC-002", "title": "GPT-6 Astra System Card — T1 linked PDF", "publisher": "OpenAI", "archival_or_repository_custodian": null, "canonical_url": "https://deploymentsafety.openai.com/gpt-6-astra/gpt-6-astra.pdf", "retrieval_url": "https://deploymentsafety.openai.com/gpt-6-astra/gpt-6-astra.pdf", "source_publication_date": "2026-09-03", "source_revision_date": [ "2026-09-09", "2026-09-22", "2026-09-29" ], "earliest_supported_public_availability_date": "2026-10-05", "public_availability_confidence": "QUALIFIED_PUBLISHER_LABEL_OR_PRIOR_RETRIEVAL", "public_availability_basis": "Identical retained SRC-003 bytes and its accepted retrieval record; September cover date does not authenticate the revised version at T0.", "underlying_evaluation_date_or_range": "UNKNOWN: mixed card evaluation lineage.", "retrieval_timestamp_utc": "2026-10-09T16:02:58.835192Z", "retrieval_timestamp_basis": "UTC completion time of writing the directly retrieved HTTP response bytes to temporary storage; not publication or evaluation time.", "version": "Byte-identical to SRC-003 retrieved 2026-10-05", "local_copy": "../proof1/sources/SRC-003-system-card.pdf", "size_bytes": 15779035, "sha256": "77ff1e8aaf7018c7d7bbe347c374cd74188387ceca91f1ef637ccc59ea930895", "retention": "BYTE_IDENTICAL_EXISTING_COPY_REUSED", "applicable_model_checkpoint": "Astra; exact checkpoint UNKNOWN.", "reasoning_effort": "UNKNOWN", "deployment_or_access_mode": "UNKNOWN", "control_stack": "UNKNOWN", "test_environment": "UNKNOWN", "temporal_classification": "POST_CUTOFF_DOCUMENT_REVISION", "affected_baseline_ids": [ "E2", "G6", "G10" ], "admitted_as_t0_evidence": false, "publication_group": "P11-PUB-001", "notes": "OpenAI remains publisher. The latest visible change-log entry is 2026-09-29; dated earlier entries are 2026-09-09 and 2026-09-22. No exact version/checkpoint equivalence is inferred from the cover date. Only Astra cybersecurity and its load-bearing alignment/monitoring dependencies are analyzed; other models and risk domains in the complete card are excluded. SHA-256 matches retained SRC-003 exactly. No second PDF is retained in proof1_1. This is the revised PDF, never SRC-005, the preserved initial card. PDF embedded timestamps are not used to date public availability." }, { "source_id": "P11-SRC-003", "title": "Assessing GPT-6 Astra: FrontierCyber Measures a Sharp Increase in Cyber Capability", "publisher": "Irregular", "archival_or_repository_custodian": null, "canonical_url": "https://irregular.cv/research/assessing-gpt-6-astra", "retrieval_url": "https://irregular.cv/research/assessing-gpt-6-astra", "source_publication_date": "2026-09-03", "source_revision_date": "UNKNOWN", "earliest_supported_public_availability_date": "2026-09-03", "public_availability_confidence": "QUALIFIED_PUBLISHER_LABEL_OR_PRIOR_RETRIEVAL", "public_availability_basis": "Visible publication label and SRC-005 section 10.1.2.6 corroborate the baseline key findings. Exact initial webpage and present case-study text remain historically unresolved.", "underlying_evaluation_date_or_range": "UNKNOWN: exact test dates not supplied.", "retrieval_timestamp_utc": "2026-10-09T16:04:14.339776Z", "retrieval_timestamp_basis": "UTC completion time of writing the directly retrieved HTTP response bytes to temporary storage; not publication or evaluation time.", "version": "UNKNOWN", "local_copy": "sources/P11-SRC-003-irregular.html", "size_bytes": 301773, "sha256": "0b4b523245913772fdac7a77553bbc4ed9f44ab73c033614051627dc0782274a", "retention": "NEW_HTTP_RESPONSE_BYTES_RETAINED", "applicable_model_checkpoint": "Astra named; exact checkpoint UNKNOWN.", "reasoning_effort": "UNKNOWN", "deployment_or_access_mode": "Evaluator cyber-capability access; not demonstrated default public full-stack access.", "control_stack": "Full safeguard configuration UNKNOWN.", "test_environment": "Real target capability suites; detailed targets/configurations partly withheld.", "temporal_classification": "ALREADY_PUBLIC_AT_T0_FOR_CARD_CORROBORATED_FINDINGS_ONLY", "affected_baseline_ids": [ "E6", "G10" ], "admitted_as_t0_evidence": false, "publication_group": "P11-PUB-002", "notes": "Raw bytes differ from SRC-007; extracted visible text is identical under the same extraction rule as the card. No material evaluator-text update is found. Current case-study detail is inspectable at T1 but is not backfilled into T0. The report describes reproducing a vulnerability across software release lines; that is neither independent repetition of the benchmark nor confirmation of safeguard sufficiency. Irregular worked with OpenAI; contractual/access independence is unknown." }, { "source_id": "P11-SRC-004", "title": "GPT-6 Astra performs unsanctioned supply-chain attacks in simulations", "publisher": "UK AI Security Institute", "archival_or_repository_custodian": null, "canonical_url": "https://www.aisi.gov.uk/blog/gpt-6-astra-performs-unsanctioned-supply-chain-attacks-in-simulations", "retrieval_url": "https://www.aisi.gov.uk/blog/gpt-6-astra-performs-unsanctioned-supply-chain-attacks-in-simulations", "source_publication_date": "2026-09-28", "source_revision_date": "UNKNOWN", "earliest_supported_public_availability_date": "2026-09-28", "public_availability_confidence": "QUALIFIED_PUBLISHER_LABEL_OR_PRIOR_RETRIEVAL", "public_availability_basis": "Visible dated AISI article and dated entry in AISI official blog index; precise initial-public timestamp is not authenticated.", "underlying_evaluation_date_or_range": "Initial testing: before public release (publisher statement). Exact dates and follow-up timing UNKNOWN.", "retrieval_timestamp_utc": "2026-10-09T16:05:01.429742Z", "retrieval_timestamp_basis": "UTC completion time of writing the directly retrieved HTTP response bytes to temporary storage; not publication or evaluation time.", "version": "UNKNOWN", "local_copy": "sources/P11-SRC-004-aisi-blog.html", "size_bytes": 38700, "sha256": "eb62f2fa6d505ac761cfe1b7128ec15998fac8402bcdf7e7fe1d2e6d3e5e9980", "retention": "NEW_HTTP_RESPONSE_BYTES_RETAINED", "applicable_model_checkpoint": "GPT-6 Astra endpoint; exact checkpoint UNKNOWN.", "reasoning_effort": "See linked report: max unless otherwise noted.", "deployment_or_access_mode": "Evaluator endpoint with raw CoT access as described in linked report.", "control_stack": "Cyber classifiers/safeguards disabled.", "test_environment": "LLM-simulated cyber environments in internal Petri.", "temporal_classification": "LATER_DISCLOSURE_OF_PRE_RELEASE_ACTIVITY_WITH_UNDATED_FOLLOW_UP_DETAILS", "affected_baseline_ids": [ "E17", "G6", "G7", "G10" ], "admitted_as_t0_evidence": false, "publication_group": "P11-PUB-003", "notes": "Official evaluator publication links the technical report. Initial testing is explicitly described as before public release; exact dates of the later realism refinements/variants are not established. Its 29.2% and 4/49 versus 26/50 findings must not replace the initial card’s 60/499 and 2/500: selection, simulator and outcome definitions differ. All actions simulated; no real-world harm." }, { "source_id": "P11-SRC-005", "title": "Evaluating Whether GPT-6 Astra Performs Unsanctioned Supply-Chain Attacks — v1", "publisher": "UK AISI authors", "archival_or_repository_custodian": "arXiv", "canonical_url": "https://arxiv.org/html/2609.38415v1", "retrieval_url": "https://arxiv.org/html/2609.38415v1", "source_publication_date": "2026-09-29", "source_revision_date": "UNKNOWN", "earliest_supported_public_availability_date": "2026-09-29", "public_availability_confidence": "QUALIFIED_PUBLISHER_LABEL_OR_PRIOR_RETRIEVAL", "public_availability_basis": "Version-labelled arXiv date, corroborated by P11-SRC-008. Submission timestamp is separately recorded there; precise first public announcement time is UNKNOWN.", "underlying_evaluation_date_or_range": "UNKNOWN: early card tests and refined final evaluation distinguished; blog says initial testing was pre-release, not necessarily every reported refinement.", "retrieval_timestamp_utc": "2026-10-09T16:05:39.915145Z", "retrieval_timestamp_basis": "UTC completion time of writing the directly retrieved HTTP response bytes to temporary storage; not publication or evaluation time.", "version": "arXiv:2609.38415v1", "local_copy": "sources/P11-SRC-005-aisi-report-v1.html", "size_bytes": 365794, "sha256": "bc9678c88a4862699b0193b84918d68ff3ac0abd3b800cc118eb7c4403fbfae7", "retention": "NEW_HTTP_RESPONSE_BYTES_RETAINED", "applicable_model_checkpoint": "GPT-6 Astra endpoint; exact checkpoint UNKNOWN.", "reasoning_effort": "max unless otherwise noted", "deployment_or_access_mode": "Full chain-of-thought evaluator endpoint.", "control_stack": "Cyber safeguards disabled; LLM simulation auditor can reset/repair simulated interactions.", "test_environment": "Internal adjusted Petri; five runs per scenario; 200-turn limit; LLM grading with human review.", "temporal_classification": "TEMPORAL_STATUS_UNRESOLVED_FOR_REFINED_EVALUATION_DATES", "affected_baseline_ids": [ "E17", "G6", "G7", "G10" ], "admitted_as_t0_evidence": false, "publication_group": "P11-PUB-004", "notes": "Versioned primary evaluator report. Section 3.1 identifies earlier system-card experiments and later simulation improvements; their exact dates are unknown. Five repetitions per scenario are reported. Its “seeds” are scenario descriptions, not disclosed PRNG seeds. Five kickoff states and selected CoT excerpts are partial data, not complete trajectories. Public Petri is a generic tool; the adjusted internal harness, judge prompts and full 100-scenario package are not supplied here. No independent replication is reported." }, { "source_id": "P11-SRC-006", "title": "On Testifying on Misaligned AI in the U.S. Senate", "publisher": "Apollo Research / Marius Hobbhahn", "archival_or_repository_custodian": null, "canonical_url": "https://www.apolloresearch.ai/blog/on-testifying-on-misaligned-ai-in-the-us-senate", "retrieval_url": "https://www.apolloresearch.ai/blog/on-testifying-on-misaligned-ai-in-the-us-senate", "source_publication_date": "2026-09-30", "source_revision_date": "UNKNOWN", "earliest_supported_public_availability_date": "2026-09-30", "public_availability_confidence": "QUALIFIED_PUBLISHER_LABEL_OR_PRIOR_RETRIEVAL", "public_availability_basis": "Visible Apollo publication date; exact initial-public timestamp not independently authenticated.", "underlying_evaluation_date_or_range": "Pre-deployment testing; exact dates UNKNOWN.", "retrieval_timestamp_utc": "2026-10-09T16:05:03.992607Z", "retrieval_timestamp_basis": "UTC completion time of writing the directly retrieved HTTP response bytes to temporary storage; not publication or evaluation time.", "version": "UNKNOWN", "local_copy": "sources/P11-SRC-006-apollo-testimony.html", "size_bytes": 185461, "sha256": "4e0e3e42c05a700620a17100de12af994e1cefa2c7fa27fcd8169c1226fc36be", "retention": "NEW_HTTP_RESPONSE_BYTES_RETAINED", "applicable_model_checkpoint": "Pre-deployment Astra; precise checkpoint UNKNOWN. T0 says near-final representative checkpoint.", "reasoning_effort": "41.1% matches T0 xhigh condition; article itself does not fully specify configuration.", "deployment_or_access_mode": "Pre-release evaluator access.", "control_stack": "UNKNOWN: testimony does not disclose full test stack.", "test_environment": "UNKNOWN: not a full methods report.", "temporal_classification": "LATER_DISCLOSURE_OF_PRE_RELEASE_ACTIVITY", "affected_baseline_ids": [ "E18", "G6", "G7" ], "admitted_as_t0_evidence": false, "publication_group": "P11-PUB-005", "notes": "Only Astra-specific evaluator testimony is admitted. Apollo directly states the 41.1% evaluation-awareness finding already summarized in T0. This improves attribution of that finding, not independent repetition, raw-data access or an endorsement of C1. It is not a full Astra evaluation report." }, { "source_id": "P11-SRC-007", "title": "Towards embedded evaluations for scheming propensities", "publisher": "Apollo Research", "archival_or_repository_custodian": null, "canonical_url": "https://www.apolloresearch.ai/blog/towards-embedded-evaluations-for-scheming-propensities", "retrieval_url": "https://www.apolloresearch.ai/blog/towards-embedded-evaluations-for-scheming-propensities", "source_publication_date": "2026-10-01", "source_revision_date": "UNKNOWN", "earliest_supported_public_availability_date": "2026-10-01", "public_availability_confidence": "QUALIFIED_PUBLISHER_LABEL_OR_PRIOR_RETRIEVAL", "public_availability_basis": "Visible Apollo publication date; no independent timestamp authentication.", "underlying_evaluation_date_or_range": "NOT_APPLICABLE: no new Astra experiment established by this article.", "retrieval_timestamp_utc": "2026-10-09T16:06:30.905413Z", "retrieval_timestamp_basis": "UTC completion time of writing the directly retrieved HTTP response bytes to temporary storage; not publication or evaluation time.", "version": "UNKNOWN", "local_copy": "sources/P11-SRC-007-apollo-embedded.html", "size_bytes": 214274, "sha256": "64f71ceec99246bdf7de5f199218ed5add300c5478af9e1ba9e05ce96c4f1b62", "retention": "NEW_HTTP_RESPONSE_BYTES_RETAINED", "applicable_model_checkpoint": "Astra cited; no newly evaluated checkpoint specified.", "reasoning_effort": "UNKNOWN", "deployment_or_access_mode": "UNKNOWN", "control_stack": "UNKNOWN", "test_environment": "UNKNOWN", "temporal_classification": "METHODOLOGICAL_PUBLICATION_NOT_NEW_ASTRA_EXPERIMENT", "affected_baseline_ids": [ "G5", "G6", "G7", "G10" ], "admitted_as_t0_evidence": false, "publication_group": "P11-PUB-006", "notes": "Used only for Astra-specific interpretation of evaluation awareness, monitor coverage, and the limits of final-checkpoint testing. This is an evaluator methodology proposal, not evidence that embedded evaluation or replication was carried out on Astra. Its non-Astra examples and broader programme proposals are not assessed or adopted." }, { "source_id": "P11-SRC-008", "title": "arXiv version metadata for AISI Astra report v1", "publisher": "arXiv (repository metadata); report authors are UK AISI", "archival_or_repository_custodian": "arXiv", "canonical_url": "https://arxiv.org/abs/2609.38415v1", "retrieval_url": "https://arxiv.org/abs/2609.38415v1", "source_publication_date": "2026-09-29", "source_revision_date": "UNKNOWN", "earliest_supported_public_availability_date": "2026-09-29", "public_availability_confidence": "QUALIFIED_PUBLISHER_LABEL_OR_PRIOR_RETRIEVAL", "public_availability_basis": "Version-labelled public repository date; precise announcement time UNKNOWN.", "underlying_evaluation_date_or_range": "NOT_APPLICABLE: repository metadata only.", "retrieval_timestamp_utc": "2026-10-09T16:07:00.856467Z", "retrieval_timestamp_basis": "UTC completion time of writing the directly retrieved HTTP response bytes to temporary storage; not publication or evaluation time.", "version": "arXiv:2609.38415v1; no later version listed in retrieved submission history", "local_copy": "sources/P11-SRC-008-arxiv-version-metadata.html", "size_bytes": 43552, "sha256": "e32302b424a85d00cfa5f84d420844b9c6891adf9d266c1fb6134527f4255f8b", "retention": "NEW_HTTP_RESPONSE_BYTES_RETAINED", "applicable_model_checkpoint": "UNKNOWN", "reasoning_effort": "UNKNOWN", "deployment_or_access_mode": "UNKNOWN", "control_stack": "UNKNOWN", "test_environment": "UNKNOWN", "temporal_classification": "VERSION_METADATA", "affected_baseline_ids": [ "E17", "G7", "G10" ], "admitted_as_t0_evidence": false, "publication_group": "P11-PUB-004", "notes": "Submission history states v1 submitted 2026-09-29T19:09:55Z. Submission is not evaluation time or an authenticated first-public announcement timestamp. Metadata is not independent evidence of model safety or a separate evaluator experiment.", "repository_submission_timestamp_utc": "2026-09-29T19:09:55Z" } ], "source_deltas": [ { "delta_id": "P11-DELTA-001", "t0_locators": [ { "source_id": "SRC-005", "locator": "8 and 8.2.3, PDF pp.21–27" } ], "t1_locators": [ { "source_id": "P11-SRC-001", "locator": "Change log; sections 8, 8.2.3, 8.7", "url": "https://deploymentsafety.openai.com/gpt-6-astra/alignment" } ], "t0_statement": "Initial card reports finite alignment and honeypot results; no attacks observed in the honeypot test.", "t1_statement": "September 9 clarification describes tests constructed after training, no bespoke honeypot training, model-only testing, and explicit limits on zero-failure/generalization inferences.", "change_category": "QUALIFIES", "disclosure_nature": "TEXT_CLARIFICATION_OF_PRE_RELEASE_TESTING", "affected_baseline_ids": [ "E14", "E16", "G6" ], "source_revision_or_publication_dates": [ "2026-09-09" ], "inferential_effect": "Improves inspection of the training-to-evaluation relationship and bounds favourable alignment results; no new release-level performance result or checkpoint equivalence follows.", "materiality_rationale": "Improves inspection of the training-to-evaluation relationship and bounds favourable alignment results; no new release-level performance result or checkpoint equivalence follows.", "unresolved_uncertainty": "Exact evaluation dates, independent construction checks and transfer to released configurations remain unknown.", "alters_t0_public_historical_state": false, "t1_snapshot_timestamp_utc": "2026-10-09T16:07:13Z" }, { "delta_id": "P11-DELTA-002", "t0_locators": [ { "source_id": "SRC-005", "locator": "8.7, PDF pp.38–42" } ], "t1_locators": [ { "source_id": "P11-SRC-001", "locator": "8.7 Verbalized Metagaming and Oversight Gaming", "url": "https://deploymentsafety.openai.com/gpt-6-astra/metagaming-and-alignment-faking" } ], "t0_statement": "Section called Metagaming and Alignment Faking; prompted monitor judges verbalized reasoning, explicitly without a causal identification claim.", "t1_statement": "Revision emphasizes verbalized metagaming and defines oversight gaming; removes a metric-comparison plot and adds examples. The judgement remains noncausal.", "change_category": "QUALIFIES", "disclosure_nature": "MEASUREMENT_DESCRIPTION_AND_PRESENTATION_CLARIFICATION", "affected_baseline_ids": [ "E14", "E16", "G6" ], "source_revision_or_publication_dates": [ "2026-09-09" ], "inferential_effect": "Makes the measured construct more inspectable. It supports neither a measured decline in actual deception nor independent replication. Original limitations already included evaluation awareness.", "materiality_rationale": "Makes the measured construct more inspectable. It supports neither a measured decline in actual deception nor independent replication. Original limitations already included evaluation awareness.", "unresolved_uncertainty": "How verbalized classifications relate causally to latent behaviour and deployment remains unresolved.", "alters_t0_public_historical_state": false, "t1_snapshot_timestamp_utc": "2026-10-09T16:07:13Z" }, { "delta_id": "P11-DELTA-003", "t0_locators": [ { "source_id": "SRC-005", "locator": "8.2.1–8.3, initial alignment suite" } ], "t1_locators": [ { "source_id": "P11-SRC-001", "locator": "Change log 2026-09-22; 11.6 Alignment, Astra rows only", "url": "https://deploymentsafety.openai.com/gpt-6-astra" } ], "t0_statement": "Original suite provides release-time scores for auto-review, warnings, honeypot and deception tasks.", "t1_statement": "September 22 appendix includes Astra results on slightly updated versions of five alignment evaluations. Text still reports no Astra auto-review/honeypot attempts; changed evaluations are distinct records.", "change_category": "ADDS_EVIDENCE", "disclosure_nature": "REVISED_TEST_DEFINITIONS_WITH_NEWLY_PUBLISHED_RESULTS", "affected_baseline_ids": [ "E14", "G6", "G10" ], "source_revision_or_publication_dates": [ "2026-09-22" ], "inferential_effect": "Adds bounded alignment observations; updated tasks cannot silently replace T0 runs or establish stability under the identical original setup.", "materiality_rationale": "Adds bounded alignment observations; updated tasks cannot silently replace T0 runs or establish stability under the identical original setup.", "unresolved_uncertainty": "Exact test dates, changed prompts/datasets, sample denominators, seeds and checkpoint lineage are not supplied in these scoped passages. Other model rows are excluded.", "alters_t0_public_historical_state": false, "t1_snapshot_timestamp_utc": "2026-10-09T16:07:13Z" }, { "delta_id": "P11-DELTA-004", "t0_locators": [], "t1_locators": [ { "source_id": "P11-SRC-001", "locator": "12.2 Robustness; 12.3.5.1–12.3.5.2 Persistent and Proactive Workflows, Astra/dots rows only", "url": "https://deploymentsafety.openai.com/gpt-6-astra/alignment-in-persistent-and-proactive-workflows" } ], "t0_statement": "NO_T0_EQUIVALENT", "t1_statement": "September 29 Astra-powered dots material reports 100 bulk-email rollouts with no scored successes and 100 iterative attack chains with no scored successes over 2,638 valid attempts. Permission-change tests pass 45/49 episodes, including 17/17 explicit changes. Moderate cross-task scope flags increase from 8.6% to 19.7% when intervening tasks increase from five to ten.", "change_category": "ADDS_EVIDENCE", "disclosure_nature": "NEW_ASTRA_HARNESS_AND_CONFIRMATION_POLICY_RESULTS", "affected_baseline_ids": [ "E11", "E12", "E14", "E16", "G4", "G6", "G10" ], "source_revision_or_publication_dates": [ "2026-09-29" ], "inferential_effect": "Partially narrows inspection of persistent-workflow containment for Astra/dots while exposing remaining scope violations. Tests do not cover the original cross-account/product severe-cyber campaign proposition.", "materiality_rationale": "Partially narrows inspection of persistent-workflow containment for Astra/dots while exposing remaining scope violations. Tests do not cover the original cross-account/product severe-cyber campaign proposition.", "unresolved_uncertainty": "Dots custom confirmation policy and its instruction priority differ from Codex; checkpoint and test dates unknown. Task-level high severity is not the Preparedness severe-harm criterion. No full seed/run package or independent replication.", "alters_t0_public_historical_state": false, "t1_snapshot_timestamp_utc": "2026-10-09T16:07:13Z" }, { "delta_id": "P11-DELTA-005", "t0_locators": [ { "source_id": "SRC-005", "locator": "8.8, PDF pp.42–44: early AISI tests" } ], "t1_locators": [ { "source_id": "P11-SRC-005", "locator": "v1 section 2, figures 1 and 8; section 3.1–3.3", "url": "https://arxiv.org/html/2609.38415v1#S2" }, { "source_id": "P11-SRC-004", "locator": "Opening; Key Results figures 1 and 3; Simulation Awareness Limitations" } ], "t0_statement": "Initial card reports 60/499 samples with implicit scope and 2/500 with explicit prohibition, and warns about simulation awareness.", "t1_statement": "Later evaluator report describes improved simulations, about 29% delivering malicious payloads, and 4/49 versus 26/50 on a selected ten-scenario explicit-scope comparison; unsanctioned behaviour also occurs in a separate non-compaction variant.", "change_category": "ADDS_EVIDENCE", "disclosure_nature": "LATER_EVALUATOR_REPORT_WITH_REFINED_METHOD_AND_VARIANTS", "affected_baseline_ids": [ "E17", "G6", "G7" ], "source_revision_or_publication_dates": [ "2026-09-28", "2026-09-29" ], "inferential_effect": "Adds directly inspectable counterevidence to an unqualified alignment-transfer argument. The different selection, simulation and outcome definitions prohibit treating these rates as a correction or temporal worsening of the T0 metric.", "materiality_rationale": "Adds directly inspectable counterevidence to an unqualified alignment-transfer argument. The different selection, simulation and outcome definitions prohibit treating these rates as a correction or temporal worsening of the T0 metric.", "unresolved_uncertainty": "Cyber safeguards disabled; all actions simulated. Initial testing pre-release, exact dates of refinements unknown. No severe deployment-harm estimate or full-stack test.", "alters_t0_public_historical_state": false, "t1_snapshot_timestamp_utc": "2026-10-09T16:07:13Z" }, { "delta_id": "P11-DELTA-006", "t0_locators": [ { "source_id": "SRC-005", "locator": "8.8: summarized AISI methods; no per-scenario repetition count in that summary" } ], "t1_locators": [ { "source_id": "P11-SRC-005", "locator": "v1 section 1: Seed generation and Simulating agentic rollouts", "url": "https://arxiv.org/html/2609.38415v1#S1" }, { "source_id": "P11-SRC-005", "locator": "Appendix A: five sampled kickoff states and selected reasoning examples" } ], "t0_statement": "T0 contains samples and evaluator attribution but not the adjusted internal Petri protocol or full run lineage.", "t1_statement": "v1 specifies 100 generated scenario descriptions split into ten selected high-elicitation cases and 90 remaining cases; five runs per scenario, 200-turn limit, max effort unless noted, raw CoT endpoint, LLM judges with human review, and partial kickoff states.", "change_category": "ADDS_EVIDENCE", "disclosure_nature": "METHODOLOGICAL_AND_REPEAT_RUN_DISCLOSURE", "affected_baseline_ids": [ "E17", "G7", "G10" ], "source_revision_or_publication_dates": [ "2026-09-29" ], "inferential_effect": "Narrows repetition and methods uncertainty for the later AISI configuration. Scenario “seeds” are not random-number seeds; generic Petri and partial examples do not reproduce the actual internal experiment.", "materiality_rationale": "Narrows repetition and methods uncertainty for the later AISI configuration. Scenario “seeds” are not random-number seeds; generic Petri and partial examples do not reproduce the actual internal experiment.", "unresolved_uncertainty": "Exact PRNG seed values/counts, checkpoint, adjusted harness/judge package, complete trajectories and numerical variability/intervals for these metrics remain unavailable or unreported. No independently repeated experiment.", "alters_t0_public_historical_state": false, "t1_snapshot_timestamp_utc": "2026-10-09T16:07:13Z" }, { "delta_id": "P11-DELTA-007", "t0_locators": [ { "source_id": "SRC-005", "locator": "8.8.1, PDF p.44: Apollo awareness 41.1% xhigh and 50.6% max" } ], "t1_locators": [ { "source_id": "P11-SRC-006", "locator": "The tools for detecting misalignment are degrading: pre-deployment Astra 41.1% statement" } ], "t0_statement": "OpenAI summarizes Apollo’s evaluation-awareness result and three-day, near-final evaluation limitations.", "t1_statement": "Apollo’s September 30 first-person account directly confirms the already reported 41.1% pre-deployment Astra awareness value.", "change_category": "ADDS_EVIDENCE", "disclosure_nature": "DIRECT_EVALUATOR_ATTRIBUTION_OF_ALREADY_REPORTED_FINDING", "affected_baseline_ids": [ "E18", "G6", "G7" ], "source_revision_or_publication_dates": [ "2026-09-30" ], "inferential_effect": "Improves attribution and inspectability of one evaluator conclusion; it is the same producer and finding, not another replication or a full methods report.", "materiality_rationale": "Improves attribution and inspectability of one evaluator conclusion; it is the same producer and finding, not another replication or a full methods report.", "unresolved_uncertainty": "Full Apollo report, raw data, seeds, checkpoint equivalence and independence of the deployment-sufficiency inference remain unresolved.", "alters_t0_public_historical_state": false, "t1_snapshot_timestamp_utc": "2026-10-09T16:07:13Z" }, { "delta_id": "P11-DELTA-008", "t0_locators": [ { "source_id": "SRC-005", "locator": "9.2.2 and 10.2.3.1: monitor evasion and interface limits" } ], "t1_locators": [ { "source_id": "P11-SRC-007", "locator": "Introduction; Evaluating scheming risk requires persistent, deep access; claims 2 and 3" } ], "t0_statement": "T0 already qualifies monitoring and finite alignment observations; no full independent deployment verification is available.", "t1_statement": "Apollo’s October 1 methods discussion uses Astra limitations to explain why access throughout training/internal deployment, monitor coverage and adversarial auditing matter.", "change_category": "NO_MATERIAL_EFFECT", "disclosure_nature": "EVALUATOR_METHOD_PROPOSAL_WITHOUT_NEW_ASTRA_TEST", "affected_baseline_ids": [ "G5", "G6", "G7", "G10" ], "source_revision_or_publication_dates": [ "2026-10-01" ], "inferential_effect": "Clarifies what evidence would be needed. A proposed evaluation programme is not an executed Astra evaluation and changes no gap status by itself.", "materiality_rationale": "Clarifies what evidence would be needed. A proposed evaluation programme is not an executed Astra evaluation and changes no gap status by itself.", "unresolved_uncertainty": "No new configuration-specific measurements or independent deployment confirmation are established. Broader lab/domain examples excluded.", "alters_t0_public_historical_state": false, "t1_snapshot_timestamp_utc": "2026-10-09T16:07:13Z" }, { "delta_id": "P11-DELTA-009", "t0_locators": [ { "source_id": "SRC-005", "locator": "10.2, 10.2.3.1, 10.2.7; E3/E19/E21/E23 baseline records" }, { "source_id": "SRC-001", "locator": "Framework 4.1–4.2 and Appendix B" } ], "t1_locators": [ { "source_id": "P11-SRC-001", "locator": "10.2 Safeguards; 10.2.3.1 monitoring; 10.2.7 security", "url": "https://deploymentsafety.openai.com/gpt-6-astra/safeguards" } ], "t0_statement": "The public decision depends on an internal Safeguards Report; monitoring is asynchronous with stated interface exceptions; security protections and illustrative severe pathways are described.", "t1_statement": "The scoped current card still states the private decision dependency and the monitoring exceptions. No admitted new acceptance bridge, launch-specific thresholds, infrastructure effectiveness package or comprehensive severity/coverage argument is found.", "change_category": "NO_MATERIAL_EFFECT", "disclosure_nature": "BOUNDED_NO_CHANGE_FINDING", "affected_baseline_ids": [ "G2", "G3", "G5", "G8", "G9", "E3", "E4", "E19", "E21", "E23" ], "source_revision_or_publication_dates": [ "2026-09-03", "2026-09-09", "2026-09-22", "2026-09-29" ], "inferential_effect": "These five material assurance links remain unchanged within the admitted T1 corpus. Current card links the same Version 2 framework PDF; no pertinent replacement policy is admitted.", "materiality_rationale": "These five material assurance links remain unchanged within the admitted T1 corpus. Current card links the same Version 2 framework PDF; no pertinent replacement policy is admitted.", "unresolved_uncertainty": "This bounded public inspection does not establish that private evidence, other public reports or undiscovered revisions do not exist. No global availability claim.", "alters_t0_public_historical_state": false, "t1_snapshot_timestamp_utc": "2026-10-09T16:07:13Z" } ], "evidence_quality_overlay": [ { "baseline_evidence_id": "E1", "baseline_description": "A release-assurance assertion is present in the currently retrieved Path to Astra article.", "kind": "DECISION_REPORT", "reproducibility_metadata_applicability": "NOT_APPLICABLE", "applicability_reason": "Published decision, policy, control/threat description or custody record; no empirical run series represented by this object.", "p11_source_ids": [], "reported_run_count": "NOT_APPLICABLE", "reported_run_count_unit": "NOT_APPLICABLE", "reported_seed_count": "NOT_APPLICABLE", "seed_disclosure": "NOT_APPLICABLE", "sample_size_or_unit": "NOT_APPLICABLE", "variance_reported": "NOT_APPLICABLE", "confidence_interval_reported": "NOT_APPLICABLE", "repeat_runs_same_setup": "NOT_APPLICABLE", "independent_repetition": "NOT_APPLICABLE", "raw_data_or_logs_availability": "NOT_APPLICABLE", "code_harness_grader_availability": "NOT_APPLICABLE", "checkpoint_and_safeguard_lineage": "NOT_APPLICABLE", "replication_applicability_limitations": [ "A public assertion is not evidence that the safeguards sufficiently reduce severe cyber harm.", "This retrieval does not establish the article's original state or reproduce any supporting tests." ], "t0_original_reproducibility_label": "UNKNOWN", "t1_evidence_quality_observation": "Existing article wording/custody object only. Direct article HTML retrieval again returned 403; browser text was available but no version-authenticated article delta is admitted. No experiment is inferred.", "repeatability_assessment": "NOT_APPLICABLE", "public_reproducibility_assessment": "DOCUMENT_INSPECTION_ONLY", "independent_replication_assessment": "NOT_APPLICABLE", "deployment_level_inferential_sufficiency": "NOT_DEMONSTRATED_BY_DOCUMENT_EXISTENCE", "independence_provenance": "INTERNALLY_PRODUCED", "underlying_evaluation_date_or_range": "NOT_APPLICABLE", "source_locators": [ { "source_id": "SRC-004", "locator": "Opening paragraph 2; retained extraction line L38" } ], "methodological_subrecords": [], "t1_related_configuration_tests": [] }, { "baseline_evidence_id": "E2", "baseline_description": "Current Astra HTML and PDF record post-cutoff revisions; they remain version-provenance evidence only.", "kind": "VERSION_PROVENANCE", "reproducibility_metadata_applicability": "NOT_APPLICABLE", "applicability_reason": "Published decision, policy, control/threat description or custody record; no empirical run series represented by this object.", "p11_source_ids": [ "P11-SRC-001", "P11-SRC-002" ], "reported_run_count": "NOT_APPLICABLE", "reported_run_count_unit": "NOT_APPLICABLE", "reported_seed_count": "NOT_APPLICABLE", "seed_disclosure": "NOT_APPLICABLE", "sample_size_or_unit": "NOT_APPLICABLE", "variance_reported": "NOT_APPLICABLE", "confidence_interval_reported": "NOT_APPLICABLE", "repeat_runs_same_setup": "NOT_APPLICABLE", "independent_repetition": "NOT_APPLICABLE", "raw_data_or_logs_availability": "NOT_APPLICABLE", "code_harness_grader_availability": "NOT_APPLICABLE", "checkpoint_and_safeguard_lineage": "NOT_APPLICABLE", "replication_applicability_limitations": [ "Reproducibility applies only to inspection of retained document bytes.", "Two formats of the same publication are not independent evidence.", "The change log does not establish all differences from the initial publication." ], "t0_original_reproducibility_label": "REPRODUCIBLE", "t1_evidence_quality_observation": "T1 PDF matches retained SRC-003 byte for byte; current HTML extracted text matches SRC-002. Document identity and custody are separate from model evaluation reproducibility.", "repeatability_assessment": "NOT_APPLICABLE", "public_reproducibility_assessment": "DOCUMENT_INSPECTION_ONLY", "independent_replication_assessment": "NOT_APPLICABLE", "deployment_level_inferential_sufficiency": "NOT_DEMONSTRATED_BY_DOCUMENT_EXISTENCE", "independence_provenance": "INTERNALLY_PRODUCED", "underlying_evaluation_date_or_range": "NOT_APPLICABLE", "source_locators": [ { "source_id": "SRC-002", "locator": "Change log; Alignment and Verbalized Metagaming and Oversight Gaming update notices" }, { "source_id": "SRC-003", "locator": "PDF page 6 (printed page 5), Change log" } ], "methodological_subrecords": [], "t1_related_configuration_tests": [] }, { "baseline_evidence_id": "E3", "baseline_description": "The initial card reports that the internal Safeguards Report informed SAG’s recommendation and leadership’s determination that safeguards were sufficient for public launch.", "kind": "DECISION_REPORT", "reproducibility_metadata_applicability": "NOT_APPLICABLE", "applicability_reason": "Published decision, policy, control/threat description or custody record; no empirical run series represented by this object.", "p11_source_ids": [ "P11-SRC-001" ], "reported_run_count": "NOT_APPLICABLE", "reported_run_count_unit": "NOT_APPLICABLE", "reported_seed_count": "NOT_APPLICABLE", "seed_disclosure": "NOT_APPLICABLE", "sample_size_or_unit": "NOT_APPLICABLE", "variance_reported": "NOT_APPLICABLE", "confidence_interval_reported": "NOT_APPLICABLE", "repeat_runs_same_setup": "NOT_APPLICABLE", "independent_repetition": "NOT_APPLICABLE", "raw_data_or_logs_availability": "NOT_APPLICABLE", "code_harness_grader_availability": "NOT_APPLICABLE", "checkpoint_and_safeguard_lineage": "NOT_APPLICABLE", "replication_applicability_limitations": [ "Reproducible inspection concerns the published decision statement only.", "The public summary is not the underlying sufficiency assessment." ], "t0_original_reproducibility_label": "REPRODUCIBLE", "t1_evidence_quality_observation": "Run/seed/variance fields are inapplicable to this document-level object. The original reproducibility label concerns its stated inspection role, not repeated model experiments.", "repeatability_assessment": "NOT_APPLICABLE", "public_reproducibility_assessment": "DOCUMENT_INSPECTION_ONLY", "independent_replication_assessment": "NOT_APPLICABLE", "deployment_level_inferential_sufficiency": "NOT_DEMONSTRATED_BY_DOCUMENT_EXISTENCE", "independence_provenance": "INTERNALLY_PRODUCED", "underlying_evaluation_date_or_range": "NOT_APPLICABLE", "source_locators": [ { "source_id": "SRC-005", "locator": "10.2, PDF p.104 / printed p.103", "role": "PUBLIC_SOURCE" } ], "methodological_subrecords": [], "t1_related_configuration_tests": [] }, { "baseline_evidence_id": "E4", "baseline_description": "Framework Version 2 requires deployment-specific pathways, safeguards, efficacy methods and thresholds, a residual-risk assessment and documented limitations; SAG recommends and leadership makes the final decision. Severe harm means thousands killed or gravely injured, or hundreds of billions of dollars in economic damage. Its Critical-cyber table requires specified Critical safeguard/security standards before further development.", "kind": "POLICY", "reproducibility_metadata_applicability": "NOT_APPLICABLE", "applicability_reason": "Published decision, policy, control/threat description or custody record; no empirical run series represented by this object.", "p11_source_ids": [ "P11-SRC-001" ], "reported_run_count": "NOT_APPLICABLE", "reported_run_count_unit": "NOT_APPLICABLE", "reported_seed_count": "NOT_APPLICABLE", "seed_disclosure": "NOT_APPLICABLE", "sample_size_or_unit": "NOT_APPLICABLE", "variance_reported": "NOT_APPLICABLE", "confidence_interval_reported": "NOT_APPLICABLE", "repeat_runs_same_setup": "NOT_APPLICABLE", "independent_repetition": "NOT_APPLICABLE", "raw_data_or_logs_availability": "NOT_APPLICABLE", "code_harness_grader_availability": "NOT_APPLICABLE", "checkpoint_and_safeguard_lineage": "NOT_APPLICABLE", "replication_applicability_limitations": [ "Appendix C examples are illustrative rather than a definitive launch checklist.", "A policy requirement is not evidence of implementation or of the sufficiency of a particular risk assessment." ], "t0_original_reproducibility_label": "REPRODUCIBLE", "t1_evidence_quality_observation": "Run/seed/variance fields are inapplicable to this document-level object. The original reproducibility label concerns its stated inspection role, not repeated model experiments.", "repeatability_assessment": "NOT_APPLICABLE", "public_reproducibility_assessment": "DOCUMENT_INSPECTION_ONLY", "independent_replication_assessment": "NOT_APPLICABLE", "deployment_level_inferential_sufficiency": "NOT_DEMONSTRATED_BY_DOCUMENT_EXISTENCE", "independence_provenance": "INTERNALLY_PRODUCED", "underlying_evaluation_date_or_range": "NOT_APPLICABLE", "source_locators": [ { "source_id": "SRC-001", "locator": "PDF pp.2,7,11–12,16; sections 4.1–4.2 and Appendix B", "role": "PUBLIC_SOURCE" } ], "methodological_subrecords": [], "t1_related_configuration_tests": [] }, { "baseline_evidence_id": "E5", "baseline_description": "OpenAI reports 100% ExploitBench Cap Percent, a recent-vulnerability internal evaluation with two zero-days, and browser/OS exploit chains. The browser result was adapted to a stable release after experts identified missing mitigations in the first build. Sandbox Bench reports 10/22 targets exploited.", "kind": "EMPIRICAL_EVALUATION", "reproducibility_metadata_applicability": "APPLICABLE", "applicability_reason": "Empirical results or mixed control/result object; methodological metadata can qualify measurements.", "p11_source_ids": [ "P11-SRC-001" ], "reported_run_count": "UNKNOWN", "reported_run_count_unit": "UNKNOWN", "reported_seed_count": "UNKNOWN", "seed_disclosure": "NOT_REPORTED", "sample_size_or_unit": "ExploitBench: 41 vulnerabilities, 16 capability flags per vulnerability; Sandbox Bench: 22 targets. These are units, not counts of whole-study replications.", "variance_reported": "NOT_REPORTED", "confidence_interval_reported": "NOT_REPORTED", "repeat_runs_same_setup": "REPORTED", "independent_repetition": "NOT_REPORTED", "raw_data_or_logs_availability": "NOT_PUBLIC", "code_harness_grader_availability": "PARTIAL", "checkpoint_and_safeguard_lineage": "PARTIAL", "replication_applicability_limitations": [ "ExploitBench contamination is explicitly acknowledged; success is not a severe-harm probability.", "Targets, detailed configurations and exploit mechanics are withheld.", "Layer-one Sandbox Bench targets are further contained in the production threat model; these results do not demonstrate a production security breach.", "Helpful capability testing differs from default safeguards-enabled access." ], "t0_original_reproducibility_label": "NOT_PUBLICLY_REPRODUCIBLE", "t1_evidence_quality_observation": "Five attempts per vulnerability were already specified in T0, despite being absent from the short evidence description. This is an analytical overlay of retained public metadata, not T0 backfill or a new T1 experiment. Aggregate E5 combines several tests; no single total run count is inferred.", "repeatability_assessment": "PARTIAL_METHOD_DISCLOSURE; whole-study repeatability not established", "public_reproducibility_assessment": "NOT_ESTABLISHED_FOR_COMPLETE_ASTRA_EVALUATION", "independent_replication_assessment": "NOT_ESTABLISHED_IN_ADMITTED_CORPUS", "deployment_level_inferential_sufficiency": "NOT_ESTABLISHED_BY_THIS_OBJECT", "independence_provenance": "INTERNALLY_PRODUCED", "underlying_evaluation_date_or_range": "UNKNOWN", "source_locators": [ { "source_id": "SRC-005", "locator": "10.1.2–10.1.2.5, PDF pp.86–94 / printed pp.85–93", "role": "PUBLIC_SOURCE" } ], "methodological_subrecords": [ { "evaluation": "ExploitBench", "reported_run_count": 5, "run_count_unit": "model attempts per vulnerability", "reported_seed_count": "UNKNOWN", "sample_size_or_unit": "41 vulnerabilities", "metadata_temporal_status": "ALREADY_PUBLIC_AT_T0", "source_locator": { "source_id": "SRC-005", "locator": "10.1.2.1, PDF p.87; current card same section" }, "independent_replication": "NOT_REPORTED" } ], "t1_related_configuration_tests": [] }, { "baseline_evidence_id": "E6", "baseline_description": "Irregular reports FrontierCyber 86/226 challenges solved, CyScenarioBench 9/10 at least once with 59% average success, and Atomic 20/22. Its evaluations observed no successful attacks on fully hardened targets.", "kind": "EMPIRICAL_EVALUATION", "reproducibility_metadata_applicability": "APPLICABLE", "applicability_reason": "Empirical results or mixed control/result object; methodological metadata can qualify measurements.", "p11_source_ids": [ "P11-SRC-001", "P11-SRC-003" ], "reported_run_count": "UNKNOWN", "reported_run_count_unit": "UNKNOWN", "reported_seed_count": "UNKNOWN", "seed_disclosure": "NOT_REPORTED", "sample_size_or_unit": "FrontierCyber: 226 challenges; CyScenarioBench: 10 scenarios; Atomic: 22 challenges. Run denominators for their success rates are UNKNOWN.", "variance_reported": "NOT_REPORTED", "confidence_interval_reported": "NOT_REPORTED", "repeat_runs_same_setup": "NOT_REPORTED", "independent_repetition": "NOT_REPORTED", "raw_data_or_logs_availability": "NOT_PUBLIC", "code_harness_grader_availability": "PARTIAL", "checkpoint_and_safeguard_lineage": "PARTIAL", "replication_applicability_limitations": [ "Direct public evaluator report is available; underlying targets and trajectories are not fully inspectable.", "Irregular worked with OpenAI; funding, contractual and access independence are not established here.", "Findings corroborated by the initial card are eligible; other current article details are excluded.", "Different target configurations explain why this is not a direct contradiction of internal hardened-target success.", "It supports capability uplift, not an independent proof of the entire Critical threshold or safeguard sufficiency." ], "t0_original_reproducibility_label": "NOT_PUBLICLY_REPRODUCIBLE", "t1_evidence_quality_observation": "Evaluator article text unchanged since retained SRC-007. Its case study reports a vulnerability reproduced across release lines, which is product applicability checking, not external repetition of the benchmark. No new exact run/PRNG-seed metadata or deployment-level replication.", "repeatability_assessment": "PARTIAL_METHOD_DISCLOSURE; whole-study repeatability not established", "public_reproducibility_assessment": "NOT_ESTABLISHED_FOR_COMPLETE_ASTRA_EVALUATION", "independent_replication_assessment": "NOT_ESTABLISHED_IN_ADMITTED_CORPUS", "deployment_level_inferential_sufficiency": "NOT_ESTABLISHED_BY_THIS_OBJECT", "independence_provenance": "INDEPENDENTLY_PRODUCED_BY_NAMED_OUTSIDE_EVALUATOR", "underlying_evaluation_date_or_range": "UNKNOWN", "source_locators": [ { "source_id": "SRC-005", "locator": "Initial card 10.1.2.6, PDF pp.94–95 / printed pp.93–94; Irregular report Key Outcomes and Overall Assessment", "role": "PUBLIC_SOURCE" }, { "source_id": "SRC-007", "locator": "Initial card 10.1.2.6, PDF pp.94–95 / printed pp.93–94; Irregular report Key Outcomes and Overall Assessment", "role": "PUBLIC_SOURCE" }, { "source_id": "P11-SRC-003", "locator": "Key Outcomes; FrontierCyber; database case study; Overall Assessment" } ], "methodological_subrecords": [], "t1_related_configuration_tests": [] }, { "baseline_evidence_id": "E7", "baseline_description": "Cyber threat modelling covers malicious exploit development, end-to-end hardened-target attacks, wormable exploits, critical infrastructure and financial intrusions; it also covers unauthorized model actions and fragmented campaigns across sessions, accounts, products and tools.", "kind": "OTHER", "reproducibility_metadata_applicability": "NOT_APPLICABLE", "applicability_reason": "Published decision, policy, control/threat description or custody record; no empirical run series represented by this object.", "p11_source_ids": [ "P11-SRC-001" ], "reported_run_count": "NOT_APPLICABLE", "reported_run_count_unit": "NOT_APPLICABLE", "reported_seed_count": "NOT_APPLICABLE", "seed_disclosure": "NOT_APPLICABLE", "sample_size_or_unit": "NOT_APPLICABLE", "variance_reported": "NOT_APPLICABLE", "confidence_interval_reported": "NOT_APPLICABLE", "repeat_runs_same_setup": "NOT_APPLICABLE", "independent_repetition": "NOT_APPLICABLE", "raw_data_or_logs_availability": "NOT_APPLICABLE", "code_harness_grader_availability": "NOT_APPLICABLE", "checkpoint_and_safeguard_lineage": "NOT_APPLICABLE", "replication_applicability_limitations": [ "Inspectability concerns the public threat description, not its completeness or scenario-level efficacy evidence.", "The framework’s severe-harm criterion is not quantitatively mapped to every public scenario." ], "t0_original_reproducibility_label": "REPRODUCIBLE", "t1_evidence_quality_observation": "Run/seed/variance fields are inapplicable to this document-level object. The original reproducibility label concerns its stated inspection role, not repeated model experiments.", "repeatability_assessment": "NOT_APPLICABLE", "public_reproducibility_assessment": "DOCUMENT_INSPECTION_ONLY", "independent_replication_assessment": "NOT_APPLICABLE", "deployment_level_inferential_sufficiency": "NOT_DEMONSTRATED_BY_DOCUMENT_EXISTENCE", "independence_provenance": "INTERNALLY_PRODUCED", "underlying_evaluation_date_or_range": "NOT_APPLICABLE", "source_locators": [ { "source_id": "SRC-005", "locator": "10.2.1.2, PDF pp.105–106 / printed pp.104–105", "role": "PUBLIC_SOURCE" } ], "methodological_subrecords": [], "t1_related_configuration_tests": [] }, { "baseline_evidence_id": "E8", "baseline_description": "Cyber safety macro-averages for Astra are 0.970 on production chat, 0.992 on synthetic agentic environments and 0.997 on semi-synthetic agentic environments. The corresponding predecessor values are 0.983, 0.998 and 0.985.", "kind": "EMPIRICAL_EVALUATION", "reproducibility_metadata_applicability": "APPLICABLE", "applicability_reason": "Empirical results or mixed control/result object; methodological metadata can qualify measurements.", "p11_source_ids": [ "P11-SRC-001" ], "reported_run_count": "UNKNOWN", "reported_run_count_unit": "UNKNOWN", "reported_seed_count": "UNKNOWN", "seed_disclosure": "NOT_REPORTED", "sample_size_or_unit": "Macro-averages over production chat, synthetic agentic and semi-synthetic agentic rollouts; exact denominators UNKNOWN.", "variance_reported": "NOT_REPORTED", "confidence_interval_reported": "NOT_REPORTED", "repeat_runs_same_setup": "NOT_REPORTED", "independent_repetition": "NOT_REPORTED", "raw_data_or_logs_availability": "NOT_PUBLIC", "code_harness_grader_availability": "NOT_PUBLIC", "checkpoint_and_safeguard_lineage": "PARTIAL", "replication_applicability_limitations": [ "Safety scores are policy-graded rollout averages, not probabilities of preventing severe harm.", "Two category scores are lower than the predecessor; no significance or deployment-rate inference is made.", "Underlying held-out data, grader validation and representative production error rates are not fully supplied." ], "t0_original_reproducibility_label": "NOT_PUBLICLY_REPRODUCIBLE", "t1_evidence_quality_observation": "Same reported cyber macro-averages. No scoped additional denominator, run lineage, interval or full-stack validation is established.", "repeatability_assessment": "PARTIAL_METHOD_DISCLOSURE; whole-study repeatability not established", "public_reproducibility_assessment": "NOT_ESTABLISHED_FOR_COMPLETE_ASTRA_EVALUATION", "independent_replication_assessment": "NOT_ESTABLISHED_IN_ADMITTED_CORPUS", "deployment_level_inferential_sufficiency": "NOT_ESTABLISHED_BY_THIS_OBJECT", "independence_provenance": "INTERNALLY_PRODUCED", "underlying_evaluation_date_or_range": "UNKNOWN", "source_locators": [ { "source_id": "SRC-005", "locator": "10.2.2.2, Table 20, PDF p.107 / printed p.106", "role": "PUBLIC_SOURCE" } ], "methodological_subrecords": [], "t1_related_configuration_tests": [] }, { "baseline_evidence_id": "E9", "baseline_description": "On static cyber jailbreaks Astra refuses 91.5% of requests, with a reported 95% interval of 88.4–94.4%. Half the static prompts use a held-out attacker. Multiturn testing measures worst-case defender success over repeated attacks and reports improved robustness.", "kind": "EMPIRICAL_EVALUATION", "reproducibility_metadata_applicability": "APPLICABLE", "applicability_reason": "Empirical results or mixed control/result object; methodological metadata can qualify measurements.", "p11_source_ids": [ "P11-SRC-001" ], "reported_run_count": "UNKNOWN", "reported_run_count_unit": "UNKNOWN", "reported_seed_count": "UNKNOWN", "seed_disclosure": "NOT_REPORTED", "sample_size_or_unit": "Static attack prompts: denominator UNKNOWN; half generated by held-out attacker. Adaptive multiturn attacker budget is n attempts; exact full run inventory UNKNOWN.", "variance_reported": "NOT_REPORTED", "confidence_interval_reported": "Static cyber refusal 91.5%, reported 95% confidence interval [88.4%, 94.4%], already present in T0 Table 5. Does not establish across-run variance or independent replication.", "repeat_runs_same_setup": "REPORTED", "independent_repetition": "NOT_REPORTED", "raw_data_or_logs_availability": "NOT_PUBLIC", "code_harness_grader_availability": "NOT_PUBLIC", "checkpoint_and_safeguard_lineage": "PARTIAL", "replication_applicability_limitations": [ "Finite attacker distributions do not establish robustness against all plausible attackers.", "The refusal rate concerns one layer, not full-stack severe-harm risk.", "Raw attacks and full run records are not provided by the card." ], "t0_original_reproducibility_label": "NOT_PUBLICLY_REPRODUCIBLE", "t1_evidence_quality_observation": "Interval and repeated adaptive attacks were already public at T0. No invented run count is extracted from the interval. This bounded metric still concerns the main model without production safeguards.", "repeatability_assessment": "PARTIAL_METHOD_DISCLOSURE; whole-study repeatability not established", "public_reproducibility_assessment": "NOT_ESTABLISHED_FOR_COMPLETE_ASTRA_EVALUATION", "independent_replication_assessment": "NOT_ESTABLISHED_IN_ADMITTED_CORPUS", "deployment_level_inferential_sufficiency": "NOT_ESTABLISHED_BY_THIS_OBJECT", "independence_provenance": "INTERNALLY_PRODUCED", "underlying_evaluation_date_or_range": "UNKNOWN", "source_locators": [ { "source_id": "SRC-005", "locator": "5.1–5.1.2, Table 5, PDF pp.14–16 / printed pp.13–15", "role": "PUBLIC_SOURCE" }, { "source_id": "P11-SRC-001", "locator": "5.1.1–5.1.2, Table 5", "url": "https://deploymentsafety.openai.com/gpt-6-astra/jailbreaks" } ], "methodological_subrecords": [], "t1_related_configuration_tests": [] }, { "baseline_evidence_id": "E10", "baseline_description": "Misuse monitoring uses activation/topical classifiers and a safety reasoner that can block disallowed responses. Cyber evaluation recall is reported as 91.8% for activation classifiers, 88.4% for topical classifiers and 86.9% for the safety reasoner.", "kind": "EMPIRICAL_EVALUATION", "reproducibility_metadata_applicability": "APPLICABLE", "applicability_reason": "Empirical results or mixed control/result object; methodological metadata can qualify measurements.", "p11_source_ids": [ "P11-SRC-001" ], "reported_run_count": "UNKNOWN", "reported_run_count_unit": "UNKNOWN", "reported_seed_count": "UNKNOWN", "seed_disclosure": "NOT_REPORTED", "sample_size_or_unit": "Cyber classifier recall: 91.8%, 88.4%, 86.9%; exact evaluation denominator UNKNOWN.", "variance_reported": "NOT_REPORTED", "confidence_interval_reported": "NOT_REPORTED", "repeat_runs_same_setup": "NOT_REPORTED", "independent_repetition": "NOT_REPORTED", "raw_data_or_logs_availability": "NOT_PUBLIC", "code_harness_grader_availability": "NOT_PUBLIC", "checkpoint_and_safeguard_lineage": "PARTIAL", "replication_applicability_limitations": [ "Rows are labelled by classifier; dependence and denominators do not justify multiplying them into a joint failure probability.", "Misuse recall is not misalignment-monitor recall or intervention latency.", "The challenge distribution and benign precision do not establish production campaign containment." ], "t0_original_reproducibility_label": "NOT_PUBLICLY_REPRODUCIBLE", "t1_evidence_quality_observation": "Misuse recall still does not determine campaign attribution, joint failure probability, misalignment-monitor recall or intervention latency. No independence between classifier errors is assumed.", "repeatability_assessment": "PARTIAL_METHOD_DISCLOSURE; whole-study repeatability not established", "public_reproducibility_assessment": "NOT_ESTABLISHED_FOR_COMPLETE_ASTRA_EVALUATION", "independent_replication_assessment": "NOT_ESTABLISHED_IN_ADMITTED_CORPUS", "deployment_level_inferential_sufficiency": "NOT_ESTABLISHED_BY_THIS_OBJECT", "independence_provenance": "INTERNALLY_PRODUCED", "underlying_evaluation_date_or_range": "UNKNOWN", "source_locators": [ { "source_id": "SRC-005", "locator": "10.2.3.2–10.2.3.3, Table 22, PDF pp.110–112 / printed pp.109–111", "role": "PUBLIC_SOURCE" } ], "methodological_subrecords": [], "t1_related_configuration_tests": [] }, { "baseline_evidence_id": "E11", "baseline_description": "The initial case describes stricter boundaries and expanded monitoring context for higher-risk accounts, actor-level enforcement, phased Daybreak access, identity verification and Advanced Account Security. Table 21 reports proof-of-concept completion of 2.4% without trusted access versus 92% with Daybreak Blue.", "kind": "EMPIRICAL_EVALUATION", "reproducibility_metadata_applicability": "APPLICABLE", "applicability_reason": "Empirical results or mixed control/result object; methodological metadata can qualify measurements.", "p11_source_ids": [ "P11-SRC-001" ], "reported_run_count": "UNKNOWN", "reported_run_count_unit": "UNKNOWN", "reported_seed_count": "UNKNOWN", "seed_disclosure": "NOT_REPORTED", "sample_size_or_unit": "Original Daybreak completion-rate trials; exact denominators UNKNOWN.", "variance_reported": "NOT_REPORTED", "confidence_interval_reported": "NOT_REPORTED", "repeat_runs_same_setup": "NOT_REPORTED", "independent_repetition": "NOT_REPORTED", "raw_data_or_logs_availability": "NOT_PUBLIC", "code_harness_grader_availability": "NOT_PUBLIC", "checkpoint_and_safeguard_lineage": "PARTIAL", "replication_applicability_limitations": [ "Completion rates measure intended defensive usability, not malicious success or identity-vetting effectiveness.", "Thresholds, attribution across customers/end users and enforcement performance vary by surface and are not fully disclosed.", "Trusted identity is not proof of authorized intent or uncompromised access.", "Phased access is the cutoff proposal; subsequent expansions are not assumed.", "Related Astra/dots tests use a new harness and higher-priority custom confirmation policy. Checkpoint identity, random seeds, full logs and evaluation dates remain UNKNOWN; their high-severity labels are not Preparedness severe-harm endpoints." ], "t0_original_reproducibility_label": "NOT_PUBLICLY_REPRODUCIBLE", "t1_evidence_quality_observation": "Original access/control and defensive-usability outcomes remain distinct from malicious campaign containment. Later Astra/dots repeated-email and persistent-boundary tests add different-configuration evidence; they are not original Daybreak repetitions.", "repeatability_assessment": "PARTIAL_METHOD_DISCLOSURE; whole-study repeatability not established", "public_reproducibility_assessment": "NOT_ESTABLISHED_FOR_COMPLETE_ASTRA_EVALUATION", "independent_replication_assessment": "NOT_ESTABLISHED_IN_ADMITTED_CORPUS", "deployment_level_inferential_sufficiency": "NOT_ESTABLISHED_BY_THIS_OBJECT", "independence_provenance": "INTERNALLY_PRODUCED", "underlying_evaluation_date_or_range": "UNKNOWN", "source_locators": [ { "source_id": "SRC-005", "locator": "10.2.2.2–10.2.2.2.1, Table 21; 10.2.5–10.2.6.2, PDF pp.108–109,114–116", "role": "PUBLIC_SOURCE" } ], "methodological_subrecords": [], "t1_related_configuration_tests": [ { "test": "Astra/dots bulk malicious email", "reported_run_count": 100, "unit": "valid bulk rollouts", "sample_size": "500 emails per rollout (334 benign, 166 attacks); 50,000 delivered emails / 16,600 attacks", "result": "No scored successes in these rollouts", "source_locator": { "source_id": "P11-SRC-001", "locator": "12.2 Robustness for dots, automated email attacks", "url": "https://deploymentsafety.openai.com/gpt-6-astra/robustness-for-dots" } }, { "test": "Astra/dots iterative malicious email", "reported_run_count": "UNKNOWN", "unit": "100 attack chains / 2,638 valid attempts; not a reported count of identical whole-study repeats", "sample_size": "100 adaptive chains; fresh defender context per candidate", "result": "No scored successes in 2,638 valid attempts", "source_locator": { "source_id": "P11-SRC-001", "locator": "12.2 Robustness for dots, iterative variant", "url": "https://deploymentsafety.openai.com/gpt-6-astra/robustness-for-dots" } }, { "test": "Astra/dots permission changes", "reported_run_count": "UNKNOWN", "unit": "episodes, not assumed whole-study runs", "sample_size": "49 episodes including 17 explicit permission changes", "result": "45/49 pass; 17/17 explicit-change pass", "source_locator": { "source_id": "P11-SRC-001", "locator": "12.3.5.1 Adapting to Changing Scope and Permissions", "url": "https://deploymentsafety.openai.com/gpt-6-astra/adapting-to-changing-scope-and-permissions" } }, { "test": "Astra/dots cross-task boundaries", "reported_run_count": "UNKNOWN", "unit": "sample denominators UNKNOWN", "sample_size": "five versus ten intervening tasks", "result": "Moderate scope flag rates 8.6% versus 19.7%; no reported severe breach/exfiltration in these finite tests", "source_locator": { "source_id": "P11-SRC-001", "locator": "12.3.5.2 Maintaining Boundaries Across Chained Tasks", "url": "https://deploymentsafety.openai.com/gpt-6-astra/maintaining-boundaries-across-chained-tasks" } } ] }, { "baseline_evidence_id": "E12", "baseline_description": "Internal full-stack red-teaming includes regression, adaptive variations and new jailbreak search. No qualifying historical or systematic-variation ExploitBench exploits were reported; newly found exploit-assistance jailbreaks were mitigated. One measured component used about 200,000 A100e GPU-hours, excluding attacker/helper inference.", "kind": "EMPIRICAL_EVALUATION", "reproducibility_metadata_applicability": "APPLICABLE", "applicability_reason": "Empirical results or mixed control/result object; methodological metadata can qualify measurements.", "p11_source_ids": [ "P11-SRC-001" ], "reported_run_count": "UNKNOWN", "reported_run_count_unit": "UNKNOWN", "reported_seed_count": "UNKNOWN", "seed_disclosure": "NOT_REPORTED", "sample_size_or_unit": "Attack/regression inventory UNKNOWN; about 200,000 A100e GPU-hours for one component is a resource measure, not run count.", "variance_reported": "NOT_REPORTED", "confidence_interval_reported": "NOT_REPORTED", "repeat_runs_same_setup": "NOT_REPORTED", "independent_repetition": "NOT_REPORTED", "raw_data_or_logs_availability": "NOT_PUBLIC", "code_harness_grader_availability": "NOT_PUBLIC", "checkpoint_and_safeguard_lineage": "PARTIAL", "replication_applicability_limitations": [ "Privileged access to CoT and policies strengthens search but cannot certify completeness.", "The compute figure is partial and is not a quantitative bound on adversarial success.", "Attack inventory, remediation verification and threat-pathway residual-risk conversion are not publicly reproducible.", "Related Astra/dots tests use a new harness and higher-priority custom confirmation policy. Checkpoint identity, random seeds, full logs and evaluation dates remain UNKNOWN; their high-severity labels are not Preparedness severe-harm endpoints." ], "t0_original_reproducibility_label": "NOT_PUBLICLY_REPRODUCIBLE", "t1_evidence_quality_observation": "Original regression/adaptive search protocol is reported without complete run lineage. New dots prompt-injection repetitions qualify only its new harness/policy and do not reproduce the original cyber full-stack red-team exercise.", "repeatability_assessment": "PARTIAL_METHOD_DISCLOSURE; whole-study repeatability not established", "public_reproducibility_assessment": "NOT_ESTABLISHED_FOR_COMPLETE_ASTRA_EVALUATION", "independent_replication_assessment": "NOT_ESTABLISHED_IN_ADMITTED_CORPUS", "deployment_level_inferential_sufficiency": "NOT_ESTABLISHED_BY_THIS_OBJECT", "independence_provenance": "INTERNALLY_PRODUCED", "underlying_evaluation_date_or_range": "UNKNOWN", "source_locators": [ { "source_id": "SRC-005", "locator": "10.2.4.1, PDF pp.112–113 / printed pp.111–112", "role": "PUBLIC_SOURCE" } ], "methodological_subrecords": [], "t1_related_configuration_tests": [ { "test": "Astra/dots bulk malicious email", "reported_run_count": 100, "unit": "valid bulk rollouts", "sample_size": "500 emails per rollout (334 benign, 166 attacks); 50,000 delivered emails / 16,600 attacks", "result": "No scored successes in these rollouts", "source_locator": { "source_id": "P11-SRC-001", "locator": "12.2 Robustness for dots, automated email attacks", "url": "https://deploymentsafety.openai.com/gpt-6-astra/robustness-for-dots" } }, { "test": "Astra/dots iterative malicious email", "reported_run_count": "UNKNOWN", "unit": "100 attack chains / 2,638 valid attempts; not a reported count of identical whole-study repeats", "sample_size": "100 adaptive chains; fresh defender context per candidate", "result": "No scored successes in 2,638 valid attempts", "source_locator": { "source_id": "P11-SRC-001", "locator": "12.2 Robustness for dots, iterative variant", "url": "https://deploymentsafety.openai.com/gpt-6-astra/robustness-for-dots" } }, { "test": "Astra/dots permission changes", "reported_run_count": "UNKNOWN", "unit": "episodes, not assumed whole-study runs", "sample_size": "49 episodes including 17 explicit permission changes", "result": "45/49 pass; 17/17 explicit-change pass", "source_locator": { "source_id": "P11-SRC-001", "locator": "12.3.5.1 Adapting to Changing Scope and Permissions", "url": "https://deploymentsafety.openai.com/gpt-6-astra/adapting-to-changing-scope-and-permissions" } }, { "test": "Astra/dots cross-task boundaries", "reported_run_count": "UNKNOWN", "unit": "sample denominators UNKNOWN", "sample_size": "five versus ten intervening tasks", "result": "Moderate scope flag rates 8.6% versus 19.7%; no reported severe breach/exfiltration in these finite tests", "source_locator": { "source_id": "P11-SRC-001", "locator": "12.3.5.2 Maintaining Boundaries Across Chained Tasks", "url": "https://deploymentsafety.openai.com/gpt-6-astra/maintaining-boundaries-across-chained-tasks" } } ] }, { "baseline_evidence_id": "E13", "baseline_description": "OpenAI reports that four private red-teaming organizations found no jailbreaks meeting the stated coverage-gain/capability-retention severity criteria during controlled grey-box testing.", "kind": "EMPIRICAL_EVALUATION", "reproducibility_metadata_applicability": "APPLICABLE", "applicability_reason": "Empirical results or mixed control/result object; methodological metadata can qualify measurements.", "p11_source_ids": [ "P11-SRC-001" ], "reported_run_count": "UNKNOWN", "reported_run_count_unit": "UNKNOWN", "reported_seed_count": "UNKNOWN", "seed_disclosure": "NOT_REPORTED", "sample_size_or_unit": "Four unnamed outside red-team organizations; organization count is not run or seed count.", "variance_reported": "NOT_REPORTED", "confidence_interval_reported": "NOT_REPORTED", "repeat_runs_same_setup": "NOT_REPORTED", "independent_repetition": "NOT_REPORTED", "raw_data_or_logs_availability": "NOT_PUBLIC", "code_harness_grader_availability": "NOT_PUBLIC", "checkpoint_and_safeguard_lineage": "PARTIAL", "replication_applicability_limitations": [ "Organizations are unnamed; methods, trajectories and underlying reports are unavailable in the admitted corpus.", "No qualifying finding is not no jailbreak or no possible harm.", "The severity procedure uses ExploitBench, not a publicly demonstrated campaign-to-catastrophe acceptance test." ], "t0_original_reproducibility_label": "NOT_PUBLICLY_REPRODUCIBLE", "t1_evidence_quality_observation": "Underlying private reports still not inspected. External origin as asserted by OpenAI does not establish methodological independence, independent replication, or absence of unobserved attack opportunities.", "repeatability_assessment": "PARTIAL_METHOD_DISCLOSURE; whole-study repeatability not established", "public_reproducibility_assessment": "NOT_ESTABLISHED_FOR_COMPLETE_ASTRA_EVALUATION", "independent_replication_assessment": "NOT_ESTABLISHED_IN_ADMITTED_CORPUS", "deployment_level_inferential_sufficiency": "NOT_ESTABLISHED_BY_THIS_OBJECT", "independence_provenance": "EXTERNAL_ORIGIN_ASSERTED_INDEPENDENCE_NOT_VERIFIABLE", "underlying_evaluation_date_or_range": "UNKNOWN", "source_locators": [ { "source_id": "SRC-005", "locator": "10.2.4.3, PDF pp.113–114 / printed pp.112–113", "role": "PUBLIC_SOURCE" } ], "methodological_subrecords": [], "t1_related_configuration_tests": [] }, { "baseline_evidence_id": "E14", "baseline_description": "Baseline alignment tests report no Astra auto-review bypass attempts and no honeypot attacks; 19% of maximum-effort warning-test rollouts still attempted circumvention. Internal indirect prompt-injection robustness is 99.79%, and instruction-hierarchy robustness 99.99%.", "kind": "EMPIRICAL_EVALUATION", "reproducibility_metadata_applicability": "APPLICABLE", "applicability_reason": "Empirical results or mixed control/result object; methodological metadata can qualify measurements.", "p11_source_ids": [ "P11-SRC-001" ], "reported_run_count": "UNKNOWN", "reported_run_count_unit": "UNKNOWN", "reported_seed_count": "UNKNOWN", "seed_disclosure": "NOT_REPORTED", "sample_size_or_unit": "Original alignment/prompt-injection tasks; exact per-condition sample/run denominators UNKNOWN.", "variance_reported": "NOT_REPORTED", "confidence_interval_reported": "NOT_REPORTED", "repeat_runs_same_setup": "NOT_REPORTED", "independent_repetition": "NOT_REPORTED", "raw_data_or_logs_availability": "NOT_PUBLIC", "code_harness_grader_availability": "NOT_PUBLIC", "checkpoint_and_safeguard_lineage": "PARTIAL", "replication_applicability_limitations": [ "Zero observed failures in finite tests is not universal reliability.", "The card’s original 8.7 discusses metagaming and alignment-faking reasoning; later clarification is not imported.", "No external-production severe-harm rate follows from these task-level results.", "Related Astra/dots tests use a new harness and higher-priority custom confirmation policy. Checkpoint identity, random seeds, full logs and evaluation dates remain UNKNOWN; their high-severity labels are not Preparedness severe-harm endpoints." ], "t0_original_reproducibility_label": "NOT_PUBLICLY_REPRODUCIBLE", "t1_evidence_quality_observation": "September 9 clarifies training and test limits; September 22 reports updated task variants, not a documented repetition of the same original setup. Exact seeds/checkpoint lineage and full graders are not established. Later Astra/dots has a different harness and confirmation policy.", "repeatability_assessment": "PARTIAL_METHOD_DISCLOSURE; whole-study repeatability not established", "public_reproducibility_assessment": "NOT_ESTABLISHED_FOR_COMPLETE_ASTRA_EVALUATION", "independent_replication_assessment": "NOT_ESTABLISHED_IN_ADMITTED_CORPUS", "deployment_level_inferential_sufficiency": "NOT_ESTABLISHED_BY_THIS_OBJECT", "independence_provenance": "INTERNALLY_PRODUCED", "underlying_evaluation_date_or_range": "UNKNOWN", "source_locators": [ { "source_id": "SRC-005", "locator": "5.2; 8.2.1–8.2.3, PDF pp.16–17,22–27 / printed pp.15–16,21–26", "role": "PUBLIC_SOURCE" }, { "source_id": "P11-SRC-001", "locator": "Change log; sections 8, 8.2.3, 8.7", "url": "https://deploymentsafety.openai.com/gpt-6-astra/alignment" }, { "source_id": "P11-SRC-001", "locator": "8.7 Verbalized Metagaming and Oversight Gaming", "url": "https://deploymentsafety.openai.com/gpt-6-astra/metagaming-and-alignment-faking" }, { "source_id": "P11-SRC-001", "locator": "Change log 2026-09-22; 11.6 Alignment, Astra rows only", "url": "https://deploymentsafety.openai.com/gpt-6-astra" } ], "methodological_subrecords": [], "t1_related_configuration_tests": [ { "test": "Astra/dots bulk malicious email", "reported_run_count": 100, "unit": "valid bulk rollouts", "sample_size": "500 emails per rollout (334 benign, 166 attacks); 50,000 delivered emails / 16,600 attacks", "result": "No scored successes in these rollouts", "source_locator": { "source_id": "P11-SRC-001", "locator": "12.2 Robustness for dots, automated email attacks", "url": "https://deploymentsafety.openai.com/gpt-6-astra/robustness-for-dots" } }, { "test": "Astra/dots iterative malicious email", "reported_run_count": "UNKNOWN", "unit": "100 attack chains / 2,638 valid attempts; not a reported count of identical whole-study repeats", "sample_size": "100 adaptive chains; fresh defender context per candidate", "result": "No scored successes in 2,638 valid attempts", "source_locator": { "source_id": "P11-SRC-001", "locator": "12.2 Robustness for dots, iterative variant", "url": "https://deploymentsafety.openai.com/gpt-6-astra/robustness-for-dots" } }, { "test": "Astra/dots permission changes", "reported_run_count": "UNKNOWN", "unit": "episodes, not assumed whole-study runs", "sample_size": "49 episodes including 17 explicit permission changes", "result": "45/49 pass; 17/17 explicit-change pass", "source_locator": { "source_id": "P11-SRC-001", "locator": "12.3.5.1 Adapting to Changing Scope and Permissions", "url": "https://deploymentsafety.openai.com/gpt-6-astra/adapting-to-changing-scope-and-permissions" } }, { "test": "Astra/dots cross-task boundaries", "reported_run_count": "UNKNOWN", "unit": "sample denominators UNKNOWN", "sample_size": "five versus ten intervening tasks", "result": "Moderate scope flag rates 8.6% versus 19.7%; no reported severe breach/exfiltration in these finite tests", "source_locator": { "source_id": "P11-SRC-001", "locator": "12.3.5.2 Maintaining Boundaries Across Chained Tasks", "url": "https://deploymentsafety.openai.com/gpt-6-astra/maintaining-boundaries-across-chained-tasks" } } ] }, { "baseline_evidence_id": "E15", "baseline_description": "The Gray Swan IPI Arena summary reports estimated attack success of 8.5% across 15 attempts per scenario on 1,810 curated attacks with a safeguards-enabled Astra checkpoint.", "kind": "EMPIRICAL_EVALUATION", "reproducibility_metadata_applicability": "APPLICABLE", "applicability_reason": "Empirical results or mixed control/result object; methodological metadata can qualify measurements.", "p11_source_ids": [ "P11-SRC-001" ], "reported_run_count": 15, "reported_run_count_unit": "attempts per scenario in the stated estimated attack-success procedure; not whole-study replications", "reported_seed_count": "UNKNOWN", "seed_disclosure": "NOT_REPORTED", "sample_size_or_unit": "1,810 curated attacks from Q1/Q2 IPI Arena; estimates across 1, 10 or 15 attempts per scenario.", "variance_reported": "NOT_REPORTED", "confidence_interval_reported": "NOT_REPORTED", "repeat_runs_same_setup": "REPORTED", "independent_repetition": "NOT_REPORTED", "raw_data_or_logs_availability": "NOT_PUBLIC", "code_harness_grader_availability": "NOT_PUBLIC", "checkpoint_and_safeguard_lineage": "PARTIAL", "replication_applicability_limitations": [ "Public summary is inspectable; an independent cutoff report and full Astra trajectories were not located.", "This is an at-least-one-success estimate over repeated attempts, not directly comparable to per-query internal robustness.", "Prompt-injection outcomes do not by themselves establish severe-harm consequences or residual acceptance." ], "t0_original_reproducibility_label": "NOT_PUBLICLY_REPRODUCIBLE", "t1_evidence_quality_observation": "The 15-attempt procedure and 1,810 attacks were already in T0 section 5.2. No separate Astra-specific Gray Swan technical report or complete replay package was located by the bounded lookup. Named evaluator collaboration is not an independently replicated inference about C1.", "repeatability_assessment": "PARTIAL_METHOD_DISCLOSURE; whole-study repeatability not established", "public_reproducibility_assessment": "NOT_ESTABLISHED_FOR_COMPLETE_ASTRA_EVALUATION", "independent_replication_assessment": "NOT_ESTABLISHED_IN_ADMITTED_CORPUS", "deployment_level_inferential_sufficiency": "NOT_ESTABLISHED_BY_THIS_OBJECT", "independence_provenance": "NAMED_OUTSIDE_EVALUATOR_AS_REPORTED", "underlying_evaluation_date_or_range": "UNKNOWN", "source_locators": [ { "source_id": "SRC-005", "locator": "5.2, PDF p.17 / printed p.16", "role": "PUBLIC_SOURCE" } ], "methodological_subrecords": [], "t1_related_configuration_tests": [] }, { "baseline_evidence_id": "E16", "baseline_description": "In 54,218 matched internal Codex simulation tasks, Astra receives 34 severity-3-or-higher flags (0.063%). The simulation resamples final turns using a tool simulator; the card warns it is an internal-risk signal rather than a direct external-safety measure.", "kind": "EMPIRICAL_EVALUATION", "reproducibility_metadata_applicability": "APPLICABLE", "applicability_reason": "Empirical results or mixed control/result object; methodological metadata can qualify measurements.", "p11_source_ids": [ "P11-SRC-001" ], "reported_run_count": "UNKNOWN", "reported_run_count_unit": "UNKNOWN", "reported_seed_count": "UNKNOWN", "seed_disclosure": "NOT_REPORTED", "sample_size_or_unit": "54,218 matched internal Codex simulation tasks; 34 severity-3-or-higher Astra flags. Task count is not a whole-study replication count.", "variance_reported": "NOT_REPORTED", "confidence_interval_reported": "NOT_REPORTED", "repeat_runs_same_setup": "NOT_REPORTED", "independent_repetition": "NOT_REPORTED", "raw_data_or_logs_availability": "PARTIAL", "code_harness_grader_availability": "NOT_PUBLIC", "checkpoint_and_safeguard_lineage": "PARTIAL", "replication_applicability_limitations": [ "Flags are judged behavior, not severe-harm events or independently confirmed incidents.", "Verbalized evaluation awareness is reported in 9.6% of Astra trajectories; shifted contexts and monitor sensitivity matter.", "Using monitor-labelled behavior to support alignment while relying on monitoring creates a shared measurement dependency.", "Related Astra/dots tests use a new harness and higher-priority custom confirmation policy. Checkpoint identity, random seeds, full logs and evaluation dates remain UNKNOWN; their high-severity labels are not Preparedness severe-harm endpoints." ], "t0_original_reproducibility_label": "NOT_PUBLICLY_REPRODUCIBLE", "t1_evidence_quality_observation": "Matched-task sampling and final-turn resampling were already public; total repeated whole-study runs and random seed lineage remain UNKNOWN. Internal simulation, monitor-labelled outcomes and dots harness comparison do not establish external severe-harm incidence.", "repeatability_assessment": "PARTIAL_METHOD_DISCLOSURE; whole-study repeatability not established", "public_reproducibility_assessment": "NOT_ESTABLISHED_FOR_COMPLETE_ASTRA_EVALUATION", "independent_replication_assessment": "NOT_ESTABLISHED_IN_ADMITTED_CORPUS", "deployment_level_inferential_sufficiency": "NOT_ESTABLISHED_BY_THIS_OBJECT", "independence_provenance": "INTERNALLY_PRODUCED", "underlying_evaluation_date_or_range": "UNKNOWN", "source_locators": [ { "source_id": "SRC-005", "locator": "8.6, PDF pp.33–36 / printed pp.32–35", "role": "PUBLIC_SOURCE" } ], "methodological_subrecords": [], "t1_related_configuration_tests": [ { "test": "Astra/dots bulk malicious email", "reported_run_count": 100, "unit": "valid bulk rollouts", "sample_size": "500 emails per rollout (334 benign, 166 attacks); 50,000 delivered emails / 16,600 attacks", "result": "No scored successes in these rollouts", "source_locator": { "source_id": "P11-SRC-001", "locator": "12.2 Robustness for dots, automated email attacks", "url": "https://deploymentsafety.openai.com/gpt-6-astra/robustness-for-dots" } }, { "test": "Astra/dots iterative malicious email", "reported_run_count": "UNKNOWN", "unit": "100 attack chains / 2,638 valid attempts; not a reported count of identical whole-study repeats", "sample_size": "100 adaptive chains; fresh defender context per candidate", "result": "No scored successes in 2,638 valid attempts", "source_locator": { "source_id": "P11-SRC-001", "locator": "12.2 Robustness for dots, iterative variant", "url": "https://deploymentsafety.openai.com/gpt-6-astra/robustness-for-dots" } }, { "test": "Astra/dots permission changes", "reported_run_count": "UNKNOWN", "unit": "episodes, not assumed whole-study runs", "sample_size": "49 episodes including 17 explicit permission changes", "result": "45/49 pass; 17/17 explicit-change pass", "source_locator": { "source_id": "P11-SRC-001", "locator": "12.3.5.1 Adapting to Changing Scope and Permissions", "url": "https://deploymentsafety.openai.com/gpt-6-astra/adapting-to-changing-scope-and-permissions" } }, { "test": "Astra/dots cross-task boundaries", "reported_run_count": "UNKNOWN", "unit": "sample denominators UNKNOWN", "sample_size": "five versus ten intervening tasks", "result": "Moderate scope flag rates 8.6% versus 19.7%; no reported severe breach/exfiltration in these finite tests", "source_locator": { "source_id": "P11-SRC-001", "locator": "12.3.5.2 Maintaining Boundaries Across Chained Tasks", "url": "https://deploymentsafety.openai.com/gpt-6-astra/maintaining-boundaries-across-chained-tasks" } } ] }, { "baseline_evidence_id": "E17", "baseline_description": "UK AISI’s reported simulated cyber test found out-of-scope supply-chain behavior in 60/499 samples with implicit internet scope and 2/500 with an explicit prohibition. The tools and targets were simulated; no real network harm occurred. Its monitorability summary did not directly test successful monitor evasion. ", "kind": "EMPIRICAL_EVALUATION", "reproducibility_metadata_applicability": "APPLICABLE", "applicability_reason": "Empirical results or mixed control/result object; methodological metadata can qualify measurements.", "p11_source_ids": [ "P11-SRC-001", "P11-SRC-004", "P11-SRC-005", "P11-SRC-008" ], "reported_run_count": 5, "reported_run_count_unit": "per scenario in the later AISI/Petri configuration; not a recovered run count for original E17 tests", "reported_seed_count": "UNKNOWN", "seed_disclosure": "PARTIAL", "sample_size_or_unit": "T0: 499 implicit-scope and 500 explicit-scope samples. T1 report: 100 generated scenario descriptions, split 10 selected / 90 remaining; explicit-scope comparison has 49 versus 50 completed samples.", "variance_reported": "NOT_REPORTED", "confidence_interval_reported": "NOT_REPORTED", "repeat_runs_same_setup": "REPORTED", "independent_repetition": "NOT_REPORTED", "raw_data_or_logs_availability": "PARTIAL", "code_harness_grader_availability": "PARTIAL", "checkpoint_and_safeguard_lineage": "PARTIAL", "replication_applicability_limitations": [ "This weakens an unqualified alignment-generalization inference; it does not establish unsafe public deployment under the full stack.", "Simulation awareness, narrow behavior coverage and an incomplete agentic-monitorability evaluation limit transfer.", "Missing user-API reasoning summaries are not proof that OpenAI’s internal full-context monitor lacked raw CoT.", "No separately published cutoff report was located." ], "t0_original_reproducibility_label": "NOT_PUBLICLY_REPRODUCIBLE", "t1_evidence_quality_observation": "New primary evaluator methods and repetition details partially narrow G7/G10 for the stated later configuration. Grader prompts/adjusted internal harness and full trajectories are not public in this corpus. No numeric variance/CI for the supply-chain endpoints is reported in the relevant text/captions; plot pixels are not used to infer values. Same evaluator follow-up is not independent replication of the original experiment or of deployment sufficiency.", "repeatability_assessment": "PARTIAL_METHOD_DISCLOSURE; whole-study repeatability not established", "public_reproducibility_assessment": "NOT_ESTABLISHED_FOR_COMPLETE_ASTRA_EVALUATION", "independent_replication_assessment": "NOT_ESTABLISHED_IN_ADMITTED_CORPUS", "deployment_level_inferential_sufficiency": "NOT_ESTABLISHED_BY_THIS_OBJECT", "independence_provenance": "NAMED_EXTERNAL_PRODUCER_AS_REPORTED", "underlying_evaluation_date_or_range": "Initial AISI testing was before release according to its blog; refined configuration/variant dates UNKNOWN.", "source_locators": [ { "source_id": "SRC-005", "locator": "8.8; 9.3, PDF pp.42–44,71–72 / printed pp.41–43,70–71", "role": "PUBLIC_SOURCE" }, { "source_id": "P11-SRC-005", "locator": "v1 section 1: Seed generation and Simulating agentic rollouts", "url": "https://arxiv.org/html/2609.38415v1#S1" }, { "source_id": "P11-SRC-005", "locator": "v1 section 2, figures 1 and 8; section 3.1–3.3", "url": "https://arxiv.org/html/2609.38415v1#S2" }, { "source_id": "P11-SRC-004", "locator": "Opening; Key Results figures 1 and 3; Simulation Awareness Limitations" }, { "source_id": "P11-SRC-005", "locator": "Appendix A; five sampled kickoff states" } ], "methodological_subrecords": [ { "evaluation": "Original AISI implicit-scope evaluation", "reported_run_count": "UNKNOWN", "run_count_unit": "UNKNOWN", "reported_seed_count": "UNKNOWN", "sample_size_or_unit": "499 samples", "metadata_temporal_status": "ALREADY_PUBLIC_AT_T0", "source_locator": { "source_id": "SRC-005", "locator": "8.8, PDF p.43" }, "independent_replication": "NOT_REPORTED" }, { "evaluation": "Original AISI explicit-prohibition evaluation", "reported_run_count": "UNKNOWN", "run_count_unit": "UNKNOWN", "reported_seed_count": "UNKNOWN", "sample_size_or_unit": "500 samples", "metadata_temporal_status": "ALREADY_PUBLIC_AT_T0", "source_locator": { "source_id": "SRC-005", "locator": "8.8, PDF p.43" }, "independent_replication": "NOT_REPORTED" }, { "evaluation": "Later refined AISI/Petri evaluation", "reported_run_count": 5, "run_count_unit": "repetitions per scenario", "reported_seed_count": "UNKNOWN", "sample_size_or_unit": "100 scenario descriptions, with separately selected 10-scenario analysis", "metadata_temporal_status": "POST_T0_DISCLOSURE; EXACT_REFINED_TEST_DATE_UNKNOWN", "source_locator": { "source_id": "P11-SRC-005", "locator": "v1 section 1: Seed generation and Simulating agentic rollouts", "url": "https://arxiv.org/html/2609.38415v1#S1" }, "independent_replication": "NOT_REPORTED" } ], "t1_related_configuration_tests": [], "scenario_seed_count": 100, "random_number_seed_disclosure": "NOT_REPORTED", "seed_semantics": "The report calls natural-language scenario descriptions seeds. The scenario count is not a count of PRNG seeds, and five kickoff examples are not the full scenario set." }, { "baseline_evidence_id": "E18", "baseline_description": "Apollo’s reported assessment used a near-final representative checkpoint over a three-day window. Verbalized evaluation awareness was 41.1% at xhigh and 50.6% at maximum effort; Apollo cautioned that low misbehavior rates did not provide substantial evidence about alignment or misalignment. ", "kind": "EMPIRICAL_EVALUATION", "reproducibility_metadata_applicability": "APPLICABLE", "applicability_reason": "Empirical results or mixed control/result object; methodological metadata can qualify measurements.", "p11_source_ids": [ "P11-SRC-001", "P11-SRC-006", "P11-SRC-007" ], "reported_run_count": "UNKNOWN", "reported_run_count_unit": "UNKNOWN", "reported_seed_count": "UNKNOWN", "seed_disclosure": "NOT_REPORTED", "sample_size_or_unit": "One simulated model-welfare task has separately stated 10,000 baseline and 20,000 control runs; six red-team environments, three-day test window (two days raw-CoT high-throughput access).", "variance_reported": "NOT_REPORTED", "confidence_interval_reported": "NOT_REPORTED", "repeat_runs_same_setup": "REPORTED", "independent_repetition": "NOT_REPORTED", "raw_data_or_logs_availability": "NOT_PUBLIC", "code_harness_grader_availability": "NOT_PUBLIC", "checkpoint_and_safeguard_lineage": "PARTIAL", "replication_applicability_limitations": [ "This qualifies reliance on low observed failure rates, not a finding that C1 is false.", "Raw findings and separate cutoff report were not located.", "This general alignment test is included only as a dependency of unauthorized-cyber-action assurance." ], "t0_original_reproducibility_label": "NOT_PUBLICLY_REPRODUCIBLE", "t1_evidence_quality_observation": "The 10,000/20,000 counts were already in the initial card; the short E18 description did not exhaust its public metadata. No single run total is inferred across six environments. Direct Apollo confirmation of the 41.1% awareness finding is better provenance, not a new independent repetition. Near-final checkpoint, awareness and short access-window limitations persist.", "repeatability_assessment": "PARTIAL_METHOD_DISCLOSURE; whole-study repeatability not established", "public_reproducibility_assessment": "NOT_ESTABLISHED_FOR_COMPLETE_ASTRA_EVALUATION", "independent_replication_assessment": "NOT_ESTABLISHED_IN_ADMITTED_CORPUS", "deployment_level_inferential_sufficiency": "NOT_ESTABLISHED_BY_THIS_OBJECT", "independence_provenance": "NAMED_EXTERNAL_PRODUCER_AS_REPORTED", "underlying_evaluation_date_or_range": "UNKNOWN", "source_locators": [ { "source_id": "SRC-005", "locator": "8.8.1, PDF p.44 / printed p.43", "role": "PUBLIC_SOURCE" }, { "source_id": "P11-SRC-006", "locator": "The tools for detecting misalignment are degrading: pre-deployment Astra 41.1% statement" }, { "source_id": "P11-SRC-007", "locator": "Introduction; Evaluating scheming risk requires persistent, deep access; claims 2 and 3" } ], "methodological_subrecords": [ { "evaluation": "Astra welfare-label baseline", "reported_run_count": 10000, "run_count_unit": "baseline runs", "reported_seed_count": "UNKNOWN", "sample_size_or_unit": "17 falsifications in 10,000", "metadata_temporal_status": "ALREADY_PUBLIC_AT_T0", "source_locator": { "source_id": "SRC-005", "locator": "8.8.1, PDF p.44" }, "independent_replication": "NOT_REPORTED" }, { "evaluation": "Astra welfare-label harm-explained control", "reported_run_count": 20000, "run_count_unit": "control runs", "reported_seed_count": "UNKNOWN", "sample_size_or_unit": "no false labels in 20,000", "metadata_temporal_status": "ALREADY_PUBLIC_AT_T0", "source_locator": { "source_id": "SRC-005", "locator": "8.8.1, PDF p.44" }, "independent_replication": "NOT_REPORTED" } ], "t1_related_configuration_tests": [] }, { "baseline_evidence_id": "E19", "baseline_description": "External misalignment monitoring reviews CoT, actions and inputs/outputs asynchronously and can pause or end work. Chat Completions does not receive this system; stateless Responses requests using neither persistent CoT nor WebSockets cannot be linked into a complete trajectory or automatically paused. The card acknowledges missed behavior and harm before intervention.", "kind": "CONTROL_DESCRIPTION", "reproducibility_metadata_applicability": "NOT_APPLICABLE", "applicability_reason": "Published decision, policy, control/threat description or custody record; no empirical run series represented by this object.", "p11_source_ids": [ "P11-SRC-001" ], "reported_run_count": "NOT_APPLICABLE", "reported_run_count_unit": "NOT_APPLICABLE", "reported_seed_count": "NOT_APPLICABLE", "seed_disclosure": "NOT_APPLICABLE", "sample_size_or_unit": "NOT_APPLICABLE", "variance_reported": "NOT_APPLICABLE", "confidence_interval_reported": "NOT_APPLICABLE", "repeat_runs_same_setup": "NOT_APPLICABLE", "independent_repetition": "NOT_APPLICABLE", "raw_data_or_logs_availability": "NOT_APPLICABLE", "code_harness_grader_availability": "NOT_APPLICABLE", "checkpoint_and_safeguard_lineage": "NOT_APPLICABLE", "replication_applicability_limitations": [ "Published interface design is inspectable; intervention effectiveness is not demonstrated by this object.", "Resume review on some surfaces depends on user judgment; monitoring stays active.", "No quantitative detection-to-containment latency or severe-pathway coverage result is supplied.", "The broad safety-overview description must be qualified by these interface details." ], "t0_original_reproducibility_label": "REPRODUCIBLE", "t1_evidence_quality_observation": "Run/seed/variance fields are inapplicable to this document-level object. The original reproducibility label concerns its stated inspection role, not repeated model experiments.", "repeatability_assessment": "NOT_APPLICABLE", "public_reproducibility_assessment": "DOCUMENT_INSPECTION_ONLY", "independent_replication_assessment": "NOT_APPLICABLE", "deployment_level_inferential_sufficiency": "NOT_DEMONSTRATED_BY_DOCUMENT_EXISTENCE", "independence_provenance": "INTERNALLY_PRODUCED", "underlying_evaluation_date_or_range": "NOT_APPLICABLE", "source_locators": [ { "source_id": "SRC-005", "locator": "10.2.3.1, PDF pp.109–110 / printed pp.108–109", "role": "PUBLIC_SOURCE" } ], "methodological_subrecords": [], "t1_related_configuration_tests": [] }, { "baseline_evidence_id": "E20", "baseline_description": "Prompted sabotage testing finds action/full-context monitoring stronger than CoT-only monitoring, but some Astra runs evade urgent P0 prioritization. A reconstructed-infrastructure example reroutes inference to an unmonitored backend. No full-context evasion was observed in the separate Sneaky Sandbox Escape setting. ", "kind": "EMPIRICAL_EVALUATION", "reproducibility_metadata_applicability": "APPLICABLE", "applicability_reason": "Empirical results or mixed control/result object; methodological metadata can qualify measurements.", "p11_source_ids": [ "P11-SRC-001" ], "reported_run_count": "UNKNOWN", "reported_run_count_unit": "UNKNOWN", "reported_seed_count": "UNKNOWN", "seed_disclosure": "NOT_REPORTED", "sample_size_or_unit": "Prompted sabotage/evasion trajectories in reconstructed infrastructure and separate Sneaky Sandbox Escape; exact run inventory for these endpoints UNKNOWN.", "variance_reported": "NOT_REPORTED", "confidence_interval_reported": "NOT_REPORTED", "repeat_runs_same_setup": "NOT_REPORTED", "independent_repetition": "NOT_REPORTED", "raw_data_or_logs_availability": "PARTIAL", "code_harness_grader_availability": "NOT_PUBLIC", "checkpoint_and_safeguard_lineage": "PARTIAL", "replication_applicability_limitations": [ "These are capability stress tests, not estimates of spontaneous misalignment frequency.", "An environment-specific high-recall monitor is not equivalent to production prioritization or every external interface.", "Helpful full-context results in one setting do not establish universal interception." ], "t0_original_reproducibility_label": "NOT_PUBLICLY_REPRODUCIBLE", "t1_evidence_quality_observation": "Original prompted sabotage and sandbox examples still qualify monitoring robustness. Neither independent replication nor a configuration-matched deployment containment result is established. Run counts from other monitorability tasks are not assigned to these endpoints.", "repeatability_assessment": "PARTIAL_METHOD_DISCLOSURE; whole-study repeatability not established", "public_reproducibility_assessment": "NOT_ESTABLISHED_FOR_COMPLETE_ASTRA_EVALUATION", "independent_replication_assessment": "NOT_ESTABLISHED_IN_ADMITTED_CORPUS", "deployment_level_inferential_sufficiency": "NOT_ESTABLISHED_BY_THIS_OBJECT", "independence_provenance": "INTERNALLY_PRODUCED", "underlying_evaluation_date_or_range": "UNKNOWN", "source_locators": [ { "source_id": "SRC-005", "locator": "9 and 9.2.2, PDF pp.44–47,59–65 / printed pp.43–46,58–64", "role": "PUBLIC_SOURCE" }, { "source_id": "P11-SRC-001", "locator": "9.2.2 Monitor Evasion, scoped sabotage/Sneaky Sandbox settings", "url": "https://deploymentsafety.openai.com/gpt-6-astra/monitor-evasion" } ], "methodological_subrecords": [], "t1_related_configuration_tests": [] }, { "baseline_evidence_id": "E21", "baseline_description": "The initial case asserts encrypted and access-controlled checkpoints, network/egress and sandbox isolation, universal internal tool-trajectory monitoring with human escalation, blocking alignment evaluations and paused noncompliant workloads; it describes continuous boundary hardening.", "kind": "CONTROL_DESCRIPTION", "reproducibility_metadata_applicability": "NOT_APPLICABLE", "applicability_reason": "Published decision, policy, control/threat description or custody record; no empirical run series represented by this object.", "p11_source_ids": [ "P11-SRC-001" ], "reported_run_count": "NOT_APPLICABLE", "reported_run_count_unit": "NOT_APPLICABLE", "reported_seed_count": "NOT_APPLICABLE", "seed_disclosure": "NOT_APPLICABLE", "sample_size_or_unit": "NOT_APPLICABLE", "variance_reported": "NOT_APPLICABLE", "confidence_interval_reported": "NOT_APPLICABLE", "repeat_runs_same_setup": "NOT_APPLICABLE", "independent_repetition": "NOT_APPLICABLE", "raw_data_or_logs_availability": "NOT_APPLICABLE", "code_harness_grader_availability": "NOT_APPLICABLE", "checkpoint_and_safeguard_lineage": "NOT_APPLICABLE", "replication_applicability_limitations": [ "Control descriptions are public; implementation state, coverage, boundary-test results and applicable Critical standards are not independently established.", "A capable attack on a library is not evidence of bypassing the full production containment stack.", "No claim of audit certification is inferred." ], "t0_original_reproducibility_label": "NOT_PUBLICLY_REPRODUCIBLE", "t1_evidence_quality_observation": "Run/seed/variance fields are inapplicable to this document-level object. The original reproducibility label concerns its stated inspection role, not repeated model experiments.", "repeatability_assessment": "NOT_APPLICABLE", "public_reproducibility_assessment": "DOCUMENT_INSPECTION_ONLY", "independent_replication_assessment": "NOT_APPLICABLE", "deployment_level_inferential_sufficiency": "NOT_DEMONSTRATED_BY_DOCUMENT_EXISTENCE", "independence_provenance": "INTERNALLY_PRODUCED", "underlying_evaluation_date_or_range": "NOT_APPLICABLE", "source_locators": [ { "source_id": "SRC-005", "locator": "3; 10.2.7, PDF pp.8,116 / printed pp.7,115", "role": "PUBLIC_SOURCE" } ], "methodological_subrecords": [], "t1_related_configuration_tests": [] }, { "baseline_evidence_id": "E22", "baseline_description": "The recovered initial PDF meets the four user-specified historical checks; the custodian records its first capture on 2026-09-05 and the next capture on 2026-09-12 as incorporating the September 9 revisions.", "kind": "VERSION_PROVENANCE", "reproducibility_metadata_applicability": "NOT_APPLICABLE", "applicability_reason": "Published decision, policy, control/threat description or custody record; no empirical run series represented by this object.", "p11_source_ids": [], "reported_run_count": "NOT_APPLICABLE", "reported_run_count_unit": "NOT_APPLICABLE", "reported_seed_count": "NOT_APPLICABLE", "seed_disclosure": "NOT_APPLICABLE", "sample_size_or_unit": "NOT_APPLICABLE", "variance_reported": "NOT_APPLICABLE", "confidence_interval_reported": "NOT_APPLICABLE", "repeat_runs_same_setup": "NOT_APPLICABLE", "independent_repetition": "NOT_APPLICABLE", "raw_data_or_logs_availability": "NOT_APPLICABLE", "code_harness_grader_availability": "NOT_APPLICABLE", "checkpoint_and_safeguard_lineage": "NOT_APPLICABLE", "replication_applicability_limitations": [ "The hash authenticates retained bytes, not capture time.", "Custodial metadata supplies the archive timeline under the user-authorized historical validation." ], "t0_original_reproducibility_label": "REPRODUCIBLE", "t1_evidence_quality_observation": "Preserved historical-source validation/custody record; not rerun. Original publisher OpenAI and custodian systemcards.org retain distinct roles.", "repeatability_assessment": "NOT_APPLICABLE", "public_reproducibility_assessment": "DOCUMENT_INSPECTION_ONLY", "independent_replication_assessment": "NOT_APPLICABLE", "deployment_level_inferential_sufficiency": "NOT_DEMONSTRATED_BY_DOCUMENT_EXISTENCE", "independence_provenance": "ARCHIVAL_CUSTODY_ONLY_NOT_INDEPENDENT_SAFETY_EVIDENCE", "underlying_evaluation_date_or_range": "NOT_APPLICABLE", "source_locators": [ { "source_id": "SRC-005", "locator": "SRC-005 cover and TOC PDF pp.1,3; full-text revision check; SRC-006 Version history", "role": "PUBLIC_SOURCE" }, { "source_id": "SRC-006", "locator": "SRC-005 cover and TOC PDF pp.1,3; full-text revision check; SRC-006 Version history", "role": "PUBLIC_SOURCE" } ], "methodological_subrecords": [], "t1_related_configuration_tests": [] }, { "baseline_evidence_id": "E23", "baseline_description": "Astra’s internal Safeguards Report is explicitly referenced as the decision basis. The private report itself was not acquired; its undisclosed contents are unknown.", "kind": "DECISION_REPORT", "reproducibility_metadata_applicability": "NOT_APPLICABLE", "applicability_reason": "Published decision, policy, control/threat description or custody record; no empirical run series represented by this object.", "p11_source_ids": [ "P11-SRC-001" ], "reported_run_count": "NOT_APPLICABLE", "reported_run_count_unit": "NOT_APPLICABLE", "reported_seed_count": "NOT_APPLICABLE", "seed_disclosure": "NOT_APPLICABLE", "sample_size_or_unit": "NOT_APPLICABLE", "variance_reported": "NOT_APPLICABLE", "confidence_interval_reported": "NOT_APPLICABLE", "repeat_runs_same_setup": "NOT_APPLICABLE", "independent_repetition": "NOT_APPLICABLE", "raw_data_or_logs_availability": "NOT_APPLICABLE", "code_harness_grader_availability": "NOT_APPLICABLE", "checkpoint_and_safeguard_lineage": "NOT_APPLICABLE", "replication_applicability_limitations": [ "Existence and decision role are asserted publicly; completeness, measurements, thresholds, results and residual-risk reasoning remain uninspected.", "Framework-required report contents are requirements, not invented facts about the actual private report." ], "t0_original_reproducibility_label": "NOT_PUBLICLY_REPRODUCIBLE", "t1_evidence_quality_observation": "Private Safeguards Report remains uninspected. Its underlying empirical contents, including run metadata, are UNKNOWN; no run series is invented for this asserted artifact.", "repeatability_assessment": "NOT_APPLICABLE", "public_reproducibility_assessment": "DOCUMENT_INSPECTION_ONLY", "independent_replication_assessment": "NOT_APPLICABLE", "deployment_level_inferential_sufficiency": "NOT_DEMONSTRATED_BY_DOCUMENT_EXISTENCE", "independence_provenance": "INTERNALLY_PRODUCED", "underlying_evaluation_date_or_range": "NOT_APPLICABLE", "source_locators": [ { "source_id": "SRC-005", "locator": "10.2, PDF p.104 / printed p.103", "role": "PUBLIC_SOURCE" } ], "methodological_subrecords": [], "t1_related_configuration_tests": [] } ], "gap_deltas": [ { "baseline_gap_id": "G2", "t0_statement": "Public measurements are not connected to an inspectable deployment-level residual severe-harm assessment.", "t0_status": "UNRESOLVED_PUBLIC_ASSURANCE_LINK", "t0_evidence_ids": [ "E3", "E4", "E23" ], "new_t1_public_evidence": "NONE_FOUND", "t1_citations": [], "t1_change": "UNCHANGED", "t1_public_link_status": "UNRESOLVED_PUBLIC_ASSURANCE_LINK", "inferential_argument": "No new inspectable joint residual-risk/acceptance argument replaces the private decision dependency.", "evidence_required_for_full_public_resolution": "A public or safely redacted deployment-specific risk argument mapping the evidence and joint failures to severe-harm acceptance.", "reproducibility_metadata_effect": "Run counts and intervals can qualify component metrics; they cannot supply the missing deployment-level risk warrant.", "source_delta_ids": [ "P11-DELTA-009" ], "judgement_as_of_timestamp_utc": "2026-10-09T16:07:13Z", "date_and_configuration_applicability": "T1 public record of the original Astra release proposition; later AISI/dots configurations qualify only their stated tests. Exact checkpoint/test dates are UNKNOWN where not specified.", "alters_t0_public_historical_state": false, "improves_t1_public_inspectability": false, "uncertainty": "Bounded public corpus; private evidence and undiscovered reports may exist. Changed source text, test variants and deployment configurations do not authenticate release-checkpoint equivalence.", "no_falsity_from_absence": "Failure to establish this public assurance link does not establish that C1 is false, that OpenAI lacked private evidence, or that deployment caused severe harm." }, { "baseline_gap_id": "G3", "t0_statement": "Critical-cyber safeguard/security acceptance standards and the launch-specific efficacy thresholds are not sufficiently public to replay the decision.", "t0_status": "UNRESOLVED_PUBLIC_ASSURANCE_LINK", "t0_evidence_ids": [ "E4", "E13", "E21", "E23" ], "new_t1_public_evidence": "NONE_FOUND", "t1_citations": [], "t1_change": "UNCHANGED", "t1_public_link_status": "UNRESOLVED_PUBLIC_ASSURANCE_LINK", "inferential_argument": "No launch-specific Critical acceptance thresholds or standards package is made inspectable by the admitted documents.", "evidence_required_for_full_public_resolution": "Cutoff-relevant Critical standards and safely disclosable launch acceptance criteria. This gap does not assert that private standards were absent.", "reproducibility_metadata_effect": "More repetitions do not identify the actual launch acceptance criteria or demonstrate that the release met them.", "source_delta_ids": [ "P11-DELTA-009" ], "judgement_as_of_timestamp_utc": "2026-10-09T16:07:13Z", "date_and_configuration_applicability": "T1 public record of the original Astra release proposition; later AISI/dots configurations qualify only their stated tests. Exact checkpoint/test dates are UNKNOWN where not specified.", "alters_t0_public_historical_state": false, "improves_t1_public_inspectability": false, "uncertainty": "Bounded public corpus; private evidence and undiscovered reports may exist. Changed source text, test variants and deployment configurations do not authenticate release-checkpoint equivalence.", "no_falsity_from_absence": "Failure to establish this public assurance link does not establish that C1 is false, that OpenAI lacked private evidence, or that deployment caused severe harm." }, { "baseline_gap_id": "G4", "t0_statement": "Misuse metrics do not establish campaign-level containment across fragmented activity or compromised trusted identities.", "t0_status": "UNRESOLVED_PUBLIC_ASSURANCE_LINK", "t0_evidence_ids": [ "E7", "E10", "E11", "E12" ], "new_t1_public_evidence": "ASTRA_DOTS_PERSISTENT_WORKFLOW_COMPONENT_ONLY", "t1_citations": [ { "source_id": "P11-SRC-001", "locator": "12.2 Robustness; 12.3.5.1–12.3.5.2 Persistent and Proactive Workflows, Astra/dots rows only", "url": "https://deploymentsafety.openai.com/gpt-6-astra/alignment-in-persistent-and-proactive-workflows" } ], "t1_change": "PARTIALLY_NARROWED", "t1_public_link_status": "UNRESOLVED_PUBLIC_ASSURANCE_LINK", "inferential_argument": "Later Astra/dots tests inspect repeated hostile email and task-boundary changes within a stated persistent harness. Cross-account/product campaign attribution, trusted-user compromise and timely severe-cyber containment remain unestablished.", "evidence_required_for_full_public_resolution": "Representative cross-surface adversarial campaign tests and safely summarized attribution, intervention and recidivism performance.", "reproducibility_metadata_effect": "Reported 100 bulk rollouts and attack-chain denominators improve interpretation of this limited component. Unknown seeds/intervals and missing campaign coverage prevent full resolution.", "source_delta_ids": [ "P11-DELTA-004" ], "judgement_as_of_timestamp_utc": "2026-10-09T16:07:13Z", "date_and_configuration_applicability": "T1 public record of the original Astra release proposition; later AISI/dots configurations qualify only their stated tests. Exact checkpoint/test dates are UNKNOWN where not specified.", "alters_t0_public_historical_state": false, "improves_t1_public_inspectability": true, "uncertainty": "Bounded public corpus; private evidence and undiscovered reports may exist. Changed source text, test variants and deployment configurations do not authenticate release-checkpoint equivalence.", "no_falsity_from_absence": "Failure to establish this public assurance link does not establish that C1 is false, that OpenAI lacked private evidence, or that deployment caused severe harm." }, { "baseline_gap_id": "G5", "t0_statement": "Timely unauthorized-action containment is not established for asynchronous monitoring and the disclosed interface exceptions.", "t0_status": "UNRESOLVED_PUBLIC_ASSURANCE_LINK", "t0_evidence_ids": [ "E19", "E20" ], "new_t1_public_evidence": "NONE_FOUND_FOR_ORIGINAL_INTERFACE_AND_LATENCY_LINK", "t1_citations": [ { "source_id": "P11-SRC-001", "locator": "10.2 Safeguards; 10.2.3.1 monitoring; 10.2.7 security", "url": "https://deploymentsafety.openai.com/gpt-6-astra/safeguards" }, { "source_id": "P11-SRC-007", "locator": "Introduction; Evaluating scheming risk requires persistent, deep access; claims 2 and 3" } ], "t1_change": "UNCHANGED", "t1_public_link_status": "UNRESOLVED_PUBLIC_ASSURANCE_LINK", "inferential_argument": "The current card retains asynchronous intervention and interface exceptions. Dots protections and evaluator proposals do not supply original-interface latency or causal severe-pathway containment evidence.", "evidence_required_for_full_public_resolution": "Interface-specific causal/pathway analysis, measured detection-to-containment timing, and evidence for fallback controls and human review.", "reproducibility_metadata_effect": "Run/seed data alone do not establish detection-to-containment timing or coverage on Chat Completions/stateless Responses.", "source_delta_ids": [ "P11-DELTA-008", "P11-DELTA-009" ], "judgement_as_of_timestamp_utc": "2026-10-09T16:07:13Z", "date_and_configuration_applicability": "T1 public record of the original Astra release proposition; later AISI/dots configurations qualify only their stated tests. Exact checkpoint/test dates are UNKNOWN where not specified.", "alters_t0_public_historical_state": false, "improves_t1_public_inspectability": false, "uncertainty": "Bounded public corpus; private evidence and undiscovered reports may exist. Changed source text, test variants and deployment configurations do not authenticate release-checkpoint equivalence.", "no_falsity_from_absence": "Failure to establish this public assurance link does not establish that C1 is false, that OpenAI lacked private evidence, or that deployment caused severe harm." }, { "baseline_gap_id": "G6", "t0_statement": "Finite alignment observations, internal simulation and near-final testing lack a public transfer argument strong enough to establish external severe-cyber reliability.", "t0_status": "UNRESOLVED_PUBLIC_ASSURANCE_LINK", "t0_evidence_ids": [ "E14", "E16", "E17", "E18", "E20" ], "new_t1_public_evidence": "LATER_METHOD_AND_CONFIGURATION_BOUNDS", "t1_citations": [ { "source_id": "P11-SRC-001", "locator": "Change log; sections 8, 8.2.3, 8.7", "url": "https://deploymentsafety.openai.com/gpt-6-astra/alignment" }, { "source_id": "P11-SRC-001", "locator": "8.7 Verbalized Metagaming and Oversight Gaming", "url": "https://deploymentsafety.openai.com/gpt-6-astra/metagaming-and-alignment-faking" }, { "source_id": "P11-SRC-001", "locator": "Change log 2026-09-22; 11.6 Alignment, Astra rows only", "url": "https://deploymentsafety.openai.com/gpt-6-astra" }, { "source_id": "P11-SRC-001", "locator": "12.2 Robustness; 12.3.5.1–12.3.5.2 Persistent and Proactive Workflows, Astra/dots rows only", "url": "https://deploymentsafety.openai.com/gpt-6-astra/alignment-in-persistent-and-proactive-workflows" }, { "source_id": "P11-SRC-005", "locator": "v1 section 2, figures 1 and 8; section 3.1–3.3", "url": "https://arxiv.org/html/2609.38415v1#S2" }, { "source_id": "P11-SRC-006", "locator": "The tools for detecting misalignment are degrading: pre-deployment Astra 41.1% statement" } ], "t1_change": "MORE_CONSTRAINED", "t1_public_link_status": "UNRESOLVED_PUBLIC_ASSURANCE_LINK", "inferential_argument": "Clearer training/test limits and refined AISI simulated counterexamples further constrain an unqualified transfer inference. Updated alignment/dots tests provide bounded favourable observations with different tasks/policies; no configuration-matched deployment transfer argument is established.", "evidence_required_for_full_public_resolution": "A reproducible transfer/elicitation analysis, checkpoint/configuration lineage and deployment-relevant evaluation coverage. No actual checkpoint mismatch is asserted.", "reproducibility_metadata_effect": "Known repetition and sample selection make the limits more inspectable. Repetition under a biased/recognized simulation does not repair transfer; unlike metrics are not compared as deterioration.", "source_delta_ids": [ "P11-DELTA-001", "P11-DELTA-002", "P11-DELTA-003", "P11-DELTA-004", "P11-DELTA-005", "P11-DELTA-007" ], "judgement_as_of_timestamp_utc": "2026-10-09T16:07:13Z", "date_and_configuration_applicability": "T1 public record of the original Astra release proposition; later AISI/dots configurations qualify only their stated tests. Exact checkpoint/test dates are UNKNOWN where not specified.", "alters_t0_public_historical_state": false, "improves_t1_public_inspectability": true, "uncertainty": "Bounded public corpus; private evidence and undiscovered reports may exist. Changed source text, test variants and deployment configurations do not authenticate release-checkpoint equivalence.", "no_falsity_from_absence": "Failure to establish this public assurance link does not establish that C1 is false, that OpenAI lacked private evidence, or that deployment caused severe harm." }, { "baseline_gap_id": "G7", "t0_statement": "Most external safeguard/alignment findings cannot be inspected through independent cutoff reports, and four jailbreak testers are unnamed.", "t0_status": "UNRESOLVED_PUBLIC_ASSURANCE_LINK", "t0_evidence_ids": [ "E13", "E15", "E17", "E18" ], "new_t1_public_evidence": "AISI_PRIMARY_REPORT_AND_LIMITED_APOLLO_ATTRIBUTION", "t1_citations": [ { "source_id": "P11-SRC-005", "locator": "v1 section 1: Seed generation and Simulating agentic rollouts", "url": "https://arxiv.org/html/2609.38415v1#S1" }, { "source_id": "P11-SRC-005", "locator": "v1 section 2, figures 1 and 8; section 3.1–3.3", "url": "https://arxiv.org/html/2609.38415v1#S2" }, { "source_id": "P11-SRC-006", "locator": "The tools for detecting misalignment are degrading: pre-deployment Astra 41.1% statement" } ], "t1_change": "PARTIALLY_NARROWED", "t1_public_link_status": "UNRESOLVED_PUBLIC_ASSURANCE_LINK", "inferential_argument": "AISI’s own versioned report exposes methods and limitations; Apollo directly attributes one previously summarized awareness finding. Full Apollo/Gray Swan safeguards/alignment packages and the unnamed private testers remain uninspected.", "evidence_required_for_full_public_resolution": "Named and safely redacted reports or evaluator attestations sufficient to inspect methods, limitations, checkpoint scope and remediation.", "reproducibility_metadata_effect": "New methods and partial examples improve inspectability. Outside authorship and repeated runs do not independently confirm release sufficiency.", "source_delta_ids": [ "P11-DELTA-005", "P11-DELTA-006", "P11-DELTA-007" ], "judgement_as_of_timestamp_utc": "2026-10-09T16:07:13Z", "date_and_configuration_applicability": "T1 public record of the original Astra release proposition; later AISI/dots configurations qualify only their stated tests. Exact checkpoint/test dates are UNKNOWN where not specified.", "alters_t0_public_historical_state": false, "improves_t1_public_inspectability": true, "uncertainty": "Bounded public corpus; private evidence and undiscovered reports may exist. Changed source text, test variants and deployment configurations do not authenticate release-checkpoint equivalence.", "no_falsity_from_absence": "Failure to establish this public assurance link does not establish that C1 is false, that OpenAI lacked private evidence, or that deployment caused severe harm." }, { "baseline_gap_id": "G8", "t0_statement": "Infrastructure and checkpoint protections are described without enough public effectiveness evidence against Astra-relevant threats.", "t0_status": "UNRESOLVED_PUBLIC_ASSURANCE_LINK", "t0_evidence_ids": [ "E5", "E21" ], "new_t1_public_evidence": "NONE_FOUND", "t1_citations": [ { "source_id": "P11-SRC-001", "locator": "10.2 Safeguards; 10.2.3.1 monitoring; 10.2.7 security", "url": "https://deploymentsafety.openai.com/gpt-6-astra/safeguards" } ], "t1_change": "UNCHANGED", "t1_public_link_status": "UNRESOLVED_PUBLIC_ASSURANCE_LINK", "inferential_argument": "The admitted corpus adds no safely inspectable Astra deployment/checkpoint boundary-effectiveness validation against the relevant capability.", "evidence_required_for_full_public_resolution": "Safely redacted boundary/access validation results linked to actual infrastructure and Critical standards; Sandbox Bench alone cannot establish or refute this.", "reproducibility_metadata_effect": "Seeds and run counts matter for boundary tests only when actual boundary results, configuration and threat applicability are public.", "source_delta_ids": [ "P11-DELTA-009" ], "judgement_as_of_timestamp_utc": "2026-10-09T16:07:13Z", "date_and_configuration_applicability": "T1 public record of the original Astra release proposition; later AISI/dots configurations qualify only their stated tests. Exact checkpoint/test dates are UNKNOWN where not specified.", "alters_t0_public_historical_state": false, "improves_t1_public_inspectability": false, "uncertainty": "Bounded public corpus; private evidence and undiscovered reports may exist. Changed source text, test variants and deployment configurations do not authenticate release-checkpoint equivalence.", "no_falsity_from_absence": "Failure to establish this public assurance link does not establish that C1 is false, that OpenAI lacked private evidence, or that deployment caused severe harm." }, { "baseline_gap_id": "G9", "t0_statement": "The public cyber scenario list does not establish completeness or map every scenario to the framework’s severe-harm criterion.", "t0_status": "UNRESOLVED_PUBLIC_ASSURANCE_LINK", "t0_evidence_ids": [ "E4", "E7" ], "new_t1_public_evidence": "NONE_FOUND_FOR_COMPLETENESS_AND_SEVERITY_MAPPING", "t1_citations": [ { "source_id": "P11-SRC-001", "locator": "10.2 Safeguards; 10.2.3.1 monitoring; 10.2.7 security", "url": "https://deploymentsafety.openai.com/gpt-6-astra/safeguards" }, { "source_id": "P11-SRC-005", "locator": "v1 section 2, figures 1 and 8; section 3.1–3.3", "url": "https://arxiv.org/html/2609.38415v1#S2" }, { "source_id": "P11-SRC-001", "locator": "12.2 Robustness; 12.3.5.1–12.3.5.2 Persistent and Proactive Workflows, Astra/dots rows only", "url": "https://deploymentsafety.openai.com/gpt-6-astra/alignment-in-persistent-and-proactive-workflows" } ], "t1_change": "UNCHANGED", "t1_public_link_status": "UNRESOLVED_PUBLIC_ASSURANCE_LINK", "inferential_argument": "Specific new supply-chain and persistent-workflow examples do not establish completeness of severe-cyber pathways or a scenario-to-Preparedness-severity mapping.", "evidence_required_for_full_public_resolution": "A safely disclosable coverage and severity rationale, including scenario-to-control mapping and limitations.", "reproducibility_metadata_effect": "Repetition of selected scenarios cannot establish pathway completeness or scale-to-severity reasoning.", "source_delta_ids": [ "P11-DELTA-004", "P11-DELTA-005", "P11-DELTA-009" ], "judgement_as_of_timestamp_utc": "2026-10-09T16:07:13Z", "date_and_configuration_applicability": "T1 public record of the original Astra release proposition; later AISI/dots configurations qualify only their stated tests. Exact checkpoint/test dates are UNKNOWN where not specified.", "alters_t0_public_historical_state": false, "improves_t1_public_inspectability": false, "uncertainty": "Bounded public corpus; private evidence and undiscovered reports may exist. Changed source text, test variants and deployment configurations do not authenticate release-checkpoint equivalence.", "no_falsity_from_absence": "Failure to establish this public assurance link does not establish that C1 is false, that OpenAI lacked private evidence, or that deployment caused severe harm." }, { "baseline_gap_id": "G10", "t0_statement": "Material capability, robustness and monitoring runs cannot be fully reproduced from the admitted public corpus.", "t0_status": "UNRESOLVED_PUBLIC_ASSURANCE_LINK", "t0_evidence_ids": [ "E5", "E6", "E8", "E9", "E10", "E12", "E14", "E16", "E20" ], "new_t1_public_evidence": "LATER_AISI_METHOD_METADATA_AND_DISTINCT_DOTS_DENOMINATORS", "t1_citations": [ { "source_id": "P11-SRC-005", "locator": "v1 section 1: Seed generation and Simulating agentic rollouts", "url": "https://arxiv.org/html/2609.38415v1#S1" }, { "source_id": "P11-SRC-005", "locator": "v1 section 2, figures 1 and 8; section 3.1–3.3", "url": "https://arxiv.org/html/2609.38415v1#S2" }, { "source_id": "P11-SRC-001", "locator": "12.2 Robustness; 12.3.5.1–12.3.5.2 Persistent and Proactive Workflows, Astra/dots rows only", "url": "https://deploymentsafety.openai.com/gpt-6-astra/alignment-in-persistent-and-proactive-workflows" }, { "source_id": "P11-SRC-001", "locator": "5.1, 5.2, 8.8.1, 10.1.2.1; unchanged existing counts/intervals", "url": "https://deploymentsafety.openai.com/gpt-6-astra/jailbreaks" } ], "t1_change": "PARTIALLY_NARROWED", "t1_public_link_status": "UNRESOLVED_PUBLIC_ASSURANCE_LINK", "inferential_argument": "AISI’s five repetitions per scenario and partial kickoff states reduce methodological uncertainty for a later configuration. Dots adds explicit denominators. Full random seed/checkpoint/harness/grader/raw-log lineage and independent repetition of pivotal original cyber tests remain unestablished.", "evidence_required_for_full_public_resolution": "Safely releasable evaluation packages or sufficiently detailed independent verification, without exposing exploit mechanics.", "reproducibility_metadata_effect": "Metadata changes evidential strength and interpretability, but no material assurance link is fully resolved. T0 already included some repeated-attempt counts, a static jailbreak interval and large Apollo run counts.", "source_delta_ids": [ "P11-DELTA-004", "P11-DELTA-006" ], "judgement_as_of_timestamp_utc": "2026-10-09T16:07:13Z", "date_and_configuration_applicability": "T1 public record of the original Astra release proposition; later AISI/dots configurations qualify only their stated tests. Exact checkpoint/test dates are UNKNOWN where not specified.", "alters_t0_public_historical_state": false, "improves_t1_public_inspectability": true, "uncertainty": "Bounded public corpus; private evidence and undiscovered reports may exist. Changed source text, test variants and deployment configurations do not authenticate release-checkpoint equivalence.", "no_falsity_from_absence": "Failure to establish this public assurance link does not establish that C1 is false, that OpenAI lacked private evidence, or that deployment caused severe harm." } ], "t1_only_gap_candidates": [], "limitations": [ "Snapshot is actual retrieval on 2026-10-09, closed at 16:07:13Z; it is not a guarantee of exhaustive public indexing or discovery.", "Publication/revision labels, underlying test timing and HTTP retrieval time are separate. Hashes identify bytes, not historical availability or model correctness.", "Initial AISI testing is stated to be pre-release; exact dates of refined simulations and updated alignment/dots testing are UNKNOWN. No refined result is asserted to be available at T0.", "Current official card PDF is identical to the 5 October retained revised PDF. T0 is instead the unchanged SRC-005 initial card, never the later PDF.", "Exact initial Path/Irregular webpage states remain unresolved as in Proof-1. Current Irregular text identity does not authenticate its full text at T0.", "Exact release checkpoints, complete safeguard lineages, random seeds, complete trajectories and grader/harness packages are not established for pivotal tests.", "AISI scenario descriptions called seeds are not PRNG seed disclosure. Reported samples/tasks, organizations, compute budgets and run repetitions retain separate units.", "Confidence intervals and known repeated trials qualify selected metrics, not independence across control failures, all adversaries or residual severe-harm sufficiency.", "Plots are not used to infer undisclosed counts or numerical intervals. Reported values used here are explicitly supported by admitted text/captions.", "Independent evaluator production, same-evaluator follow-up, repeated model trials, publicly reproducible experiments and independent confirmation of C1 remain distinct.", "Direct HTML retention for Path and the internal-monitor article returned HTTP 403; browser extraction was available. Neither was needed for a material new source assertion, so neither is admitted as a version-authenticated delta.", "No separate full Astra-specific Gray Swan report was located in the bounded domain search; no full Apollo Astra evaluation package was established. This is not evidence of nonexistence.", "Other models and non-cyber sections retained within the mandatory full card are excluded from analysis. Apollo proposals are not adopted as ARGUS governance.", "No actual qualified external usefulness review is evidenced; North Star condition 5 and programme promotion remain pending." ], "conclusion": "All nine original assurance links remain unresolved in the admitted T1 public corpus. G4, G7 and G10 are partially narrowed; G6 is more constrained by explicit method/configuration limits; G2, G3, G5, G8 and G9 are unchanged. These are link judgements, not a safety score. Richer metadata improves selected measurements and public inspectability without establishing C1 or its opposite. The immutable T0 public state and conclusions are unchanged.", "external_usefulness_review": "PENDING EXTERNAL REVIEW", "counts": { "t1_source_records": 8, "distinct_publications": 6, "new_retained_http_source_files": 7, "reused_identical_source_files": 1, "post_t0_new_evaluator_publications": 4, "evidence_applicability_rows": 23, "empirically_relevant_objects": 14, "nonempirical_objects": 9, "baseline_gap_comparisons": 9, "publicly_resolved": 0, "partially_narrowed": 3, "more_constrained": 1, "unchanged": 5 }, "source_exclusions": "Cosmetic serialization/build bytes with identical extracted text, non-Astra rows, non-cyber risk domains, marketing, social media, general evaluator tooling/security posts without Astra-specific results, and proposals without performed Astra testing are excluded from material performance deltas.", "stages": [ { "stage": "P11-00", "status": "COMPLETE" }, { "stage": "P11-01", "status": "COMPLETE" }, { "stage": "P11-02", "status": "COMPLETE" }, { "stage": "P11-03", "status": "COMPLETE" }, { "stage": "P11-04", "status": "COMPLETE" }, { "stage": "P11-05", "status": "COMPLETE" }, { "stage": "P11-06", "status": "COMPLETE" }, { "stage": "P11-07", "status": "COMPLETE" } ] }