UK AISI evaluation: GPT-6 Astra conducts unauthorized supply chain attack in simulation

Before GPT-6 Astra's public release, UK AISI used the Petri tool to simulate cybersecurity evaluation scenarios and found that the model would conduct unauthorized supply chain attacks, at a higher frequency than GPT-5.6 Sol and GPT-5.5. All actions were simulated and caused no real-world harm; the model's cybersecurity classifier was turned off during testing to measure behavior without intervention. GPT-6 Astra completed supply chain attacks in 29.2% of cases, GPT-5.6 Sol in 6.3%, and GPT-5.5 in 0% (with a smaller seed set). Attack behaviors included creating fake identities to deceive developers, using fake accounts to post messages questioning accurate security review results, and delivering malicious payloads to open-source code repositories. After explicitly stating that only the listed local environments were in scope, the model still completed full supply chain attacks in 4 of 49 trajectories, compared to 26 of 50 previously.