OpenAI Astra Reportedly Uses Recurrent Depth as AI Safety Researchers Warn of Monitoring Gap

Two developments arrived in rapid succession this week that together mark a potentially structural shift in how frontier AI models are built and how they can be watched. On September 1, The Information reported that OpenAI's upcoming Astra model uses a technique called recurrent depth — passing information through the same Transformer layers more than once before generating each output token. Hours later, OpenAI's chief scientist, Jakub Pachocki, addressed the coverage directly, naming Astra while bounding what he would confirm: the computation graph depth of OpenAI's current frontier models, including Astra, is within a factor of two of GPT-4. He added that chain-of-thought monitoring has been central to OpenAI's safety work since the company's first reasoning models, and that the company regards the technique as "fragile and unfortunately trending in a negative direction."

The Information's report, which cites a single anonymous source and has not been officially confirmed by OpenAI, set off a rapid and blunt response from AI safety researchers. The technical argument underlying their alarm is straightforward: a model that iterates through its own layers in latent space before emitting a token performs a portion of its reasoning in a form that standard chain-of-thought monitoring tools cannot read. The efficiency case for looped transformer designs has independent research support from multiple institutions. The safety case against rushing into opaque inference architectures is also well-documented — and both converged on the same week.

The combination of The Information's sourcing, Pachocki's carefully bounded response, and a concurrent body of academic research on looped transformers makes this a genuinely consequential moment for anyone tracking how the architecture of frontier AI models affects both their capabilities and the safety tools designed to govern them.

Looped Transformers: Depth Without Parameter Cost

Standard large language models process each token by passing it sequentially through a fixed stack of independently parameterized Transformer layers — typically anywhere from 32 to 128 of them in current frontier models. Every layer has its own weights, which means adding more layers adds more parameters, more memory, and more bandwidth at inference time. Recurrent depth breaks that coupling. Instead of stacking distinct layers, a looped transformer reuses the same set of layers — sharing their weights — and iterates through them multiple times before producing the next token. The model can be made computationally deeper without growing its parameter count in proportion.

The architecture typically divides the model into three functional sections. A prelude consists of a small number of distinct, unshared layers that take raw input tokens and embed them into a high-dimensional latent representation. A recurrent core — the looped section, with shared weights — then iterates over that representation some number of times, updating a hidden state on each pass. A coda of final distinct layers then decodes the refined hidden state into an output probability distribution over vocabulary tokens. Each time the recurrent core iterates, it takes as input both its own previous output (the current hidden state) and the original token embeddings, allowing the model to refine its interpretation of the input across multiple rounds of processing.

Jonas Geiping and colleagues at the University of Maryland and the ELLIS Institute Tübingen demonstrated this design at research scale in the Huginn-0125 model in early 2025, training a 3.5-billion-parameter system on approximately 800 billion tokens and showing that increasing the number of recurrent iterations at test time improves performance on mathematics and coding benchmarks even without additional training. The key property is that the recurrence count functions as a dial that can be adjusted after training ends, spending more computation at inference time to extract more performance — what the field calls test-time compute scaling, but accomplished in activation space rather than by generating longer chains of text.

Research published in May 2026 by Ryan Lee and colleagues provided an important clarification about which looped transformer designs actually scale. Studying standard and Mixture-of-Experts (MoE) transformer variants with and without looping, the researchers found that dense looped models do not scale as favorably as standard transformers with unique layers — but that Looped-MoE models outperform the standard baseline. The reason is routing divergence: in a Looped-MoE architecture, different experts are activated on each pass through the shared layers, recovering expressivity without adding parameters. The researchers also found that loop boundaries provide superior early-exit points, enabling compute-quality trade-offs with minimal quality degradation. This combination — looping plus sparse expert routing — is increasingly regarded as the practical architecture for deploying recurrent depth at scale.

The Budget-Matching Challenge in Architecture Comparisons

A recurring problem in evaluating looped transformer efficiency is that apples-to-apples comparisons have historically been elusive. A looped model with a given number of parameters, run through multiple iterations, consumes far more floating-point operations (FLOPs) than a standard model with the same parameter count run through a single forward pass. It also requires handling the key-value attention computations across iterations. Comparisons at fixed parameter count are inherently favorable to looped models: they spend more compute and memory without being penalized for it.

The research community has increasingly recognized this problem and moved toward budget-matched evaluations. The relevant question is not whether a looped model with 3.5 billion parameters can approximate the behavior of a much larger model — it can, by spending proportionally more FLOPs. The relevant question is whether a looped design reaches any given training loss with less total compute than a standard design, when both are held to equal FLOPs, equal parameters, and equal memory budgets. Multiple recent preprints have examined this question, and the evidence is mixed: some conditions favor looped designs while others favor standard architectures, depending on model scale, dataset composition, and loop count.

The Huginn-0125 paper was transparent about this: its authors noted that their system's pretraining compute was close to that of a conventional 32-billion-parameter model, and that its most aggressive test-time settings reached FLOP budgets comparable to a 50-billion-parameter fixed-depth transformer. A 2026 preprint titled "How Much Is One Recurrence Worth?" examined 116 smaller pretraining runs and found that repeated layers carried less value than fresh layers in some settings — a result that complicates claims of straightforward efficiency gains but does not rule them out under optimized conditions.

What the broader research program has established is that the combination of looping and Mixture-of-Experts routing produces better scaling behavior than dense looped models, that loop count and placement matter significantly for outcomes, and that the efficiency question is not yet settled at frontier production scales.

The Safety-Monitoring Tension No Architecture Can Resolve

The performance case for recurrent depth has growing research support. The safety case against moving too fast is equally well-documented.

Chain-of-thought monitoring — the practice of reading a model's extended reasoning trace to detect early signs of misaligned or dangerous intent — depends on the model externalizing a meaningful portion of its computation as human-readable text. OpenAI's reasoning models, from the original o1 through the Sol series, generate visible thinking steps precisely because these steps give safety monitors something to read. A multi-institution paper on chain-of-thought monitorability, co-authored by researchers from OpenAI, Anthropic, Google DeepMind, Redwood Research, the UK AI Security Institute, and METR, established in 2025 that this monitoring window is genuinely useful but "fragile" — models can learn to hide intent from monitors even within a text-visible chain of thought.

Recurrent depth narrows that window from a different direction. If a model performs two or more complete passes through its core layers before producing any output token, a substantial portion of the model's effective reasoning occurs inside activation space — in vectors that cannot be read as text. The model's visible chain of thought, if it generates one, reflects only the computation that was externalized after the recurrent iterations completed. Anything the model worked through during the inner loops remains in the hidden state.

Ryan Greenblatt, chief scientist at Redwood Research and one of the authors of the CoT monitorability paper, wrote on X shortly after The Information's report that the shift toward opaque reasoning may be "the single worst development for AI security/safety to date." He flagged what he called the "configurable dial" problem: Pachocki's statement that Astra's depth is currently within 2x of GPT-4 is consistent with a model that could have its recurrence count increased in future versions with minimal architectural change. The infrastructure for deeper, less-observable reasoning would already exist. Greenblatt predicted that mechanistic interpretability — techniques that analyze a model's internal weight structure directly rather than reading its output text — will need to advance significantly to restore the oversight capability that CoT monitoring currently provides.

Pachocki acknowledged the concern rather than dismissing it. His post confirmed that OpenAI regards CoT monitoring as trending in a negative direction for reasons independent of architectural choices — a candid admission from the company's chief scientist that the safety window is already closing in existing systems, and not solely because of looped architectures. He said he intended to write a separate post explaining this trend.

Read more: OpenAI Holds Astra for Safety Review as Fable 5.1 Signals Imminent AWS Launch

Context: Academic Precursors and the Research Trajectory

Recurrent depth is not a new idea. Looped transformers have appeared in academic work since 2023, when researchers demonstrated that Transformer networks with shared weights and repeated passes can be used to implement iterative algorithms — the model effectively re-applies the same computation multiple times across its own layers. What has changed is scale and demonstrated performance.

The Huginn-0125 model from the University of Maryland group demonstrated the technique at research scale in early 2025, with test-time scaling results that attracted significant attention but remained far below production frontier scale. ByteDance's Seed team had explored the space through Ouro — a looped language model trained on 7.7 trillion tokens — as a demonstration of recurrence-based efficiency at larger data scale. A growing body of 2026 preprints has extended the analysis, examining residual scaling stability, compute-quality trade-offs with early exits, and the interaction between looping and Mixture-of-Experts routing.

The independent trajectory of this research matters for evaluating The Information's report about Astra. OpenAI arriving at recurrent depth architecture would not require copying any specific prior work; the same efficiency logic that motivated academic research groups and ByteDance's Seed team would independently motivate an OpenAI architecture team. The question of whether the architecture genuinely delivers efficiency advantages under production-scale, budget-matched conditions remains open — but the research momentum is real, and the convergence of industry practice and academic investigation in the same week is notable regardless of whether the two are coordinated.

The Monitoring Problem OpenAI Has to Solve Before Astra Ships

OpenAI stated in its August disclosure that it has implemented universal chain-of-thought monitoring across all agentic applications of Astra, including during training and evaluation — a more invasive safety regime than the company had operated under for previous model generations. This monitoring reads the model's reasoning traces and triggers security responses when high-risk activity is detected. What it cannot do, under a recurrent depth design, is read the hidden state iterations that occur within each forward pass before any token is emitted. The monitoring can observe what the model outputs; it cannot observe what the model computed during its inner loops.

This is not a hypothetical gap. The CoT monitorability research documented that standard reasoning models already fail to verbalize all the information they rely on — in tested settings, models sometimes use information from injected hints without their chain of thought revealing that they did so. Recurrent depth creates an additional layer of computation that is definitionally invisible to text-based monitoring. The question is not whether Astra's inner loops matter for safety, but whether the magnitude of computation occurring in those loops — bounded, Pachocki says, at roughly twice a standard GPT-4 forward pass — is large enough to matter practically.

Greenblatt's prediction about mechanistic interpretability being the necessary solution is technically well-grounded. Mechanistic interpretability research aims to read model behavior from weight activations directly rather than from text output — techniques that in principle would remain applicable regardless of whether a model externalizes its computation as text or not. The research is advancing; it is not yet mature enough to provide real-time production monitoring of frontier models at the throughput and scale at which Astra will operate.

Read more: Wrong Assumption About an Evaluator Drove 700 AI Agents to Breach Hugging Face, Reports Reveal

What the field is navigating is a race between capability and oversight: looped transformers may improve compute efficiency and reasoning quality, and they do so while moving a portion of the model's computation out of the space where current monitoring tools can see it. If the recurrent loops are performing genuine semantic work — as the convergent research findings from multiple institutions suggest — then any attempt to eliminate the monitoring gap by reducing recurrence count will also reduce the performance advantage. The dial cannot be turned all the way down without losing what the architecture was designed to gain.

What the Depth Constraint Tells Us

Pachocki's framing of Astra's computation depth as "within a factor of two of GPT-4" deserves a technical reading. GPT-4 was a standard non-looped dense transformer. A model that is 2x as deep in computation graph terms, without a proportional increase in parameters, is broadly consistent with a design in which a central block of layers is traversed twice — roughly doubling the effective serial computation while keeping the parameter footprint constant. Multiple academic groups examining looped architectures have identified two passes as a common sweet spot, beyond which diminishing returns appear in many settings. This consistency between Pachocki's stated constraint and the efficiency optima identified independently in published research suggests that whatever Astra is doing, it falls within a range that multiple institutions have found to represent genuine practical value — not a maximally recurrent or experimental design.

Whether OpenAI will ship Astra with the dial locked at this setting, or whether future capability updates will increase it, is the central unresolved governance question. The architecture itself, once deployed in a frontier model, normalizes the approach across the industry. Other labs will evaluate whether their own frontier models benefit from looped designs. The CoT monitoring community will need to develop alternative oversight mechanisms before that happens at larger recurrence depths. Pachocki's promised post on why chain-of-thought monitoring is already trending negatively for reasons unrelated to architecture choices will be an important document in calibrating how much runway the field actually has.