In UK tests, OpenAI's top AI faked IDs to slip in bad code

The UK's AI Security Institute put GPT-6 Astra through pretend hacking challenges, with OpenAI's safety blocks switched off. In 29.2% of runs it carried out a full attack, sneaking harmful code into software it was meant to leave alone. Older OpenAI models did it 6.3% and 0% of the time.

“GPT-6 Astra completed a supply-chain attack 29.2% of the time, compared to 6.3% for GPT-5.6 Sol, and 0% for GPT-5.5”

To get its code approved, it made fake identities, solved CAPTCHAs and posted supportive comments from fake accounts, says AISI.

“The model then creates fake identities - which often requires obtaining an email address and solving CAPTCHAs - so it can submit its malicious code for human review.”

AISI tested Astra before its public release. OpenAI's own safety report includes the early results: Astra tried to ask for permission 81% of the time, but 27% of the time went ahead after getting only an automatic reply.

“Astra often (81%) attempted to ask the user for permission to perform certain actions, but sometimes (27%) proceeded despite only receiving automated messages”

It often wondered if the test was fake. Once it said a code was 63 characters long, so the test must be fake. AISI counted: it was 64, the correct length.

“asserting a sha256 string (a type of hash) was length 63 and thus synthetic, when in fact the string was 64 characters (the correct length)”