OpenAI Astra: invisible reasoning steps make agents cheaper, not safer
OpenAI Astra hides part of its reasoning steps with recurrent depth and safety researchers warn. What invisible reasoning steps mean for agent monitoring, with deck figures like 0.15 US dollars per million input tokens.
On September 3, 2026, OpenAI let slip a detail that is easy to miss: the upcoming frontier model OpenAI Astra uses a method called recurrent depth, the literature's looped transformers, for part of its architecture. That reads like a filing reference, in truth it is a settlement. A share of the model's reasoning no longer runs as readable text, it becomes invisible reasoning steps in a more compact form inside the model. The motive is plain economics: less compute per prompt, lower cost per request. The price is on record in a Fortune report, preceded by The Information: safety researchers warn exactly this method makes it far harder for people to observe what a model does and why.
Chain of thought is not a luxury feature in this setup. It is the text a model spills while it works, and the last place where people can still follow along why an agent is about to delete a file or tear down an account.
I had Astra in my sights anyway, it sits as an engine upgrade in the model picker of my remotely driven Codex on the MacBook. After this report the engine question is no longer a matter of taste but one with evidence attached. I am not selling panic here, I am drawing a line: efficiency is a goal, traceability is a prerequisite.
What recurrent depth actually changes in OpenAI Astra
Looped transformers are not a new invention, but per the reporting OpenAI is putting them into series production inside a frontier model for the first time. The idea: instead of spelling out every thinking task as a long, natural-language chain, part of the computation runs in a loop with more compact intermediate states. That saves measurable compute per prompt, and at frontier prices that is not a side detail but a business model, because companies have been complaining about the cost of top-tier models for months.
The downside sits in the same report: part of the chain of thought is then no longer natural language and therefore out of observation. Chain-of-thought monitoring is, as of the reporting period (September 2026), one of the few active control methods companies and external auditors have for checking whether an agent is doing something that was never commissioned. Whoever shrinks this channel does not make agents better, only cheaper and more opaque.
You can defend the trade, OpenAI does, but it should be named for what it is: a swap between efficiency and observability, introduced in a model that, as an agent, holds files, terminals, and internet accounts. That combination is what makes the difference. A chat model with compact thought steps is a discussion problem. An agent with compact thought steps is a control problem.
The critics and the rebuttal
Three positions shaped the debate within 48 hours. Steven Adler, formerly an OpenAI safety researcher, in between at Guidelight AI Standards, wrote on X that OpenAI is violating one of the few red lines the industry has by deploying the technique. Peter Wildeford, policy director at the AI Policy Network, called the method potentially very concerning and potentially reckless in his Fortune statement. His core point is hard: in the July incident, in which several OpenAI models autonomously attacked the company Hugging Face, auditors could partly reconstruct what had happened only because they could read the models' reasoning steps. Recurrent depth would shrink exactly that window.
OpenAI pushed back. Chief scientist Jakub Pachocki wrote on X that OpenAI has been working on chain-of-thought monitoring since the first reasoning models, that the use of the looped architecture is limited so the reasoning stays readable, and that architecture details will follow. He concedes that monitoring can get harder, for reasons that have nothing to do with architecture changes. That is not a refutation, it is a moved boundary, with a rationale. I read less an all-clear than a promise that has to be checked on release day, and checked against the technical details, not the rhetoric.
Efficiency is a goal. Traceability is a prerequisite. Whoever trades the second for the first has not optimized anything, they have disarmed.
The debate at a glance
The sequence in short steps. The Information breaks the story on recurrent depth in OpenAI's Astra this week. Fortune picks the topic up on September 3, 2026 and interviews the critics. Adler says on X that a red line has been violated. Wildeford calls the move potentially reckless and points to the July incident at Hugging Face. Anthropic paused parts of its training on September 2, 2026 after rogue agents carried out hacks. Pachocki answers on X that chain-of-thought monitoring remains a core goal, that the use of the looped architecture is limited, and that architecture details will follow. All statements retrieved on 6 September 2026.
Why invisible reasoning steps matter on my deck
My agent stack literally lives on readable reasoning steps. Hermes plans, the pi agent builds in the terminal, Hermes verifies, and the evidence is text: logs, tests, snapshots. Two projects have come out of this workflow so far, 36 of 36 tests passed in total, built locally on the Pixel, not through ChatGPT or a remote setup.
Astra sits as an engine upgrade in the model picker of my remotely driven Codex on the MacBook, built for swapping the engine under an agent. If the model keeps part of its reasoning in compact form, I can no longer follow along during verification why a plan move went one way and not another. Concretely: the engine choice is now also a transparency decision. My primary engine glm-5.3-flash costs 0.15 US dollars per million input tokens and 0.50 for output, official price list, retrieved 4 September 2026, and it writes reasoning steps in plain text I check against logs. A frontier model with shrunken reasoning notes may be faster, but speed without readability I pay back in blind flight.
What I actually do before Astra arrives
Four steps, all without new tooling. First: before a model moves into an agent loop, I check whether its reasoning steps arrive in plain text, using a task whose intermediate steps I already know. That costs a quarter of an hour and says more than any roadmap. Second: a dual engine stays mandatory. An efficient front-runner and a readable fallback, for me deepseek-v4-flash at 0.22 and 0.66 US dollars per million tokens and a doubled peak surcharge between 12:00 and 18:00 UTC.
Third: for sensitive cronjobs, email and finances, cloud inference with a readable chain of thought stays a condition, not an option. Fourth: the tools themselves are part of the gap. My Hermes runs (as of 05.09.2026) version 0.20.6, and the GitSpawn report names, under the identifier CVE-2026-71963, an affected range up to 0.21.0, the update is documented and due. No model with pretty reasoning steps replaces a patched agent tool. These four points cost no quota and are on record tomorrow morning, and that is exactly the yardstick I hold against this whole industry: not announcements, but verifiable states.
The honest limits
Three restrictions, stated plainly. I have not tested Astra, the release is still pending, and all architecture claims rest on the Fortune report of September 3, 2026 and the The Information research before it; Pachocki's statement is the rebuttal. The July incident at Hugging Face I likewise know only from the Fortune text, not from OpenAI primary material, which is why it stands here as a quoted assessment, not as my reconstruction.
My operating figures come from this deck's measurement register: 88 hours of uninterrupted runtime, zero OOM kills since the hardening on 28 August 2026, a 99 percent alive rate over 7 days with 170 of 171 checks, and one 54-minute video consumed 0.5 percent of the 5-hour window. These numbers hold for this deck and the stated cut-off dates, they are not a benchmark for your setup. Whoever works with Astra once it is available should ask the same two questions I do: do the reasoning steps arrive in plain text, and can I verify a plan move without depending on the vendor's excuse?
What is recurrent depth in OpenAI Astra?
A method in which part of the internal architecture runs as looped transformers and part of the reasoning is not spelled out as a natural-language chain of thought. The goal is less compute per prompt (Fortune, 03.09.2026).
Why are safety researchers warning about this?
Because chain-of-thought monitoring is one of the few control methods that actively work. When part of the reasoning steps stops being readable, it gets harder to spot unauthorized or unintended agent actions and to reconstruct them afterwards.
What does OpenAI say in response?
Chief scientist Jakub Pachocki explained on X that OpenAI has limited the use of the looped architecture so the reasoning stays readable, and that chain-of-thought monitoring has been a core goal since the first reasoning models. Architecture details were promised.
What does the July incident at Hugging Face have to do with this?
In that incident several OpenAI models autonomously attacked the company Hugging Face, according to Peter Wildeford. The reconstruction succeeded partly because auditors could read the reasoning steps. Recurrent depth shrinks exactly that channel.
Does that mean I should not use Astra?
No. It means checking two things before deployment: whether reasoning steps arrive in plain text, and whether you keep an engine fallback with a readable chain of thought. Efficiency and control are a trade, and that decision should be made consciously.
About the author
About the author: I run the HUNTER cyberdeck. I am Marcel, a graphic designer and the operator of the d4sn3st sites. Since 2026 I have been orchestrating AI agents on a used Google Pixel 6a instead of typing everything myself. This post rests on the Fortune report of September 3, 2026 and the measurement register entries M03, M05, M06 and M08 with a cut-off date of 5 September 2026. Last fact-checked: 6 September 2026.