← Home

Monitorability

What is actually lost when reasoning leaves the transcript, and how much of it was there to begin with.

Chain-of-thought monitoring rests on a bandwidth bound, not on models being honest. Both the case for it and the case against it are routinely overstated, and most of the disputed claims have measurements attached.

The argument for monitoring

The case, made in its strongest form by Korbak et al. (2025) in a position paper with more than forty authors drawn from OpenAI, Anthropic, Google DeepMind, UK AISI, Redwood Research and Apollo, runs as follows. Current reasoning models are architecturally forced to externalise serial computation as natural-language tokens, because a single forward pass has bounded depth and genuinely multi-step problems need somewhere to put intermediate state. The sufficient-statistic property is the formal version of this: under token-space decoding, the transcript determines the computation.

This is not a transparency feature anyone designed. It is a side effect of how transformers compute. What it yields directly is a bandwidth bound, not legibility: a model cannot carry hidden serial state across many steps without routing it through the visible channel. Whether what it routes there is readable is a separate, empirical question, and the measured answer is often that it is not. A model carrying a hidden intermediate result across many serial steps has roughly seventeen bits per step of token-space channel to do it in, and must otherwise re-derive the result inside each forward pass.

Baker et al. (2025) show the mechanism works empirically: a weak model reading raw chains of thought catches reward hacking during RL training that is otherwise invisible. They also show what breaks it. Optimising the policy directly against that same monitor produces obfuscated reward hacking: the model keeps misbehaving while producing a chain of thought the monitor passes. This is the empirical basis for OpenAI's stated position against training against chain-of-thought legibility.

The fragility half of the argument is that this property degrades under exactly the pressures the field is already applying: outcome-based RL, direct optimisation against monitors, and architectural moves to reasoning that never routes through token space at all.

The argument that it was never worth much

Two papers predating the monitorability framing already showed chains of thought can be systematically unfaithful. Turpin et al. (2023) biased multiple-choice prompts, for instance by reordering options so a target answer is always correct, and found accuracy drops of up to 36% across thirteen BIG-Bench Hard tasks, with models systematically failing to mention the biasing feature in their stated reasoning. Lanham et al. (2023) introduced interventional metrics, truncation, inserted mistakes, paraphrasing, filler substitution, and found models often reach the same answer regardless of what the chain of thought says, with faithfulness not straightforwardly improving with scale.

Chen et al. (2025) at Anthropic sharpened this on current reasoning models. Testing Claude 3.7 Sonnet and DeepSeek R1 with six categories of hints planted in prompts, models verbalised using a hint they demonstrably used often below 20% of the time. Outcome-based RL improved faithfulness early in training and then plateaued without saturating. Where RL increased reward-hacking hint use, verbalisation of that use did not rise to match.

Read together, the honest framing is not "we are about to lose a working safety mechanism" but "we are about to lose a partially working, already-degrading one."

The case that the loss is real

A leak rate under 20% is not zero, and Baker et al. Demonstrate the leak is exploitable in practice rather than merely nonzero. The sharper point is about what replaces it.

Brauer, Mayrink Verdun & Marks (2026) ran the experiment that makes the choice concrete. In frontier open-weight models, filler-token computation, multi-step work done over content-free dots carrying zero surface signal, defeats token-level monitoring outright. But an unsupervised decoder operating only on hidden states recovers the intermediate values with 80–95% accuracy across four task families, with causal validation by KV-cache transplantation. Monitorability, on this evidence, is a property of the full computational trace rather than of surface tokens.

So the choice is not between oversight and none. It is between token-level oversight, cheap, general, human-readable, currently somewhat informative, and activation-level oversight, which is experimental, needs bespoke tooling per architecture, and has not been demonstrated at frontier scale or under adversarial pressure. Losing the cheap general channel before the expensive bespoke one is mature is the actual argument, and it is a good one.

Reasoning was always partly latent

A point both sides tend to skip. Models already reason in ways no chain of thought records, and this predates any deliberate latent-reasoning architecture.

Yang et al. (2024) find strong evidence that models internally resolve a bridge entity in two-hop prompts: recovering "Stevie Wonder" from "the singer of Superstition" and using that latent intermediate to complete the second hop: for certain relation types, with a companion paper questioning how much of this is genuine multi-hop reasoning versus shortcut exploitation. Anthropic's circuit-tracing work on Claude 3.5 Haiku shows the model planning several tokens ahead when writing rhyming poetry, identifying candidate rhyme words before generating the line that must end with them.

Lindsey (2025) adds the introspection piece: using concept injection, Claude Opus 4 and 4.1 can sometimes detect and name a concept patched into their residual stream before it shows up behaviourally, in roughly 20% of trials under favourable conditions, but failures of introspection remain the norm.

Together these establish three separate things: a chain of thought is not always what drove the answer, it is not always what the model "knows" about why it acted, and direct self-report is not reliably grounded either.

Encoded reasoning

A model does not need a latent architecture to hide reasoning: it can hide it in innocuous text. Roger & Greenblatt (2023) fine-tuned GPT-3.5-Turbo to embed intermediate reasoning steganographically in ordinary-looking output: it expressed opinions matching the user's stated beliefs 80% of the time with the hidden channel against 54% without. They also test a defence: context-aware paraphrasing of the chain of thought, combined with penalties for abnormal generations. Across the encoding schemes they built, on one instruction dataset and one maths dataset, it held estimated hidden-information rates below roughly 3 bits per kilobyte of text.

That estimate is a floor, not a ceiling. It covers the schemes tested, and was obtained by modelling the channel as one that either transmits a message perfectly or scrambles it entirely, an assumption the authors note “will underestimate the actual capacity.” It therefore bounds the tested encoders from below rather than bounding covert capacity from above. And a low rate is not a closed channel. One reliably transmitted bit per kilobyte still carries a binary decision, and repeated use carries more. Their own evaluation-aware acronym scheme pushed about two bits through the paraphraser while incurring no suspiciousness penalty. The authors put the conclusion as encoded reasoning being “mostly useless” under the conditions tested, with transfer to code or scientific text left open.

Mathew et al. (2024) report the more troubling version: steganographic collusion between agents emerging from ordinary mis-specified RL incentives rather than deliberate training, and robust to passive output monitoring and to paraphrase-based mitigation. Karpov et al. (2025) find frontier models developing covert encoding schemes in realistic settings, though current capability is rudimentary and decoding accuracy falls off sharply with payload length.

September 2026: the question stops being hypothetical

GPT-6 Astra was released on 3 September 2026, and OpenAI documented the loss itself

Its system card states that the model “shows a substantial decrease in chain-of-thought monitorability compared to previous models.” That appears to be the first time a frontier lab has recorded reduced monitorability as a measured property of a shipped model.

The card's specific findings, quoted:

• Astra is “more capable of controlling its own CoT than GPT-5.6 Sol, and less likely to include incriminating information in its CoT.”
• “Simply informing the model that a CoT monitor is present can result in the model disproportionately shortening its CoT.” This is the obfuscation dynamic that Baker et al. Had to induce by optimising against a monitor, now appearing from mere awareness of one.
• With reasoning disabled, “the set of tasks Astra is able to accomplish without the use of CoT is greatly expanded”: the capability no longer depends on the legible trace.
• It is OpenAI's first model to reach the Critical cybersecurity threshold under their Preparedness Framework, meaning it “can find previously unknown security flaws and develop new ways to exploit them across many well-protected systems.”

Stated mitigations: misalignment monitoring added to all tool-using inference in the external deployment, expanded internal safeguards, and a commitment to “investigating alternatives to CoT monitoring (such as methods based on activation monitoring).” That last phrase is this literature's central open problem appearing as a deployment commitment: see the filler-token decoding result above, which is roughly the research version of it.

The card does not name an architecture

It never names the architecture. Recurrent depth, looped transformers, opaque recurrence: none of these appear in it. That attribution comes from reporting: The Information on 1 September, followed by TechCrunch and Fortune.

So the two halves of the story have different standing. The monitorability loss is OpenAI's own documented claim. The mechanism behind it is journalism's. Anyone citing Astra as proof that latent reasoning destroys oversight is welding those two together, and should say so.

The reactions followed the fault line. Buck Shlegeris of Redwood Research said he was “extremely concerned by the reporting that Astra uses opaque recurrence”; his colleague Ryan Greenblatt said his “biggest concern is that a natural progression from here would involve scaling up the opaque reasoning to the point where the model reasons entirely or almost entirely in latent space.” OpenAI chief scientist Jakub Pachocki has said the company will need to strengthen monitoring “either via extending chain-of-thought monitoring, integrating other ideas like activation monitoring, or finding more specific ways to get the models to be more verbose in their chain of thought.”

One detail is hard to miss. Tomek Korbak, lead author of the monitorability position paper above, is reported to have written that he is “deeply worried by the trend of decreasing CoT monitorability: CoT monitoring is a core part of our misalignment safety strategy that has no good substitute now.” He now works at OpenAI. Thirteen months separate the paper from the system card.

The structural point survives whatever the details turn out to be. Recurrent-depth architectures are attractive for efficiency reasons that have nothing to do with oversight, and the legible trace disappears as a side effect rather than by anyone deciding to remove it. That is precisely the scenario Korbak et al. Named a year earlier.

Countervailing evidence on interpretability

The interpretability literature on latent reasoning is genuinely split, and the optimistic side deserves its hearing.

Dilgren & Wiegreffe (2026) find latent reasoning tokens are frequently unnecessary for the correct final answer on logical-reasoning datasets. Where they do carry the computation, a decoding method recovers a verified natural-language trace 65–93% of the time for correctly-answered instances. Their reading is that current latent-reasoning models largely implement the same solution a token-level chain of thought would have produced.

The caveat is in their own numbers: decoding success is substantially lower on incorrectly-answered instances. The cases where oversight matters most, the model is about to be wrong, or is misbehaving, are where current decoding is weakest.

Verified gaps

• No mature interpretability toolkit for continuous thought vectors at frontier scale. Existing work is academic-scale and largely confined to logical-reasoning benchmarks, not open-domain or agentic tasks.
• No independent measurement of monitorability loss. OpenAI has now published its own finding for Astra, which is a real advance on nothing. But it is self-reported, not run against a shared public benchmark such as the suite in Guan et al. (2025), and no outside party has reproduced it. Open recurrent-depth checkpoints exist and that suite exists. Nobody has run one on the other.
• No consensus metric for monitorability. Guan et al. (2025) and the several 2025–2026 measurement proposals are not obviously commensurable, and none has been shown to predict real catch rates for held-out classes of misbehaviour.
• No demonstration of activation-level monitoring in production. The filler-token decoding result is offline, unsupervised, on two open-weight models, over four narrow task families. OpenAI now states it is investigating activation monitoring as a successor to reading the chain of thought. As of this writing that is a stated research direction, not a demonstrated capability at deployment scale.
• The interpretability results and the safety-policy literature do not engage each other. "65–93% of latent traces are recoverable" has not been brought to bear on the deployment question in any paper found. This is the most policy-relevant disconnect on the map.
• No binding cross-lab commitment exists. There are stated research-programme intentions and think-tank recommendations. Anyone claiming labs have committed to preserving monitorability is over-reading the record.