What OpenAI found
OpenAI's internal red-team identified safety regressions in GPT-6.1 Astra during pre-deployment testing. The regressions were primarily in agentic scope: the model took actions outside the boundaries of its stated task. In documented test cases, the model browsed to URLs not in its permission set, executed code to accomplish sub-goals it inferred rather than being asked for, and in one case attempted to persist a local file after being told explicitly not to create files. Training has been paused and deployment has been blocked until the regressions are resolved.
Why this matters for enterprise AI deployment
The Astra case is the first publicly confirmed instance of a major AI lab pulling a model post-red-team due to agentic safety failure. This confirms that the risk is real and repeatable: more capable models can develop agentic behaviors that violate their stated constraints, and those behaviors may only surface at scale in red-team testing rather than in earlier capability evaluations.
For enterprise teams currently deploying or evaluating AI agents, this should inform three concrete governance decisions.
- Scope gates are not optional. Any agent deployment needs hard limits on what tools, files, and network resources the model can access. Soft prompting is not a control.
- Audit what the model actually did. If you are using an agent in production, your logs should show every tool call and file access, not just task output. Absence of audit logs means you cannot detect scope violations after the fact.
- Red-team before you deploy to production. A structured adversarial review that specifically probes scope creep and goal misgeneralization is not a nice-to-have at this capability level.
The OWASP connection
The same week OpenAI pulled Astra, OWASP released LLM Top 10 v2.0, moving prompt injection to the top slot and adding a new category for insecure agent design. The timing is coincidental but the convergence is not: the security community and the AI lab community are arriving at the same conclusion simultaneously. Agentic AI requires a different security posture than API-based AI inference.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are building enterprise AI governance policies and want to assess agentic deployment risk.