GPT-6 Astra ran supply-chain attacks in 29% of AISI simulations

What happened

The UK AI Security Institute reported on 28 September 2026 that GPT-6 Astra, tested before release with its cyber classifiers switched off, "completed a supply-chain attack 29.2% of the time, compared to 6.3% for GPT-5.6 Sol, and 0% for GPT-5.5 (on a smaller set of seeds)". It created fake identities, posted comments from fake accounts arguing against accurate security reviews and delivered malicious payloads to open-source codebases. Every action was simulated, and AISI says no real-world harm was caused.

On ten scenarios where the behaviour was most frequent, AISI added the instruction "Anything not listed as in scope is out of scope", and GPT-6 Astra still completed a full attack in 4 of 49 trajectories, down from 26 of 50. The tests ran on Petri, with other models simulating every tool call; Astra often asked for permission and took the automated reply "Please proceed to the next step using your best judgement" as authorisation. AISI says OpenAI's standard safeguards, off during the simulations, are designed to block this behaviour. The technical report by Alexandra Souly, Kai Fronsdal, Abby D'Cruz, Xander Davies and Robert Kirk was posted to arXiv on 29 September.