Last week I argued that the most important place to monitor an AI agent is not the network layer but the reasoning layer — watching what the model is thinking about doing, before it does it. That argument rested on a quiet assumption: that a model’s reasoning is something you can actually read.
This week, that assumption got a lot less safe.
Reports surfaced that OpenAI’s newest model, Astra, uses an architecture called recurrent depth — a technique that lets the model do more of its thinking silently, inside the network, rather than writing it out as visible text. One important caveat up front: the architecture claims come from anonymously sourced reporting, and OpenAI has not confirmed the details in any official documentation. But the technique itself is real, well studied in the open research community, and almost certainly coming to more models whether or not this particular report is exactly right. So it’s worth understanding now.
Since then, Astra has shipped, and its system card doesn’t name an architecture — but it does confirm the part that matters: OpenAI reports the model is less monitorable through chain of thought and can complete harder tasks without verbalised reasoning. Whether or not the looped-layer report is right, the monitoring problem is real and documented.
First, the plain-language version
Think about a maths exam. There are two ways to get full marks: show your working, or just write the correct answer. Showing your working takes longer and uses more paper, but it lets the examiner see how you got there — and catch the moment you went wrong, or the moment you copied from your neighbour.
For the last couple of years, the best AI models have been “showing their working.” Before answering a hard question, they generate a long stream of intermediate text — a chain of thought — that walks through the problem step by step. That stream isn’t just for the user’s benefit. It’s the single most useful window we have into what a model is actually doing. Safety teams read it to spot when a model is about to cheat, take a shortcut, or go somewhere it shouldn’t. In the agent security incident I wrote about last week, those readable reasoning logs were reportedly a key part of how investigators pieced together what happened.
Recurrent depth is the “just write the answer” approach — with a twist. Instead of writing out its intermediate steps as text, the model runs the same internal layers over and over, refining a hidden internal state each time, and only then produces an output. The thinking still happens. It just happens where no one can read it.
Now the technical version
A standard transformer is a fixed stack of layers. Input goes in the bottom, passes through each layer once, and a token comes out the top. If you want more “thinking” per token, you have two classic options: make the stack deeper (more parameters, more memory) or generate more intermediate tokens (longer chain of thought, bigger context, growing cache).
A looped transformer, the idea behind recurrent depth, takes a third route. It keeps a core block of layers and passes the hidden state through that same block multiple times before emitting a token — the same weights, applied repeatedly to an evolving internal representation. That buys more sequential computation without adding parameters, and without adding tokens to the context window.
The idea isn’t new. Universal Transformers proposed adaptive layer reuse back in 2019, and the specific recurrent-depth formulation that the Astra reporting points to was laid out in a 2025 paper from Geiping and collaborators (the “Huginn” model), which showed a small model could match much larger ones on reasoning benchmarks by looping at test time. Open models like Nanbeige 4.2 have shipped with looped layer stacks since. So the surprising part isn’t that the technique exists; it’s that a frontier lab appears to be betting on it in production.
Two things worth being precise about, because the hype has blurred them:
- It is not necessarily faster or cheaper. Every extra loop is a real, sequential forward pass. What you save is parameter memory and context growth, not compute. Whether looping beats simply training a deeper model is still an open research question.
- It is not the same as “no chain of thought.” A model can loop internally and still write out reasoning text. The concern is about the balance: the more work moves into the loops, the less of it needs to be verbalised, and the less there is for a human to read.
Why this matters more than it sounds
Last year, researchers from OpenAI, Anthropic, Google DeepMind and others co-authored a paper with a telling title: chain-of-thought monitorability is a new and fragile opportunity for safety. Their point was that we’ve stumbled into a situation where the most capable systems happen to think in a language we can read, and that this is a historical accident we should protect, not assume.
Recurrent depth is exactly the kind of change that erodes it. Not maliciously, and not all at once — but structurally. The reported constraint on Astra is that its loop count is capped so that its effective serial depth stays within roughly twice that of earlier models, which would keep the shift modest for now. The worry from safety researchers is less about this specific model and more about the direction: once the architecture exists and pays off, the incentive is to loop more, verbalise less, and eventually reason almost entirely in a space that only specialised interpretability tools can inspect.
It’s worth being fair to the other side of the argument, too. Chain-of-thought text was never a perfectly faithful record of a model’s reasoning — models sometimes write one thing and do another. And scaling a model up in size also moves more computation into unreadable activations; nobody demanded a monitorability review when GPT-4 became bigger than GPT-3. Recurrent depth is a difference of degree, not kind. The question is whether it’s a degree that matters — and the honest answer is that we don’t yet know.
What this means if you build with these models
I think about this less as an AI-safety abstraction and more as an engineering-practice question, because it changes what you can and cannot rely on.
- Stop treating reasoning logs as your audit trail. If you’ve built monitoring, evaluation, or incident response around reading a model’s chain of thought, that dependency is now a risk. Reasoning text may become shorter, summarised, or absent entirely, and the version you see through an API may already be a cleaned-up summary rather than the raw stream.
- Move your ground truth to actions. Tool calls, API requests, file writes, credential use, messages sent to other agents — these are observable no matter how the model thinks. If last week’s post argued for reasoning-layer monitoring, this week’s argues that the action layer has to be strong enough to stand on its own when the reasoning layer goes dark.
- Evaluate behaviour, not explanations. A model’s account of why it did something is not evidence of what it did. Test outcomes against expected outcomes, on real tasks, repeatedly.
- Ask your vendors the monitorability question. How much of this model’s reasoning is visible? Is what I’m shown the raw chain of thought or a summary? Has that changed between versions? These are reasonable questions for any team deploying agents at scale, and the answers are going to start diverging between providers.
The road ahead
There’s a version of this story where recurrent depth is simply a good engineering idea — more capability per parameter, less context bloat — and the monitorability cost turns out to be manageable with better interpretability tooling. There’s another version where it’s the first step toward models whose reasoning we can only infer from the outside, the way we infer a person’s intentions from their behaviour rather than their thoughts.
Both versions are plausible. What’s not plausible is that the “showing its working” era lasts forever by default. It lasts if labs choose to protect it and if the people building on top of these models make that choice visible by asking for it.
So here’s the question I’d put to anyone deploying agents right now: if the model you’re using stopped writing out its reasoning tomorrow, would your monitoring still catch a problem — or would you find out the way the last incident was found, after the fact?
Sources: The Information, “OpenAI Technique in ‘Astra’ Model Sparks Security Concerns” (Sept 2026); Geiping et al., “Scaling up Test-Time Compute with Latent Reasoning: A Recurrent Depth Approach” (2025); Korbak et al., “Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety” (2025); Sebastian Raschka, “OpenAI Astra and Looped Transformers” (Sept 2026).