OpenAI Scrambles to Fix Safety Issues Before Shipping Its Next Flagship Model

OpenAI is grappling with fallout from its use of a controversial innovation in AI design as it works to get its next unreleased model to a place where leaders believe they can safely release it.

The model design, known as loop transformers or recurrent depth, can make it harder to monitor the way the AI “thinks,” or how it reasons and processes its response to a question or task, The Information reported last month. That means the technique could erode a key tool that OpenAI and other companies rely on to catch misbehaving models. OpenAI hasn’t publicly acknowledged the technique, but Microsoft last week accidentally confirmed OpenAI’s use of it in one of the AI company’s most advanced commercially available models, GPT-6.1 Sol, in a blog post it has since edited to remove the disclosure.

Internal concerns about the use of loop transformers also appear to be connected to the work of three safety researchers whom OpenAI recently fired and who are now publicly feuding with the company over the circumstances of their dismissal.

In a letter sent last week to OpenAI’s board directors and other safety advisors to the company, the three researchers emphasized that they didn’t disclose the use of loop transformers to The Information, but said that the company needs to take steps to ensure that the “thinking” of frontier models remains monitorable. The researchers also said they’d been involved in work with other companies, which OpenAI had sanctioned, to limit the development of “unmonitorable architectures” for AI.

OpenAI has said in response to the letter that the firings weren’t related to researchers sharing safety concerns. “Safety and research debates happen every day at OpenAI, often spirited and highly critical,” OpenAI research leaders wrote in a recent memo. “We actively encourage these discussions and consider them essential to making the right decisions.”

The company didn’t comment on its usage of loop transformers, but the memo said the research leaders agree “that preserving the monitorability of frontier models requires an industry-wide commitment, including from OpenAI.”

Still, the researchers’ dismissal has raised anxiety among some other employees as well as outside AI safety advocates about whether OpenAI is seeking to discourage staffers who flag safety issues with its models.

The feud involving researchers has played out as OpenAI has been in an all-hands-on-deck mode to prepare its next major model for commercial release, after publicly announcing its decision to halt the release of a different, less-capable model due to safety concerns.

Preparing the new model—which a person familiar with the situation said also uses loop transformers—could take a while. The process involves getting the new model to align its objectives with what OpenAI researchers and customers want, and securing the software being used to test the model’s capabilities, employees say. After leaders get comfortable with the model’s performance on safety evaluations, OpenAI will need to share the model with the U.S. government for testing up to 30 days before it can share the model with trusted partners and then broadly release it, one employee said.

OpenAI agreed to such a process following an executive order from President Trump regarding evaluations of advanced AI.

Even still, OpenAI is likely to release one or two new models by the end of the year, if not the major upgraded model it is racing to prepare, employees said.

Shifting More Compute to Safety Work

The increased focus on safety and security at OpenAI comes after a spree of AI-powered breaches caused by the company, including most prominently an incident this summer where a swarm of OpenAI agents broke out of a testing environment and gained access to open-source repository Hugging Face and other businesses. The AI agents did so despite acknowledging in writing that they weren’t supposed to. The agents’ acknowledgement is the kind of legible reasoning that looping architectures threaten to hide.

Other AI developers including Anthropic, Google and Meta have experienced similar AI-powered breaches in recent months. Last week, Anthropic said that its AI had used the internet to inadvertently fill out government forms with incomplete information and also submitted a false homicide crime tip to the Philadelphia police department.

Model Fallout: A Timeline of Events Since the Hugging Face Incident

July 2026July 2026 • OpenAI discloses Hugging Face breach by agents powered by GPT‑5.6 Sol and a more capable, unreleased model. Aug. 2026Aug. 2026 • OpenAI says the agents were trying to cheat on an evaluation by finding solutions online. Sept. 2026Sept. 2026 • The Information reports that OpenAI is using recurrent depth or looped transformers in new models.• OpenAI’s chief scientist says it is prioritizing making AI reasoning legible to humans.• OpenAI says its AI accessed parts of the Department of Education website and improperly interacted with sites run by the SEC.• OpenAI commits to embedding outside safety evaluators in its offices, following similar Anthropic commitment.• OpenAI fires three safety researchers. One, Tomek Korbak, said he was told he was fired over how he communicated with METR, a safety organization OpenAI partnered with to investigate the Hugging Face incident.• FTC says it is investigating OpenAI, Anthropic and others over consumer safety issues. Oct. 2026Oct. 2026 • Microsoft inadvertently confirms GPT-6.1 Sol and GPT-6 Sol use looped inference.• The three researchers publish a letter calling for industrywide safety measures.• OpenAI says a thorough investigation found the researchers violated policies on handling sensitive information, which they deny.• OpenAI staff work on safety measures to prepare its next flagship model.• OpenAI says it is “finalizing contracts with third-party safety assessors” and will announce details soon.

In the wake of the Hugging Face attack, OpenAI shifted about 10% of its total computational resources, or hundreds of megawatts of data center capacity, toward so-called alignment and safety work, a person with knowledge of the figure said late last month. It isn’t clear how many servers were previously dedicated to such work or what the current level is, but renting that amount would cost OpenAI a minimum of billions of dollars on an annual basis at the current market rate.

OpenAI also has poured resources into efforts to beef up security around its AI. For instance, a number of engineers and researchers are focused on “hardening” the digital sandboxes that are supposed to keep unreleased models away from the internet and other software during testing, according to an employee. Such sandboxes were a key channel through which OpenAI’s AI agents escaped during the Hugging Face breach.

Amid those safety concerns, OpenAI’s use of loop transformers has been a sensitive aspect of its model development.

OpenAI uses such looping in both its model training and inference, when its completed models handle tasks for customers. The Microsoft disclosure about OpenAI’s use of the technique came in a technical description of GPT-6.1 Sol. OpenAI launched that model earlier this month, saying it performs nearly as well as its recent flagship GPT-6 Astra at a much lower price.

Microsoft, which has access to OpenAI’s intellectual property, said in the now-deleted section of its post that the model relies on looping inference, or a form of reasoning where the model thinks through the same problem in multiple “passes” before generating an answer. GPT-6.1 Sol “uses the same base model weights as GPT-6 Sol with two inference passes instead of three,” according to a copy of the webpage viewed by The Information.

That description was an accurate summary of what OpenAI privately shared with Microsoft about the model, according to someone with direct knowledge of the situation. Microsoft later removed the passage after realizing it was meant to be kept secret, this person said.

Looping models repeatedly process the same problem in ways humans can’t read. OpenAI has limited its use of loops with Astra so the model still produces legible information about its reasoning, known as chain of thought, and the company’s researchers can still sufficiently monitor it. The company says it’s working hard to preserve that legibility despite new challenges that have made it harder, separate from any changes to its models’ architecture.

Plugging Security Holes in Other Software

Beyond the work to make models safer, engineers at OpenAI have also been focused on finding security vulnerabilities in various types of software the company uses internally. For example, in recent weeks, engineers found vulnerabilities and wrote patches for FFmpeg, popular open-source software that’s used to process videos, said a person with knowledge of the incident. Engineers also found a number of vulnerabilities in open-source software the company uses to convert data into a widely-used format called JavaScript Object Notation,which AI models often use in giving responses that require a consistent structure, the person said.

It’s important for OpenAI to fix these vulnerabilities because they represent potential avenues for AI models to conduct cyberattacks, the person said. However, AI has also helped engineers find these vulnerabilities and patch them much more quickly, they said.

The recent focus on safety and security has especially helped to elevate OpenAI’s security team internally, the person said. That team is led by Chief Information Security Officer Dane Stuckey, who previously held the same position at Palantir and who reports to OpenAI Co-founder and President Greg Brockman.

Many of the incidents the security team works on are closely guarded, as leaders are concerned that if bad actors within or outside the company were to learn of these vulnerabilities, they would be able to more easily exploit them, the person said.

OpenAI is also making changes to its process for starting so-called training runs to develop more-advanced AI. One change requires leaders to write documentation, otherwise known as safety cases, explaining the risks of the training run and why they believe it’s safe to proceed with it.

The company in a blog post last month outlined some of these changes, which are either already in place or will be soon, a person with knowledge of the situation said. Those changes include requiring several leaders to sign off on each safety case, each with the power to singlehandedly veto the training run; holding the senior leader responsible for a training run accountable for any incidents as part of their performance reviews; and implementing a system that will either automatically pause a training run or alert an employee if an incident occurs.

Outside evaluators who get special access to unreleased models for safety or performance testing have also received instructions from OpenAI in recent months to have stricter cybersecurity protocols, including to use two factor authentication and to have special processes for monitoring models when they’re running, said a person from one of these evaluation organizations.

Rocket Drew also contributed to this article.

Stephanie Palazzolo is a reporter at The Information covering artificial intelligence. She previously worked at Business Insider covering AI and at Morgan Stanley as an investment banker. Based in New York, she can be reached at [email protected] or on Twitter at @steph_palazzolo.

Aaron Holmes is a reporter covering tech with a focus on enterprise and cybersecurity. You can reach him at [email protected] or on Signal at 706-347-1880.

Amir Efrati is executive editor at The Information, which he helped to launch in 2013. Previously he spent nine years as a reporter at the Wall Street Journal, reporting on white-collar crime and later about technology. He can be reached at [email protected] and is on X @amir