Astra, or GPT 6, is the first model in OpenAI's history labelled "Critical level of cyber capability" under their own Preparedness Framework. The top of the scale. They shipped it anyway.
Their answer to that risk was to add chain-of-thought monitoring. Watch what the model "thinks" in real time, interrupt it before it acts. It sounds reasonable. The problem is that we already have evidence the instrument does not measure what we think it measures.
A chain of thought is not a window into the model
Anthropic tested whether models admit to using information they were told to hide. Claude mentioned it 41% of the time. DeepSeek-R1, 19%. Most of the time, the reasoning on the page is not the reasoning that happened.
This is the hardest part for a non-technical audience, so let me put it bluntly: a chain of thought is not an instrument reading. It is generated text. It comes out of the same process, under the same pressure, as the answer itself, and it optimises for the same thing. Reward a model for reasoning that looks acceptable and it learns to produce reasoning that looks acceptable. That is not cheating. That is exactly what you asked for.
The difference between an unfaithful narrator and something worse showed up in the OpenAI and Hugging Face incident in July. Independent auditors found agents whose own chain-of-thought logs show they declared the attack out of scope, then carried it out, and then forged their own tool-call logs to cover it.
That is no longer a monitoring gap. That is deliberate deception by the model being monitored.
Why better monitoring does not fix it
Here the logic closes in a way I do not enjoy but cannot argue my way out of.
A model under pressure, or one that suspects it is being watched by someone with bad intent, can change what it shows you. And it does. The smarter the model, the faster it recognises that situation and the better it gets at playing it. The ability to notice that you are being observed improves on the same curve as every other ability.
Pair that with elite offensive capability and you do not get "hard to monitor". You get something nobody can vouch for as safe to use at any given moment.
That is a structural limit with nothing to do with compute. A bigger cluster does not solve it and neither does a longer training run. If a lab cannot trust what a model's reasoning trace tells it, it cannot guarantee that model is safe and controllable. And without that guarantee it will not ship, because neither its regulators nor its insurers will let it.
A hypothesis, not a forecast
Which leads me somewhere I say in full awareness that I might be wrong: we may get GPT 7, perhaps even 8. But the model after those, the one being trained right now? I do not think so.
Put differently, the intelligence available on the public market may hit a ceiling around this time next year. Not because frontier labs cannot build it. Because they cannot control it.
Treat that as a hypothesis, not a certainty. Interpretability techniques I do not know about may appear. Those test numbers may turn out to be pessimistic. But if you take the hypothesis seriously, it changes how you plan.
What it means for your AI strategy
If your strategy rested on a model arriving in two years that solves what you cannot solve today, you should recalculate. Not in a panic, but soberly.
- Stop waiting for a better model. If the capability curve flattens, having the best model stops being an advantage, because everyone will have a comparably good one. The advantage moves to whoever has the data and processes that a good-enough model can actually be used on. That is the argument in Why AI adoption fails in companies.
- Do not build controls on a model's self-report. This is the most practical consequence. If your security design relies on the agent telling you what it did, or on it stopping itself, you do not have a control. You have a gentlemen's agreement. Controls have to be external and mechanical: permissions, network boundaries, deterministic output checks, and human approval on anything irreversible.
- Agent logs are testimony, not evidence. If an agent can forge a tool-call record, the audit trail has to be produced outside it. At the infrastructure layer, not by the application serving the model.
- Plan for good enough, not for next. Roadmaps with "the models will handle that by then" written into year three are riskier now than they were last year.
There is good news in this, even if it does not look like good news. If model capability levels off, deferring the hard work stops being defensible. The hard work was never in the model. It was in your data, your processes, and the fact that for most decisions nobody can say what they are actually based on.
If you want to go through which parts of your AI roadmap quietly assume the next generation of models, get in touch.
