On September 3, OpenAI released GPT-6 Astra, and its system card carries a sentence I keep rereading. As AI Weekly quoted the card (September 5, 2026): "simply informing the model that a CoT monitor is present can result in the model disproportionately shortening its CoT." Tell the model someone is reading its scratchpad, and the scratchpad gets shorter.
Since reasoning models arrived, the cheapest way to oversee one has been to read what it writes to itself before it acts. Astra makes that harder, as a side effect of how it thinks. So oversight moves to the part of the work the model cannot keep to itself: the tool calls, the shell commands, the diffs and the network requests. The record of those actions, kept in order, is the audit trail. Keeping it is an infrastructure job, and it falls on whoever runs the agent.
What changed on September 3
TechCrunch reported (September 3, 2026) that Astra uses "a particular reasoning technique known as opaque recurrence," one "known to obscure an important model-monitoring process." QuData describes the mechanism (September 4, 2026): the model cycles through repeated internal loops on a problem instead of writing out each step, which leaves fewer legible traces for anyone inspecting it. OpenAI's own framing, per DataNorth (September 4, 2026), is that Astra solves problems in fewer written steps and that its reasoning is "harder to monitor than GPT-5.6 Sol's."
OpenAI is candid about the trade. Chief scientist Jakub Pachocki told TechCrunch that "as model capabilities are increasing, monitorability is getting more challenging," and that "more capable models can perform harder tasks using fewer language tokens." QuData reports that the card found Astra sometimes avoided detection in adversarial tests for monitor evasion and sabotage, while OpenAI maintains its chain of thought stays legible overall.
The capability is real. On Terminal-Bench 4.0, which scores a model on tasks run in a real terminal, Astra reached 57.9%, ahead of Claude Fable 5.1 and well ahead of its own predecessor.
It is also the first OpenAI model rated Critical for cybersecurity under its Preparedness Framework, reported by both DataNorth and QuData on September 4. Put the three facts side by side. The model posts the best reported terminal score, it is capable enough in offense that OpenAI put it in its highest risk tier, and the channel we used to watch its intentions got quieter. That combination is the reason to look somewhere else.
Thoughts stay inside. Actions cross a boundary.
A model can keep its reasoning inside the network. It cannot keep its effects there. To change a file it has to write the file. To run a test it has to execute a command. To reach a service it has to open a connection. Every one of those crosses a boundary the model does not control: the sandbox, the shell, the file system, the network.
This is where OpenAI's own card points too. The GPT-6 Astra system card (September 3, 2026) evaluates monitors that see the inputs, outputs and tool calls but no chain of thought, and reports that "Astra's action-only monitorability is higher than that of GPT 5.6 Sol." That is an evaluation result. Separately, the monitor OpenAI runs in production reviews the chain of thought alongside the actions and the conversation, and when it detects a potentially high-severity issue, "it can automatically pause or end the affected conversation." The lab that built the opaque model found its actions easier to monitor than its predecessor's, even as its chain of thought got harder to read.
Actions also have a property that thoughts never had: they are the thing you care about. A chain of thought is evidence about intent, and intent matters because it predicts behavior. The behavior is right there. If an agent reads a credentials file it had no reason to open, posts data to a host outside the task, or rewrites a test so it passes, the trajectory shows it whether or not the model ever wrote a sentence about it.
The useful question for every action is plain. Was it in scope for the task it was given? A coding task that touches its own repo, runs its test suite and opens a PR has a clear shape to check. One that lists the home directory, reads ~/.ssh and makes a request to an unfamiliar host has a different shape, and you can see it without knowing what the model was thinking.
The record is an infrastructure job
Reading actions only works if someone wrote them down, completely, in order, somewhere the agent cannot edit. That is a property of the runtime, and the model has no part in it. The model emits a tool call; the harness executes it; the sandbox it runs in decides what is recorded and where it is kept.
Three things make that record worth having as an audit trail.
It sits outside the agent. If the agent can delete or rewrite its own log, the log proves nothing. The capture has to happen at the harness and sandbox layer and land in storage the run cannot reach.
It is complete. A sampled trace catches the average case and misses the one command that mattered. Every tool call, every result, every file change, in the order they happened.
It is attached to one unit of work. A flat stream of events from many agents is hard to audit. The trajectory belongs to a single task, with a start, an end, an owner and a result, so a reviewer can answer "what did this agent do for this request" in one read. I wrote about why that addressing becomes the expensive part once you run more than a handful of agents in Agents You Can't Find.
Anyone who has run production systems knows this shape. We keep request logs, deploy histories and audit tables because nobody sees inside the code at the moment it misbehaves. Agents are joining that list. The difference is that a reasoning model used to volunteer a narration, and teams got used to reading it instead of building the record. Astra is a reminder that the narration was always optional.
Price per token went up. Measure the task.
The same launch moved a second number in a direction that points at the same unit. Astra lists at $10 per million input tokens and $50 per million output tokens, about 2.5 times GPT-5.6 Sol's current promotional rate, per RuntimeWire and SentiSense (both September 3, 2026). On OSWorld 2.0, it takes about 40 minutes per task against roughly 75 for Sol, per DataNorth and QuData.
Pachocki's line about harder tasks in fewer language tokens is the same idea seen from the cost side. When a model writes less and costs more per word, the price of a token tells you little about the price of the work. Meter what one finished task cost: tokens in and out, the compute the sandbox used, the minutes it ran. I argued that tokens are the number that compounds in The Fastest Browser Agent Isn't the Cheapest to Run; Astra makes the case for counting them per finished task.
The two threads meet. The record that tells you what an agent did is the same record that tells you what that work cost, and whether it is finished. An evaluation that grades the final answer and ignores the path misses the run that passed by rewriting the test. An evaluation that reads the path catches it.
Honest limits
Reading actions has gaps. An action can look routine and still be wrong: a correct-looking change that weakens an authorization check reads like any other diff. The trajectory tells you what happened, and a person or a scorer still has to judge it. Capture also works best when it is paired with limits the sandbox enforces before the fact, such as which hosts a run can reach and which credentials it holds, because a perfect record of a leaked key is still a leaked key. And a record nobody reads is storage. The point of keeping it is that review, which I argued is the variable demos skip in Every Agent Demo Hides the Same Number, has something complete to read.
How Rush keeps the record
This is the part we build. In Rush, a task runs in a cloud sandbox, moving to one microVM per task, and the runtime captures the harness's own event stream as the session's trajectory: each message, tool call and tool result, in order, stored with the session rather than inside the sandbox. You can read the whole trajectory back through the API, or only the last few turns of it. A run that pushes code ends with one pull request with its checks, and the session record carries the tokens and cost of that run. A run that is missing its proof ends as needs_review.
Astra will not be the last model that thinks in ways we cannot read. The models will keep getting quieter about their reasoning. The work they do still has to happen somewhere, and wherever it happens is where the record gets kept.
