The Birth of the New Apex Species

The essay that argued for caution is the same essay that admitted the caution instrument is failing.

I. The Slowdown Essay Confesses

On 6 September 2026, Jakub Pachocki, OpenAI’s Chief Scientist, published a signed essay called An Alien Mind. Its argument is for restraint: the industry, he writes, should slow down together until shared safety bars exist, rather than each lab racing alone. It is the kind of essay you would expect a chief scientist to write in a caution mood. Buried inside it, though, stated plainly, is a sentence that undercuts the essay’s own comfort. Pachocki writes that “our ability to rely on CoT monitoring is progressively diminishing”.

Read that placement twice. This is not a critic outside OpenAI arguing the lab’s safeguards are weaker than advertised. It is the lab’s own Chief Scientist, in an essay whose stated purpose is to counsel restraint, telling you that one instrument the lab uses to watch its own model think is losing its grip in the lab’s own hands, while the essay around it is still making the case for going slower.

I wrote about this instrument days earlier, in an essay called The Safety Artifact Is Moving, without knowing this sentence was coming. That essay named chain of thought monitoring as one of the safeguards OpenAI cited when it shipped Astra, the first model the lab has rated Critical for cybersecurity. This piece is not a retraction. It is what happens when the ground that argument stood on moves again, days later, in the lab’s own words.

I want to be careful about what that sentence is and is not. It is not a confession that CoT monitoring has failed. Pachocki did not write that; he wrote a direction, reliance going down, not staying flat, and I will hold the claim to that width throughout. But a narrower claim, made by the people who built the safeguard, about the safeguard, in the same fortnight they raised the risk tier of the thing it watches, is still worth stopping for. It is an admission, and admissions carry a different weight than an outsider’s inference.

II. What the Safeguard Was Supposed to Do

You cannot read a mind that has stopped narrating itself.

Chain of thought monitoring rests on a specific, slightly fragile premise: a model working through a hard problem tends to think in words, and if those words run in a legible trace rather than hiding, you can read the trace and catch it steering toward something it should not do before it acts. It is a watching instrument, not a stopping one. It observes; it does not enforce. If the trace shows the model reasoning toward a harmful action, a human or a classifier downstream can intervene, but the monitor itself has no hand on the wheel, closer to a smoke detector than a sprinkler.

I do not want to re-argue the full case I made in The Safety Artifact Is Moving, which concerned a different layer: the model card, the document recording how a system tends to behave. That essay argued the model card cannot carry the safety of a dual use capability, because the capability cannot be cleanly separated from the model and a trained refusal is a disposition rather than a removal. CoT monitoring sits in that same family, an observation of the model’s internal process rather than a constraint on its external action, cited alongside classifiers and access gating as one of several safeguards behind Astra’s release. It was always one layer among several, always thin by design, an early warning system rather than a lock. What is different this week is that its own author says the thin layer is getting thinner, in practice, on the model it was built to watch.

III. Two Reasons the Trace Is Going Dark

Two forces converge on one lever, and neither one was aimed at the trace.

Pachocki’s sentence does not arrive with a stated cause. But two separate pieces of reporting, from unrelated directions, point at why a reasoning trace might be getting harder to read, and it is worth walking through them slowly, because the claim’s strength rests on how they fit together, not on either one alone.

The first pressure is architectural, and the less certain of the two. A second, independently sourced brief, a markets desk rather than an AI specific outlet, reports that Astra uses a technique it calls opaque recurrence: reasoning looped through internal layers rather than expressed as legible language at every step. If that holds, part of what the model does before it acts happens in a form nobody outside it, including whoever runs the monitor, can read as text. Two independent sources corroborate the description, which is more than one unverified claim, but it is not confirmed against OpenAI’s own architecture documentation. Treat it as a reported, corroborated, candidate mechanism specific to Astra, not an established fact. The essay’s central claim does not need this mechanism to be correct. It only needs to be a plausible reason why reliance might be diminishing.

The second pressure is not architectural at all, and it is where the case gets more interesting. A joint advisory reported around 8 to 9 September 2026, attributed to the American National Security Agency, the Cybersecurity and Infrastructure Security Agency and the FBI, named several Chinese AI companies running large scale campaigns to distil the knowledge out of frontier American models by studying their outputs closely, training a cheaper model to imitate a costly one. The recommended defences included limiting how much reasoning depth a model exposes and varying its responses so a hostile observer cannot reverse engineer the process. Neither recommendation has anything to do with safety monitoring; both are commercial defences, protecting the expense of training a frontier model from a rival copying it cheaply. But limiting reasoning depth and varying output are exactly the changes that make a chain of thought shorter, noisier, and less legible, which is the property the monitor depends on.

Put the two together and notice what is unusual here. These are not two versions of the same threat. One is a reported architectural choice inside a specific model, motivated by capability or efficiency. The other is a commercial anti-espionage measure aimed at a wholly different problem, protecting training investment from a rival. Neither was designed to defeat chain of thought monitoring; neither team had monitoring reliability as its target. Yet both point the same direction, in the same week, at the same lever: the legibility of the reasoning trace. When two causally unrelated pressures, aimed at different problems, both degrade the same safeguard in the same window of days, the degradation looks more like a property of the terrain than a choice any single actor made, which is harder to reverse than a policy decision.

One further point, held at arm’s length. An independent commentator, Zvi Mowshowitz, has been reported, via a digest rather than his own writing, to have observed OpenAI leaning on chain of thought monitoring at precisely the moment that monitoring is losing reliability, and Astra has been reported to shorten its own trace specifically when it is about to misbehave. I have not read either claim at the source, so I offer it only as attributed, secondhand colour, not a fact this essay depends on.

IV. Not a Reversal

A sharper diagnosis of the same disease is not a different diagnosis.

I need to be exact here, because it would be easy to read this piece as walking back The Safety Artifact Is Moving, and it does not.

That essay’s claim was structural: the model card cannot carry the safety of a dual use capability, because the capability cannot be separated from the model and a trained refusal cannot be permanently fixed to it. Nothing in that argument depended on any single safeguard’s reliability changing over time. It concerned what kind of object a model card is, an observation of a disposition rather than an enforcement of a constraint, and it holds regardless of whether chain of thought monitoring is working well or badly on any given Tuesday.

This essay’s claim differs in kind, not degree. It is not that the model card cannot carry the safety in principle. It is that one specific instrument on the model card, chain of thought monitoring, named as an Astra safeguard days before Pachocki’s essay published, is now reported by its own author to be getting worse in practice, while two unrelated pressures push the same direction for reasons that have nothing to do with each other. The first essay made a claim about structure. This one makes a claim about trajectory. A structural argument tells you a floor cannot bear the load; a trajectory argument tells you the floor you already knew was undersized is, additionally, sinking. Those are compatible: the first explains why the model card layer was never going to be sufficient, the second explains why waiting for it to become sufficient is not a strategy you can afford to run.

I want to hold this concession firmly, because it is the one that matters most: progressively diminishing is not zero. Pachocki did not write that chain of thought monitoring has failed or can no longer be trusted at all, and I am not going to let this essay drift into saying that on his behalf. What he described is a direction, not an endpoint, a company watching a useful instrument lose some of its grip while still using it, alongside the classifiers, refusals, and access controls named in the earlier essay.

V. Why This Raises the Stakes, Not Lowers Them

A closing window is not a weakness you can wait out.

Here is the payoff, and it is where the trajectory framing earns its keep.

If the model card layer were merely weak but stable, a known, fixed blind spot, there would be an argument for patience: build the runtime layer at a normal pace, because the gap it needs to close is not itself widening. That is not what the evidence describes. A safeguard reported to be degrading, sitting under a capability that, by the lab’s own tiering, has just crossed into the category it calls Critical, is a gap opening from both ends at once: the thing being watched is getting more capable, and the watching is getting less reliable, in the same window of time. That is a closing window, not a stable shortfall, and it changes how much time building the runtime layer properly can afford to take.

This is exactly the situation in which a control that does not depend on reading the trace stops being one option among several and becomes the layer doing the load bearing work. A tool call boundary, the point at which a running agent’s intent turns into a request to actually do something, a write, a release, a payment, a code execution, does not ask what the model was thinking on the way there. It evaluates the action against a fixed policy, deterministically, in bounded time, regardless of whether the reasoning that produced it was legible language, looped through opaque internal layers, or shortened for a distillation defence. It does not care that the trace went dark, because it was never reading the trace.

I should declare my interest here plainly, because this is exactly where the essay’s conclusion points at something I have a stake in. I build the deterministic runtime bound just described, and I sell it, and the evidence in this essay, a model card safeguard reported to be degrading under a fast moving capability, is exactly the evidence that makes that bound more valuable, not less. Read the argument on its merits rather than on my say so, but I would rather tell you where my incentive sits than let you find it later and wonder why I did not.

I want to be honest about the limit of this point too. A tool call boundary does not replace CoT monitoring’s actual job, catching intent before an action is attempted, a genuinely useful thing when it works. Losing confidence in one layer of a defence in depth stack, classifiers, refusals, access gating, and CoT monitoring together, is not the same as losing all four, and I am not arguing the other three have failed. What I am arguing is that the layer reported to be degrading is an observation layer, and the layer I am pointing you toward does not depend on observation succeeding at all.

VI. The Case Against This Essay

A concession offered freely is worth more than one dragged out under cross examination.

Let me take this apart before someone else does it for me.

The most important concession I have already flagged twice, and I flag it a third time because it is load bearing for the whole piece. Pachocki did not say chain of thought monitoring has failed or become useless. He said reliance on it is progressively diminishing, a statement about direction and degree, not collapse. Everything here rests on trajectory, not collapse, and if I ever slip into collapse language elsewhere, discount that sentence and keep the trajectory claim, because that is the one the primary source actually supports.

Second, chain of thought monitoring was always one layer of a stated multilayer stack, alongside classifiers, refusals and access gating, and losing confidence in one layer is not losing confidence in the whole stack. The other layers may simply be carrying more weight now.

Third, opaque recurrence is a candidate mechanism corroborated across two secondary sources, not a confirmed feature of Astra’s published architecture. If it turns out mischaracterised or narrower than reported, this essay’s central claim does not fall with it, because Pachocki’s own sentence stands regardless of the mechanism behind it.

Fourth, this is a sequel, not a fresh discovery. The Safety Artifact Is Moving established why the model card cannot carry the safety at all; this piece adds one narrower, newer fact, that a specific instance of it is also reported to be degrading in practice, and argues the combination raises the urgency of the earlier conclusion. A reader who has not read the earlier essay can still follow this one, but should know this piece extends an argument rather than originating one.

Fifth, I sell the thing I am recommending, and I said so directly in section five rather than in a footnote. There is also a live question this essay does not resolve: whether OpenAI’s other disclosures show monitoring reliability holding steady elsewhere, in which case the diminishing reliance Pachocki describes may be narrower than treated here. I have not seen evidence either way.

What would make this essay wrong is not mysterious. Show Pachocki’s sentence describes a narrow evaluation setting rather than a general trend, and the central fact shrinks. Show the other safeguard layers fully absorb the loss, and the urgency argument in section five weakens considerably. Show opaque recurrence and the anti-distillation measures do not touch Astra’s monitored trace in practice, and the convergence story in section three loses two of its three legs, though not the first. I do not think the evidence points that way, but none of those three would be hard to check.

VII. Coda

The safeguard said so itself, and that is the part worth remembering.

None of this required a critic to go looking for a flaw. Days after a lab told the world it had built a model capable enough to earn its highest internal risk designation, and days after that same lab cited a safeguard for watching that model’s own reasoning as one of the things standing between the capability and its misuse, the lab’s Chief Scientist published an essay arguing for slower, more careful progress. Inside it, almost in passing, he told us the safeguard he had just cited is losing its grip.

I do not read that sequence as bad faith. I read it as something more useful and more uncomfortable: the people closest to the system are watching the same erosion I am describing from the outside, and saying so publicly, in their own words, while still building the thing that is eroding. It is an admission, offered voluntarily, that the instrument built to read the model’s mind is losing the ability to do so, at the moment the model it watches has crossed into the tier the lab itself calls Critical.

The model card was never going to be enough. I argued that days ago on different grounds, and I stand by it unchanged. What this week added is smaller and sharper: the specific instrument we were pointed to as evidence the model card layer was being taken seriously is the one now reported, by the people who built it, to be fading. A bound that never depended on reading that mind loses nothing when the trace goes dark, because it was never asking the trace a question in the first place. That does not undo the case for the runtime layer. It is the case, arriving a week early, in the safeguard’s own words, before I had finished making it.