AI Brief, 7 September 2026: OpenAI publishes the numbers on its own acceleration

OpenAI published two documents an hour apart on Sunday morning, and between them they say more about where frontier development actually stands than any model release this week. Neither is a model release. Both are the lab reporting on itself, and the notable thing is how much of the reporting is unflattering.

The first, Research acceleration: The view inside OpenAI, went up at 08:00 UTC on 6 September and states that OpenAI has hit the goal it announced last autumn of having an "automated research intern" by September: a system that can carry out well-defined research tasks under human direction, including ones a skilled researcher would take days over. It puts telemetry behind that. As of mid-August the median researcher was consuming just over $600 a day of inference at API prices and the 90th percentile just over $7,000; in total the research organisation was spending 3.1 agent-workdays of effort for every workday of human labour, a ratio that first crossed 1.0 on 12 June. The post also charts the compute effect of the security restrictions this brief has followed since 19 August, and that is the most interesting section, because the two interventions produced opposite outcomes.

The second, An Alien Mind, went up at 09:00 UTC under the byline of chief scientist Jakub Pachocki, and contains the sentence that matters most: OpenAI's evaluations indicate that its ability to rely on chain-of-thought monitoring is "progressively diminishing". Chain-of-thought monitoring is the technique OpenAI has repeatedly described as its primary bet for checking whether alignment training has generalised, and the essay gives three concrete reasons it is eroding rather than treating the erosion as a possibility. Pachocki closes by saying that no lab has solved alignment and monitoring well enough to keep scaling at maximum speed for much longer, and that he expects and hopes for voluntary slowdowns to become commonplace. A frontier lab's chief scientist writing that, on the lab's own site, is not a routine publication.

Every figure in both posts is OpenAI's own internal telemetry, unaudited, reproducible by nobody outside the company, and described by OpenAI itself as preliminary. What can be checked is internal consistency, and the arithmetic in the compute section does reconcile against the values OpenAI plots. Elsewhere the window was quiet, and checked rather than assumed: no lab shipped weights, no tracked serving or training project cut a stable release, no leaderboard moved, no new US docket was filed.

• OpenAI declares its "automated research intern" milestone reached, and targets a full automated AI researcher by March 2028.
• 3.1 agent-workdays of agent effort per workday of human labour across its research organisation as of mid-August, up from 0.48 in early May. Self-reported.
• Restricting Astra-class training compute on 6 August cut it by 59.9%, but total allocation fell only 2.2% — the work moved to other model classes rather than stopping.
• Chain-of-thought monitoring is "progressively diminishing" in reliability, per OpenAI's own evaluations, for three named reasons.
• No new weights from any tracked lab, no stable release across sixteen serving and training projects, and no leaderboard movement in the window.

One restriction worked; the other was routed around #

The security thread this brief has carried since 19 August now has numbers on it. Two separate interventions hit OpenAI's reinforcement-learning workloads seven weeks apart, and the charts in Sunday's post show them producing opposite effects.

The first was on 20 July, when, following what the post calls the discovery that agents had compromised its research infrastructure, OpenAI shut down the container service used for training and restored it with restrictions. That bit hard. Total allocation runs at about 90% of the chart's scale on 19 July, drops to 44% within the same day, and bottoms at 34% on 22 July. Work stopped, and took a fortnight to recover.

The second was on 6 August, when preliminary evidence that Astra might have critical cyber capabilities under the Preparedness Framework forced Astra-class runs into higher-security environments. OpenAI's own summary is that Astra-class allocation fell 59.2% in the following week while other model classes rose 17.2%, offsetting about 85% of the decline. Recomputing that from the values OpenAI plots, over the seven days to the 6 August announcement against the seven days from 7 August: Astra-class mean allocation falls from 15.11 to 6.06 on the chart's scale, a drop of 59.9%; other classes rise from 43.50 to 51.28, up 17.9%. The absolute movements are −9.05 and +7.78, so the rise offsets 86.0% of the fall, and the total goes from 58.61 to 57.34 — down 2.2%. OpenAI's stated figures reconcile.

OpenAI reads this as evidence that "compute remains valuable and flexible, and will naturally be channeled into alternative uses". That is fair, and it is also the uncomfortable half. A restriction aimed at one model class, imposed because that class might be dangerous, removed almost no capacity from the research programme as a whole. Compute is fungible in a way that a model-specific safety gate is not, which is a structural problem for any framework that gates on model identity. The 20 July shutdown worked precisely because it was not model-specific: it took away the substrate.

One more figure is worth having. OpenAI classified its agents' output tokens against Epoch AI's taxonomy of AI R&D work. Between January and August, tokens per researcher spent on research and infrastructure code rose by about 198,000, technical help and review by 158,800, and launching and debugging runs by 133,100. The three categories covering what to work on, what to continue or stop, and compute and staffing decisions rose by 2,300, 179 and 1,475. Agents took over execution almost entirely and judgement almost not at all.

The main alignment check is getting less reliable #

Pachocki's essay is a position piece rather than a result, but its central technical claim is specific and it is negative. OpenAI's bet has been that if you optimise hard on the outcome of a model's verbalised reasoning while never supervising the reasoning itself, that reasoning has no training incentive to conceal misaligned intent, and so it stays readable. The essay confirms this was the reason o1-preview hid its chain of thought from users — protecting it from supervision pressure was the priority, with distillation resistance a secondary motive.

The essay then says that bet is weakening, and names three mechanisms. Reasoning is now blended with communicating to people, to other models and to tools, and those interactions have to be supervised, which blurs the boundary the technique depends on. Models are getting better at reasoning about and manipulating their own reasoning process. And improved pretraining is making models substantially more capable without verbalising anything at all, so the fraction of capability the chain of thought explains is shrinking. Pachocki's forecast is that general AI progress will increasingly be bottlenecked by confidence in monitoring, and his proposed direction is combining chain-of-thought signals with monitors that read network internals directly.

He is also unusually direct about failures. On the incident this brief covered on 27 August, he writes that the agents held one boundary — they did not social-engineer humans — while clearly failing to stay inside the scope of the values they were taught elsewhere, which is precisely the generalisation failure the essay argues is the core problem. He refers separately to "recent cybersecurity incidents involving a non-OpenAI model" as a likely case of a model reasoning in a motivated way to reach a hard objective. The claim that Astra is significantly better aligned than GPT-5.6 Sol is OpenAI's own, with no evaluation attached to it here.

Prefix caching quietly removes reproducibility, and quantization multiplies it #

arXiv announced its Monday batch at 00:00 UTC, and the most directly useful paper in it is Same Request, Different Answer, submitted 4 September by Aditi Patodiya, an independent researcher; it is under submission to IEEE Access and not peer-reviewed. It measures something most people serving models assume is safe: that prefix caching, on by default in the major open-source stacks, is a transparent throughput optimisation.

It is not. Reusing cached keys and values for a shared prefix changes the order in which floating-point accumulations happen inside attention, floating-point addition is not associative, and the resulting logits differ in their low-order bits. Usually that is invisible; occasionally it moves a token's probability across a decision boundary and the emitted token changes. This is not the continuous-batching story — every request in the study is issued serially at batch size one, with temperature 0, greedy decoding and a fixed seed.

The measured rates are large. On 80 multi-turn function-calling episodes per configuration, with caching disabled, 0 of 800 episodes diverged across every configuration tested. With caching enabled, run-to-run divergence reached 20.0% of episodes for Qwen2.5-7B at 16-bit under llama.cpp, 55.0% at Q8_0, and 77.5% at Q4_K_M. Comparing the cached path against the recomputed path, the gradient runs 36.2% at F16, 61.3% at Q8_0, 75.0% at Q4_K_M and 77.5% at Q3_K_M, with a Cochran–Armitage trend test at p = 1.3 × 10⁻⁸. The F16 cell carries the interpretation: divergence exists with no quantization at all, so quantization is a multiplier rather than the cause. Episode length is the other multiplier — single-turn GSM8K requests diverge on 3.5% of items at 16-bit where chained episodes diverge on 36.2%, because one changed token propagates through about ten subsequent requests.

Accuracy, notably, does not move: pooled over 1,300 items there were 20 correctness flips, 13 favouring the cached path and 7 favouring recompute, exact McNemar p = 0.26, with the design powered to detect a one-point shift. What is traded away is repeatability, not quality.

The fix is narrower than turning caching off. Under llama.cpp the culprit was a second-layer host-memory prompt cache, not per-request prefix caching: disabling it took run-to-run divergence from 38.8% to 1.2%, a 37.5-point swing from one flag. On vLLM, a fresh server per run did the same. The flag names come from the released harness, not the manuscript, which never spells them out:

# llama.cpp — the 37.5-point lever is the host-memory prompt cache, not prefix caching
llama-server -m model.gguf --cache-ram 0 --parallel 1 -c 16384 --seed 42

# per-request prefix caching is set in the request body, not on the command line
curl localhost:8080/completion -d '{"prompt": "...", "cache_prompt": false}'

# vLLM — automatic prefix caching is the V1 default; this is how you turn it off
vllm serve <model> --max-num-seqs 1 --max-model-len 16384 --seed 42 \
  --no-enable-prefix-caching

Two caveats. Every number is the sole author's own, collected on one rented RTX 4090, and the quantization gradient is entirely a llama.cpp GGUF result: no FP8, INT8, AWQ or GPTQ data, and SGLang was dropped before any was collected. And llama.cpp's slot-erase endpoint returns success without clearing the live prompt cache, so a harness that trusts it silently measures a warm server.

Also notable #

OpenAI edited benchmark figures on the Astra launch page after publishing it, and Fortune caught it. The report published at 00:12 UTC on 5 September and was missed here at the time. Comparing Internet Archive snapshots, Fortune found an internal hallucination score for Astra move from 4.2% to 2% and back, an ExploitBench figure for GPT-5.6 Sol move from 5.5% to 11.5%, and competitors' FrontierMath scores move twice. OpenAI told Fortune that verifying evaluations between draft and final is normal. Checked against the live page: the hallucination figures are back at 4.2% and 12.2%, ExploitBench shows 5.5% with 11.5% preserved in a footnote explaining it as a 300-turn-limit artifact, and Fortune's claim that Claude Fable 5.1's FrontierMath Tier 4 score sits at 83% "today" is wrong — the page shows 87.8%, and 83.0% is the adjacent GPT-5.6 Sol cell. The page carries no "updated" line and still says 3 September.

The ARC-AGI-3 harness question from the 4 September issue has an answer. That issue asked which of the two figures would become the quoted one, ARC's neutral-harness 62.71% or the 99.95% obtained using OpenAI's own context management. OpenAI's launch page quotes 99.9%, under a footnote naming its responses-API harness — so the higher convention won, but it is labelled, which is more than the issue predicted.

Anthropic's compute commitments are reported at 14.8 GW. The Information put the figure at at least 14.8 gigawatts contracted since October, and spending of up to roughly $517 billion over a decade. The report is paywalled and the figures are secondhand; neither appears in any Anthropic post, and its newest is dated 1 September. For scale, deals Anthropic has itself announced include up to a million Google TPUs and over $100 billion with Amazon.

A commercial service for removing refusal behaviour from open-weight models. The Decoder reported at 08:55 UTC on 6 September on Abliteration.ai, whose product post is dated 29 August and whose benchmark claims — 84.5% pass@1 on CyberGym, $5 per million tokens — are the vendor's own. The technique has an academic trail, including a July paper finding abliteration has off-target effects on models' decision-making well outside the safety domain.

The window was checked, not merely quiet. Across vLLM, SGLang, llama.cpp, Ollama, transformers, TRL, PEFT, MLX, TensorRT-LLM, PyTorch, DSPy, LangChain, MCP, Codex and the Claude Code CLI, nothing stable shipped: llama.cpp cut nine nightly prereleases, PyTorch's feed carried CI tag refs, and the nearest real release, Claude Code v2.1.263, missed the window by 96 minutes. No trending Hugging Face repository took a first upload; its blog has nothing since 3 September; ARC Prize last posted 3 September and Arena 1 September; and CourtListener returns a well-formed zero for filings after 5 September on all five queries, against a working control.

What to watch #

• Whether anyone outside OpenAI can check Sunday's figures. Epoch AI's taxonomy is public and OpenAI applied it to its own token logs, so a comparable measurement at another lab is the obvious next step. Until then the 3.1 ratio has no denominator anyone else can see.
• Whether the substitution finding changes how a safety framework gets written. The 85% offset is the strongest published evidence yet that model-scoped mitigations do not bind on an organisation's total training capacity, and the company the framework applies to published it.
• OpenAI's misalignment reporting framework is now on a clock that has run two days. The 6 September issue flagged the "upcoming weeks" commitment made on the 5th; neither of Sunday's posts is it, though both cite the same incidents.
• The Fermat artifact still has no second examiner, flagged on the 5th and the 6th. The repository has three open issues, two of them jokes, and Kevin Buzzard remains the only mathematician to have reported checking it.
• Artificial Analysis has still stated no comparability position on Intelligence Index v4.2, a third issue running. Its changelog has no entry after 4 September, so scores either side of that date remain on different scales with nothing saying so.