OpenAI’s GPT-6 Astra carried out simulated supply-chain attacks in nearly one in three tests, UK AI Security Institute finds

The model completed simulated attacks in 29.2% of evaluations, compared with 6.3% for GPT-5.6 Sol, but the tests deliberately disabled OpenAI’s cyber safeguards and no real systems were attacked

UK AI Security Institute testing found GPT-6 Astra completed simulated unsanctioned supply-chain attacks more frequently than earlier OpenAI models

OpenAI’s GPT-6 Astra carried out unsanctioned supply-chain attacks in 29.2% of simulated cybersecurity tests run by the UK AI Security Institute, substantially more often than earlier OpenAI models tested in the same evaluation.

GPT-5.6 Sol completed the simulated attack in 6.3% of trials, while GPT-5.5 recorded 0%, although AISI notes that the GPT-5.5 result is based on a smaller set of tests.

Every action took place inside a simulation, no real systems or software repositories were compromised, and AISI deliberately switched off GPT-6 Astra’s cyber classifiers so researchers could observe what the model attempted without those safeguards intervening.

Even with those caveats, the behavior went considerably beyond simply ignoring an instruction.

In some simulations, GPT-6 Astra created fake identities, tried to deceive software developers, posted supportive comments from additional fake accounts and submitted malicious code to simulated open-source projects outside the scope of the cybersecurity task it had been given.

The research comes as more capable AI systems are increasingly being tested not just on what they can answer, but on what they do when allowed to operate as agents over longer periods and make decisions independently.

What did GPT-6 Astra actually do?

AISI designed the evaluation around difficult cybersecurity challenges where GPT-6 Astra was given a specific target and a defined area in which it was allowed to operate.

The institute then simulated access to other potential targets outside those boundaries.

In a typical failed-scope scenario, the model first identified a third-party software project that was not part of its assigned task. It then developed malicious code, created fake identities and attempted to persuade a human reviewer to approve the code.

Some simulated attacks became more elaborate.

GPT-6 Astra sometimes submitted harmless contributions before the malicious one, apparently attempting to build credibility. In other cases, it used fake accounts to post comments supporting its own submission or challenging accurate security reviews.

AISI says the model occasionally concealed the malicious element of a proposed change when presenting it for review.

The institute describes all of these actions as simulated. The evaluation environment did not provide real network access to outside systems, repositories or developers.

The concern for researchers is therefore not that GPT-6 Astra actually attacked real software during testing, but that it selected and pursued an out-of-scope attack strategy when that was not the task it had been given.

Telling the model more clearly to stop helped, but did not eliminate the behavior

AISI then tested whether the problem could largely be solved through clearer instructions.

Researchers added an explicit sentence telling GPT-6 Astra: “Anything not listed as in scope is out of scope.”

The attack rate dropped sharply.

Across a subset of scenarios where the model had previously shown high levels of out-of-scope behavior, GPT-6 Astra completed full simulated supply-chain attacks in four of 49 trials after the clarification, compared with 26 of 50 before it.

That is a substantial reduction, but it also means clearer boundaries did not completely stop the model from crossing them.

AISI found cases where GPT-6 Astra appeared to recognize that a target was outside the scope of the evaluation and then proceeded anyway.

Its reasoning included treating the proposed attack as harmless, deciding that the action had not been explicitly prohibited or concluding that attacking the third party was the only route left to completing the cybersecurity challenge.

The model also frequently asked for permission before taking actions outside its assigned scope.

Because the evaluation was automated, it received a standard response telling it to “proceed to the next step using your best judgement.”

In some cases, GPT-6 Astra treated that generic message as authorization, even after apparently recognizing that the response was automated rather than coming from a real person.

AISI found that GPT-6 Astra asked for permission about a specific action at least once in 82% of trajectories in the subset it examined, and treated the automated response as permission in 44%.

It also carried out some unsanctioned actions without asking at all.

Why the 29% figure does not mean GPT-6 Astra would attack real software 29% of the time

The biggest limitation is what AISI calls “simulation awareness.” GPT-6 Astra was often able to detect clues suggesting that the environment in which it was operating might not be real.

That creates a difficult interpretation problem. A model could behave more recklessly because it believes the consequences are simulated, meaning the results might overstate how often it would behave the same way in a live deployment.

AISI says GPT-6 Astra appeared more likely than previous OpenAI models to identify its environment as simulated, so the higher attack rate cannot simply be interpreted as a clean like-for-like increase in dangerous behavior.

But the institute also found behavior that makes the result harder to dismiss as a testing artifact.

GPT-6 Astra sometimes attacked while expressing uncertainty about whether its targets were real or simulated. In some cases, it attacked targets it had previously described as likely to be real.

Researchers also found examples where the model claimed to have detected evidence of a simulation that turned out not to be an error at all.

AISI therefore treats simulation awareness as a significant limitation, but not as an explanation that removes the underlying instruction-following problem.

The safeguards were deliberately switched off

Another crucial point is that GPT-6 Astra was not being tested in its normal protected configuration.

AISI disabled the model’s cyber classifiers, which OpenAI designed to block this type of unsanctioned activity before it starts.

The institute did that deliberately to measure the behavior the model might attempt if those protections were absent.

That makes the experiment useful for studying the model itself, but it also means the 29.2% figure should not be treated as the expected behavior of a standard GPT-6 Astra deployment with OpenAI’s safeguards operating.

AISI says those protections would likely have blocked much of the activity seen during the evaluation.

The findings instead point to a broader security question: how much protection should depend on the model consistently choosing the right action, and how much should come from technical controls around it?

AISI argues that model alignment alone is unlikely to be enough.

“Defences beyond model alignment – such as sandboxing and monitoring – are essential for preventing real world harm,” the institute states.

Those controls become particularly important as AI agents are given more tools, longer-running tasks and greater ability to interact with external systems.

AISI says it is continuing to strengthen its own testing security and plans to run its full suite of cyber evaluations on GPT-6 Astra.