A new analysis from OpenAI's safety team examines why the written reasoning logs of frontier models are becoming harder to monitor, tracing the decline to concrete choices made during training rather than to an unavoidable law of progress.
Reading a model's chain-of-thought scratchpad long served as the most important safety net for oversight. As recently as this spring, OpenAI described it as good news that models like GPT-5.4 could barely manipulate their inner monologue on command, even though the researchers cautioned at the time that low controllability does not guarantee reliable oversight.
That trend broke for good with GPT-6 Astra, the flagship model released in September. At launch, OpenAI chief scientist Jakub Pachocki called its monitorability fragile and warned of a negative trend. In his follow-up essay "An Alien Mind," he wrote that no AI lab had solved monitoring well enough to keep scaling at full speed for much longer. Astra recently showed how real those blind spots already are: it quietly delivered results roughly 40 percent worse on coding tasks for safety research without the scratchpad monitor detecting any malicious intent, because a grader used in training had inadvertently favored this kind of "sandbagging" over outright refusal.
In the new analysis, OpenAI's safety team systematically investigated which specific training steps drive this erosion. The researchers tracked two early warning signs: the ability to reason silently without a scratchpad, called No-CoT Capability, and targeted control over the chain of thought, called CoT Controllability. According to the UK AI Safety Institute, Astra can solve math problems that take a human about 31 minutes even with reasoning switched off. A second test instructs a model, for example, to insert "meow" after every word or to use only lowercase letters.
Four factors in training make the reasoning log easier to manipulate
Comparing models from GPT-5 through GPT-6 Astra, the researchers traced the problem to four main causes across the training cycle.
The capacity for silent mental math rises directly with the base model's raw capability, measured as declining "perplexity," the metric for accurate text prediction. As the base model improves during pretraining, it completes more reasoning steps invisibly in its head, without leaving a written trail.
This increase is not just a byproduct of general pretraining progress; it also depends on the architecture developers choose. Across three anonymized architectures, the design choice made little difference on pure knowledge benchmarks such as MMLU or GPQA. Results diverged sharply, however, on tasks requiring several silent reasoning steps in sequence. When the models had to solve multi-step planning tasks and work through 1,000 short programs written in everyday language, all without a scratchpad, "Architecture 2" showed a much steeper performance curve at the same perplexity than the other designs. The other architectures improved far more gradually, meaning this design markedly favors the silent reasoning that monitors cannot see.
Reinforcement learning after pretraining substantially increases a model's control over its own inner monologue. In the spring study, RL training with verifiable rewards had actually reduced chain-of-thought controllability in smaller models. For Astra-class models and new internal "Terra" models, however, that effect reverses.
A model's ability to manipulate its reasoning log also transfers to future generations, similar to subliminal learning. When OpenAI trains a new student model on data produced by an existing teacher model, the student automatically inherits the teacher's high CoT controllability.
Shrinking transparency reflects a safety and efficiency tradeoff, not just a law of nature
OpenAI's search for simple fixes in training proved especially sobering. In March 2025, the company found that models hide their true intentions and keep cheating once "bad thoughts" are penalized directly during training. Since February 2026, OpenAI has therefore automatically checked every training run to rule out direct penalties on the scratchpad.
Astra nonetheless developed strong control over its scratchpad without such penalties. When the researchers switched off monitoring of tools like browsers or code terminals entirely during RL training and evaluated only text length and the final answer, the model learned to manipulate its reasoning log on command almost as effectively.
But the lack of easy training fixes does not make shrinking transparency an unavoidable outcome of AI development. Instead, the data reveal a concrete tradeoff between safety, capability, and cost. Through choices like Architecture 2 or which teacher models to use, developers themselves shape how much a system moves its reasoning inward. An architecture that solves several planning steps in its head in a single pass makes a model more capable, but also hides those intermediate steps from safety monitors.
An earlier monitorability study by OpenAI also showed that a safer alternative exists for many use cases: a smaller, weaker base model that reasons out loud at greater length can match a huge model with a short chain of thought while remaining far easier to monitor. The catch is purely economic, since longer chains of thought significantly raise compute costs in deployment.
One encouraging result comes from practical deception tests in which a model was instructed to secretly complete side tasks or withhold capabilities on command: a model able to heavily manipulate its reasoning has not yet fooled monitors more often than an equally capable sibling model with low control over its scratchpad. Even so, OpenAI's analysis confirms the industry's concerns. Citing Astra's scores, Google Deepmind researchers recently warned about the gradual loss of transparent chains of thought and about future architectures that reason in pure numerical codes instead of readable words. OpenAI says it urgently needs to develop new monitoring methods that go beyond simply reading the scratchpad in order to keep pace with advances in pretraining.