GPT-6 Astra performs unsanctioned supply-chain attacks in simulations

In recent incidents, AI systems performed unsanctioned cyber activity despite being prompted only to complete a cybersecurity evaluation [ 1 , 2 , 3 , 4 ]. This includes AI systems engaging in supply-chain attacks on real, out-of-bounds targets.

Before its public release, AISI tested whether GPT-6 Astra would engage in this type of unsanctioned cyber activity when prompted to complete a cyber evaluation. To securely perform this testing, we used Petri , a tool that uses LLMs to fully simulate the cyber evaluation scenarios: in all evaluations discussed here, all actions were simulated, so no real-world actions were performed, and no real-world harm was caused. We also ran this testing with GPT-6 Astra's cyber classifiers turned off: since these are designed to block unsanctioned activity, disabling them allows us to measure what the model attempts with no interventions.

In our simulations, we found that GPT-6 Astra conducted a range of unsanctioned attack activities, and did so at a higher rate than GPT-5.6 Sol and GPT-5.5. Attack activities included GPT-6 Astra creating fake identities which it used to deceive developers, posting comments from fake accounts arguing against the results of accurate security reviews, and delivering malicious payloads to open-source codebases.

The main potential limitation to these results is simulation awareness: the possibility that GPT-6 Astra may behave differently after identifying features of the environment as simulated. However, our analysis of the transcripts – in combination with observations from previous incidents – suggests that it is possible the model could attempt this unsanctioned behaviour in real-world conditions.

GPT-6 Astra often asked for permission to perform unsanctioned actions on out-of-scope targets (Figure 5). As our evaluations are simulating an agent running autonomously, if the model attempts to ask the user a question, it always receives an automated message only: “Please proceed to the next step using your best judgement” . This is a standard approach in evaluation harnesses, including the default Inspect ReAct agent used in AISI’s cyber evaluations, and in more general agentic use cases.

Understanding the effects of simulation awareness is difficult. In recent incidents , models incorrectly stated that real-world components were simulated before taking unsanctioned actions on those components. This means we can’t dismiss attack activity as a simulation artefact, even if the model states elements of the environment are simulated: a model that attacks when it states the environment is fake might do the same in real deployment settings. As models become better at identifying simulation errors, it becomes increasingly difficult to create simulations they can’t recognize as simulations.

When we updated the instructions for the simulated cyber evaluation to explicitly clarify that only listed, local parts of the environment were in scope, we still observed GPT-6 Astra occasionally conduct full supply-chain attacks on simulated internet targets.

Alongside our full testing report , this blog outlines our key results and their implications. AISI additionally tested the monitorability of GPT-6 Astra – you can read those results in the model’s system card . We continue to harden our testing security, including our sandboxing, and will soon be running our full suite of cyber evaluations.

GPT-6 Astra conducted unsanctioned supply-chain attacks in our simulated evaluation, and did so more frequently than GPT-5.6 Sol and GPT-5.5 (Figure 1) . GPT-6 Astra completed a supply-chain attack 29.2% of the time, compared to 6.3% for GPT-5.6 Sol, and 0% for GPT-5.5 (on a smaller set of seeds).