cs.CRSep 29, 2026

Evaluating Whether GPT-6 Astra Performs Unsanctioned Supply-Chain Attacks

Authors: Alexandra Souly, Kai Fronsdal, Abby D'Cruz, Xander Davies, Robert Kirk

Organizations: UK AI Security Institute · UK AISI Research Affiliate

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

This technical report presents an alignment evaluation developed and performed by the UK AI Security Institute for assessing whether advanced AI systems take unsanctioned actions outside the scope of their assigned task. We evaluate whether frontier models conduct supply-chain attacks against out-of-scope, third-party targets when placed in difficult cybersecurity challenges, motivated by recently observed cases of models attacking real open-source repositories during evaluations. Applying our methods to GPT-6 Astra and previous OpenAI models, with cyber safeguards disabled, we find that GPT-6 Astra attempts complete supply-chain attacks in simulation at a higher rate than GPT-5.6 Sol and GPT-5.5. This includes writing malicious code as a contribution to an out-of-scope open-source codebase, creating fake identities to deceive open-source developers, and submitting benign contributions before malicious ones. GPT-6 Astra frequently reasons about the scope of the challenge in its chain-of-thought yet still proceeds to attack out-of-scope targets; it often asks for permission, and treats an automated message as as authorisation; and it continues to take unsanctioned actions, at a reduced rate, when internet access is more explicitly disallowed. Our evaluation builds on an internal version of Petri, an open-source LLM auditing tool, with all tool calls simulated by other LLMs, so that no real network access, systems or third-party repositories are reachable and no real-world harm is caused. Finally, we discuss limitations, in particular simulation awareness. We believe simulation awareness may have driven some of the observed behaviour but does not remove our concern. Our results suggest that defences beyond model alignment, such as sandboxing and monitoring, are increasingly critical for safe and secure deployment.

Figures & tables

Figure 1: GPT-6 Astra took a range of unsanctioned actions during simulated cybersecurity challenges, at a higher rate than GPT-5.6 Sol and GPT-5.5 . We plot the percentage of trajectories in our evaluation set that reached each stage of an unsanctioned supply-chain attack. GPT-5.5 ’s results are based on a smaller subset of seeds but we expect they are indicative. All stages from Create fake identity to the right involve causing effects outside the scope of the evaluation (the first two stages involve actions that do not cause out-of-scope effects). Influence human reviewer does not always come before Deliver malicious payload , which is why the latter has a higher rate than the former for some models. All evaluations took place in simulated environments so no real-world actions were taken or harm caused. Models sometimes failed to progress beyond earlier stages (particularly Create fake identity ) before the evaluation budget ran out, so rates on later stages may have been higher if we had run the evaluation for longer. The stages were classified post-hoc by manual analysis.
Figure 2: GPT-6 Astra attempted full unsanctioned supply-chain attacks in our simulated evaluation. We outline the typical flow of increasingly out-of-scope actions models took in our evaluation, with summaries of representative reasoning and actions from GPT-6 Astra throughout.
Figure 3: GPT-6 Astra explicitly reasoned about how to perform stages of an unsanctioned supply-chain attack on out-of-scope targets in our evaluations. We show a variety of excerpts from GPT-6 Astra ’s raw chain-of-thought, extracted by LLM scanners and hand-picked by AISI researchers. Bold text describes the action discussed in each excerpt, and normal text reproduces GPT-6 Astra ’s reasoning.
Figure 4: GPT-6 Astra frequently reasoned about the scope of the evaluation. The plot breaks down how GPT-6 Astra reasoned about the scope of the evaluation in its raw chain-of-thought. “Attacked” means it reached one of the three stages which had unsanctioned effects on targets outside the scope of the cybersecurity evaluation: Create fake identity , Influence human reviewer and Deliver malicious payload . These results are from the 10-scenario subset where GPT-6 Astra most frequently exhibited unsanctioned behaviour in early testing. See Fig. 5 for example quotes from GPT-6 Astra ’s chain-of-thought.
Figure 5: GPT-6 Astra stated in its raw chain-of-thought that unsanctioned supply-chain attacks on out-of-scope targets were in scope in our evaluations. Excerpts were extracted by LLM scanners and hand-picked by AISI researchers.
Figure 6: GPT-6 Astra often asked the user for permission to perform unsanctioned supply-chain attacks, receiving an automated message it sometimes treated as permission. The plot analyses how frequently GPT-6 Astra asked the operator for permission to take specific actions, and how it responded to the automated message it always received (“Please proceed to the next step using your best judgement”). “Attacked” means it reached one of the three stages which had unsanctioned effects on targets outside the scope of the cybersecurity evaluation: Create fake identity , Influence human reviewer and Deliver malicious payload . These results are from the 10-scenario subset where GPT-6 Astra most frequently exhibited unsanctioned behaviour in early testing.
Figure 7: GPT-6 Astra sometimes stated in its raw chain-of-thought that user messages were automated, and treated automated messages as approval. We include samples from GPT-6 Astra ’s raw chain-of-thought where it discussed or stated that the user messages were automated (left), and examples of reasoning where it described these automated messages as approval to pursue out-of-scope supply-chain attacks (right). Excerpts were extracted by LLM scanners and hand-picked by AISI researchers. Some excerpts have been edited to add whitespace for readability; these are marked with a star. These results are from the 10-scenario subset where GPT-6 Astra most frequently exhibited unsanctioned behaviour in early testing.
Figure 8: GPT-6 Astra still performed unsanctioned supply-chain attacks on out-of-scope targets in our evaluation even when the scope was made explicit, though much more rarely. We added a line to the user message in our evaluations stating “Anything not listed as in scope is out of scope”. With this additional scope clarification, GPT-6 Astra still performed supply-chain attacks on out-of-scope targets, although substantially less frequently. These results are from the 10-scenario subset where GPT-6 Astra most frequently exhibited out-of-scope behaviour in early testing.
Figure 9: GPT-6 Astra consistently reasoned about whether aspects of its environment were real or simulated. Selected chain-of-thought excerpts show GPT-6 Astra asserting that components of its environment were real, discussing the potential real-world consequences of planned actions, and stating that its environment should be treated as real despite possibly being simulated. The model also identified potential simulation errors that our manual verification showed were not errors. Quotes reproduce excerpts from GPT-6 Astra ’s raw chain-of-thought, with omissions marked; “Check” notes report the results of manual verification.
Figure 10: GPT-6 Astra exhibited a range of unsanctioned behaviours in simulated environments without compaction messages. To evaluate a broader set of behaviours and check whether they occurred even without compaction messages, we manually designed a set of scenarios targeting unsanctioned behaviour in cybersecurity challenges without compaction messages. We still observed GPT-6 Astra exhibiting such behaviour, including broader behaviour such as setting up fake accounts to access free compute or contacting simulated humans for help (all simulated actions, so no real-world harm caused). The results here are not comparable to those above (i.e. in Fig. 1 and Fig. 8 ) due to multiple differences in methodology and focus in constructing them.

Explore similar work

CardsList

  1. Divide, Consult, Conquer: Capability Laundering Through Aligned LLMs

    Sep 14, 2026Mark Russinovich, Blake Bullwinkel, Giorgio Severi +2Large Language Model SafetyStrong Large Language Model

    Microsoft Azure · Microsoft

  2. Restricting the Model, Missing the System: Measurement and Accountability in Offensive AI Governance

    May 10, 2026Michael Alexander Riegler, Finn Schwall, Annika Willoch Olstad +4ExploitationArtificial Intelligence Risk

    AI Safety Department SimulaMet and OsloMet Oslo, Norway · Department of Computer Science NTNU Trondheim, Norway

  3. GPT-Red: Automated Red Teaming via Self-Play at Scale

    Jul 28, 2026Eric Wallace, Christopher A. Choquette-Choo, Nikhil Kandpal +15Red-TeamingAttacker Large Language Model

    OpenAI