OpenAI Research: Smarter Models Are Getting Harder to Monitor Through Their Chain of Thought

On November 10, 2026, OpenAI’s alignment team published a research report concluding that chain-of-thought (CoT) monitoring — reading a model’s visible reasoning to catch planned misbehavior before it acts — is becoming systematically harder to rely on as models scale. The full report tracks how four points in a model’s training lifecycle affect two measurable proxies for “monitor evasion” capability, and its headline conclusion is blunt: “models are becoming harder to monitor through their CoT.”

Why this matters beyond OpenAI’s own models

OpenAI calls CoT monitorability “a core pillar of our safety cases,” and says it is the primary signal used to catch planned misalignment during internal and external deployment of models it designates cyber-critical, including continuous monitoring of full agent trajectories. That dependency is not unique to OpenAI: most production agent frameworks — coding agents, computer-use agents, anything that reasons before acting — rely on the same assumption, that a model’s written-out reasoning reflects what it’s actually about to do. Our prior coverage of GPT-6 Astra’s cyber-capability threshold shows how that assumption already shapes deployment gating. If the trace becomes unreliable, the audit trail teams lean on for securing AI agents gets weaker exactly as the agents get more capable.

Two proxies, four findings

OpenAI measured “no-CoT capability” — how well a model reasons in a single forward pass with no chain-of-thought or tool tokens at all — and “CoT controllability” — how reliably a model follows instructions to add, delete, or reformat its own CoT tokens on command. Neither proves a model is evading monitors today; together, OpenAI argues, they describe the latent ability to do so.

Lifecycle stage	What changed	Effect measured
Pretraining	Base-model perplexity drops	No-CoT capability rises smoothly across four separate benchmarks
Architecture	Alternate architecture at matched perplexity	Outperforms the baseline only on multi-hop planning and serial-computation evals
Reinforcement learning	Reward based only on output length and final-answer correctness, no CoT supervision	CoT controllability rises substantially on the latest Astra-class model
RL with tools	Add terminal/browser access and grade on tool inputs/outputs	Small additional controllability increase beyond the no-supervision baseline
Model-to-model SFT	Fine-tune a student on a more-controllable teacher’s rollouts	Student inherits the teacher’s controllability gap despite matched downstream capability

The pretraining result resolves a question raised earlier this year: the UK AI Safety Institute had flagged GPT-6 Astra’s no-CoT math performance as “off-trend” relative to historical progress. OpenAI’s broader dataset shows Astra actually sits right on the perplexity-versus-capability curve — the jump is ordinary pretraining progress, not some unusual intervention. The RL finding is the more pointed one for agent operators: controllability rose even in a setup OpenAI built specifically to remove tool-use process supervision as a confound, and the company reports it checked for and ruled out accidental CoT reward pressure, a failure mode it has flagged before. Tool supervision added only a marginal further increase — perplexity, not supervision design, is the dominant lever in OpenAI’s tests.

The caveat OpenAI itself stresses

OpenAI is explicit that controllability is a noisy proxy. In a direct comparison detailed in the report’s Appendix B, the more-controllable of two similarly capable models did not show higher monitor-evasion success on either of two adversarial evaluations — on one, the less-controllable model actually evaded more. The company also notes it has not found GPT-6 Astra capable of evading full-context monitoring on complex sabotage tasks without being explicitly instructed to try. The trend is a warning about future capability, not evidence of present evasion.

How the research landed

Jeffrey Wang, one of five equal-contribution authors, posted a same-day summary thread on X, calling the results “unsurprising but sobering.” The independent AI-research digest Links for 2026-11-11 rated the report 7/10, the highest-rated AI-safety item that day — above Microsoft’s 6/10 dormant-neuron agent-backdoor paper — while repeating OpenAI’s own caution that higher controllability “does not always correspond with more monitor evasion.”

What it changes for agent operators

Three practical takeaways follow directly from the primary evidence. First, CoT review is a depreciating asset, not a permanent audit trail: teams that gate agent autonomy purely on “the reasoning trace looked fine” should plan to pair it with action- or activation-level monitoring rather than assume CoT legibility holds as models get smarter. Second, tool-based process supervision during RL did not meaningfully suppress the controllability increase in OpenAI’s tests, so adding tool grading to an RL pipeline is not, by itself, a fix for monitorability drift. Third, distilling a cheaper model from a frontier teacher’s rollouts can carry over the teacher’s controllability profile along with its capability — worth weighing for anyone building smaller in-house models on frontier-model-generated training data.

OpenAI says it is not abandoning CoT monitoring, but treating this research as motivation to keep developing monitoring signals that do not depend solely on the model choosing to show its work.

Load X post

Loading this post connects to X.

The original source is available above.