This report was coauthored by Jacob Davies, who conducted this work while participating in the ERA Fellowship, Cambridge, UK.
Chain-of-thought (CoT) reasoning provides a window into the decision-making of frontier AI systems. Monitoring this decision-making is one of the most effective oversight tools for current systems, and one with the potential to scale to more advanced future systems.¹ However, there are threats to this window: it may become obscured as CoT becomes unfaithful,² encoded,³ or illegible,⁴ and frontier models can increasingly reason without CoT—or at least rely on it less—without degrading capability. The window may narrow if frontier models increasingly rely on less transparent reasoning mechanisms or disappear entirely if they stop using CoT altogether.⁵
The OpenAI/Hugging Face incident, arguably the most significant publicly acknowledged case of unsanctioned AI agent activity to date, illustrates the stakes of losing the insights CoT monitoring provides. OpenAI has said its CoT monitoring system would likely have caught the agent activity had it been running at the time, but that is only an effective safeguard as long as a model’s CoT remains monitorable.⁶ Future incidents of similar or greater impact could go un-detected if models gain the ability to evade CoT monitoring. Moreover, the challenges of monitoring can be exacerbated by training practices that penalize specific content in the CoT, creating optimization pressure for models to hide their bad intentions rather than change the underlying behavior.⁷
Recent evidence suggests that the ability to understand and evaluate models’ reasoning based on CoT is weakening in frontier AI systems. For example, in September 2026, OpenAI released a new model, GPT-6 Astra, that showed “a substantial decrease in chain-of-thought monitorability compared to previous models,” and the set of tasks it can complete without any CoT “is greatly expanded”.⁸ Anthropic has raised similar concerns, particularly regarding its most powerful Mythos-class models.⁹ Google DeepMind has said the monitorability of their newest frontier AI model, Gemini 4 Argon, is “more challenging compared to past models,” though the CoT remains “legible, informative, and free of spontaneous obfuscation.”¹⁰ Media reporting also suggested that OpenAI’s GPT-6 Astra leveraged a “looped transformer” architecture¹¹ that, while retaining CoT, lets the model do more reasoning without needing to use it,¹² though OpenAI has not categorically confirmed this.
This report argues that frontier AI developers should regularly disclose a small set of specific indicators so the trajectory of CoT monitorability can be tracked by independent evaluators and developers have stronger incentives to preserve it. We propose that CoT monitoring depends on a chain of five conditions and, for each, identify one indicator that is both highly relevant and reasonably feasible to disclose. The five indicators are:
Third-party CoT Access and Base Architecture Specifications. Allowing access to a model’s raw CoT to qualified third parties provides an initial warning sign about whether models continue to use CoT, and underpins external verification of the other indicators in our framework. To provide assurances that the CoT is necessary for complex reasoning capabilities, access should be complemented with relevant details of the model’s base architecture specifications that can be independently validated.
Naturalness. To use CoT to monitor for harmful actions, monitors must be able to extract semantic meaning from it. A legibility score, rated on a standard rubric of how easily a human can follow the reasoning, can indicate whether and how far a model’s reasoning is drifting from human-readable language.
Faithfulness. Access to a human-readable CoT is only helpful if its contents match the computation the model actually performed. Scores on a faithfulness suite covering a variety of failure modes can show whether a model’s CoT reflects its actual reasoning.
Detection. CoT supports model oversight when a monitoring system detects dangerous behavior expressed through it. The proportion of harmful behaviors that evade the monitoring system indicates the extent to which a model might be able to take unsanctioned actions before it is stopped.
Uplift. Efforts to secure and expand CoT monitorability are justified only if access to the CoT actually improves a monitor’s performance compared with having access to the model’s actions alone. Understanding the performance gap between monitors with these two different levels of access quantifies the value CoT access provides for safety monitoring.
We selected these from a list of 21 candidate indicators identified in recent CoT monitorability research literature, developer disclosures, and other sources. We then scored these for informativeness, technology readiness, external verifiability, developer tractability, and implementation feasibility. We do not prescribe specific evaluations for each indicator to preserve space for state-of-the-art approaches to be used and to reduce the scope for gaming.
We audited current disclosure practices among the three leading frontier AI developers—OpenAI, Anthropic, and Google DeepMind—and found that no developer reports the full set of indicators. That said, at least one developer has reported each individual indicator, showing that cross-sector reporting of the full set is feasible.¹³ Recent disclosures by OpenAI, Anthropic, and Google DeepMind that highlight evidence of increased challenges around the monitorability in their frontier models show that voluntary disclosures on these issues can happen.¹⁴ However, these disclosures are currently voluntary and based primarily on private evaluations and configurations, making it difficult for third parties to replicate the findings. In addition, a lack of standardized methods and evaluations for CoT monitorability makes independent cross-developer comparisons challenging. We recommend repeating this audit with deeper access than public disclosures allow, either by embedded evaluators working within developers or by an Independent Verification Organization.
We argue that frontier AI developers should disclose specific monitorability indicators as part of their existing system card and safety evaluation practices. Disclosure would make the trajectory of decreasing monitorability trackable before failures occur, and create reputational and coordination-related incentives to preserve monitorability.¹⁵ Disclosing the CoT monitorability indicators we set out in this report can help policymakers and researchers track this tool’s effectiveness in overseeing frontier AI systems, inform technical and policy responses when evidence shows it is weakening, and create reputational and coordination-related incentives to preserve it.¹⁶
Editorial note: This report was first circulated as a preprint paper in July 2026 that was accepted to the technical AI governance workshop at the International Conference on Machine Learning (ICML) 2026. This updated version reflects developments in the field of chain-of-thought monitorability through mid-October 2026 and primarily adds evidence supporting the report’s arguments rather than changing them.
Endnotes
OpenAI, “Detecting misbehavior in frontier reasoning models”; Korbak et al., “Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety.”
Barez et al., “Chain-of-Thought Is Not Explainability.”
Baker et al., “Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation”; Skaf et al., “Large language models can learn and generalize steganographic chain-of-thought under process supervision.”
Schoen et al., “Stress Testing Deliberative Alignment for Anti-Scheming Training.”
See for example: Hao et al., “Training Large Language Models to Reason in a Continuous Latent Space”; Lu et al., “Latent Chain-of-Thought? Decoding the Depth-Recurrent Transformer”; Geiping et al., “Scaling up Test-Time Compute with Latent Reasoning: A Recurrent Depth Approach”; Wang et, al., “Full-bandwidth transformer.”
OpenAI, “The Hugging Face incident and the road ahead”; METR, “Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident.”
Baker et al., “Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation”; Korbak et al., “Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety.”
OpenAI, “GPT-6 Astra System Card.”
Anthropic, “System Card: Claude Fable 5 & Claude Mythos 5”; Anthropic, “System Card: Claude Fable 5.1 & Claude Mythos 5.1.”
Google DeepMind, “Gemini 4 Argon Safety & Security Report.”
Kahn, J. “Safety experts warn novel design of OpenAI’s Astra model could make future AI agents harder to monitor.”
Geiping et al., “Scaling up Test-Time Compute with Latent Reasoning: A Recurrent Depth Approach.”
See for example: OpenAI, “GPT-5.6 System Card”; OpenAI, “GPT-6 Astra System Card”; Anthropic, “System Card: Claude Fable 5.1 & Claude Mythos 5.1;”; Anthropic, “System Card: Claude Sonnet 5.5”; Google DeepMind, “Gemini 3 Pro Frontier Safety Framework Report”; Google DeepMind, “Gemini 4 Argon Safety & Security Report.”
OpenAI, “GPT-6 Astra System Card”; Anthropic, “System Card: Claude Fable 5 & Claude Mythos 5”; Anthropic, “System Card: Claude Fable 5.1 & Claude Mythos 5.1”; Google DeepMind, “Gemini 4 Argon Safety & Security Report.”
Korbak et al., “Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety”; Delaney et al., “Policy Options for Preserving Chain of Thought Monitorability.”
Korbak et al., “Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety”; Delaney et al., “Policy Options for Preserving Chain of Thought Monitorability.”