Watching Its Own Model Now Costs OpenAI 20 Percent Extra, and It Paused a Training Run to Do It
OpenAI says safety monitoring adds roughly 20 percent to the inference compute being monitored. It paused reinforcement learning for two weeks and its largest planned frontier run is still on hold.
OpenAI published a post on 18 August explaining why it slowed down. Two things happened close together: the Hugging Face security incident, and preliminary evidence that Astra, an upcoming model, may cross the Critical cybersecurity threshold in the company’s own Preparedness Framework. In response OpenAI paused reinforcement learning training on its latest models for two weeks while it hardened its research environments, and says its largest planned frontier training run remains on hold while smaller evaluations run first.
The number that got picked up is the cost. OpenAI estimates its monitoring overhead at roughly 20 percent of the inference compute being monitored, though it stresses the figure varies a lot by workload. Inference, if the word is new, is simply the act of running a model to produce an answer, as opposed to training it in the first place. So for every five units of compute spent on a watched workload, a sixth is spent watching it. The company told The Register that this is internal research spend and will not be passed to customers directly.
What that money buys is more than a filter on the output. Classifiers inspect the model’s internal activity at every sampled token and escalate anything odd to progressively more expensive automated investigators, which examine tool actions, the visible reasoning and the whole sequence of behaviour for unauthorised access, data theft, destruction or attempts to get around safeguards. The target is an alert within 30 minutes, and if the teams paged cannot rule out a false alarm in that window, the activity is expected to stop. The requirement covers all reinforcement learning and tool-using evaluations at GPT-5.6 Sol capability or above, and since 7 August, all Astra inference with tools.
Here is the part that is easy to miss. This is a company saying out loud that its own labs are now a risk surface. The security work described is not about protecting users from the model, it is about containing the model inside the building: stronger sandboxes for anything running model-generated code, network isolation so one compromised workload cannot reach the internet, removal of shared services, and automated red teaming that uses their own models to attack their own boundaries continuously. That is a research organisation treating its training clusters roughly the way a bank treats a trading floor.
What this means for you: nothing changes in your ChatGPT window today, and no price moved. The reason to pay attention is the economics. Safety usually gets discussed as a policy question, and here it appears as a line item with a percentage attached, which makes it a thing that can be cut when margins tighten. The Register raised exactly that point: absorbing the cost internally is easier for a private company than a public one, which is worth remembering as OpenAI moves toward a listing. For anyone building with agents there is a smaller, more practical signal: the strongest lab in the field decided that watching what a tool-using model does at every step is worth a fifth of the compute.
Sources
Source: https://openai.com/index/pacing-model-development-cyber-capabilities/
Give a Frontier Model Only a Bibliography and Ask for the Idea. It Gets There 3 to 15 Percent of the Time
A new benchmark called Reconstruction strips away everything except a paper's reference list and asks models to recover its core finding. Seven frontier models scored between 3 and 15 percent. A multi-agent tournament reached 42.
