Speaker A
On the afternoon of September 1st, 2026, OpenAI published a post about its next model, Astra.
Explores loop transformers in AI models like OpenAI's Astra, revealing new reasoning methods and cybersecurity concerns.
Key Takeaways
- Loop transformers allow AI models to perform longer, more complex reasoning chains without increasing size.
- Internal reasoning in looped models happens in vectors ('neuralese'), making it harder to monitor.
- OpenAI's Astra is a pioneering model using this approach but maintains some readable chain of thought for safety.
- Looped models can be more efficient and competitive with larger traditional models.
- This new architecture poses cybersecurity and transparency challenges in AI development.
What the video covers
- OpenAI's Astra model, released in 2026, was rated critical for cybersecurity risk due to its complex reasoning process.
- Astra uses a loop transformer architecture, processing the same text multiple times without writing intermediate tokens.
- Loop transformers enable deeper reasoning chains within a fixed number of layers by recurrently reusing computations.
- Traditional models write out chains of thought as tokens, limiting the amount of information passed between steps.
- Loop transformers carry internal vectors through multiple passes, creating 'neuralese' reasoning not readable as text.
- Examples like Oro and Hoogan demonstrate loop transformers improving efficiency and reasoning depth without increasing model size.
- Looped models can match or outperform larger ordinary models by reusing layers multiple times per token.
- This architecture raises monitoring challenges since intermediate reasoning is hidden in internal vectors.
- OpenAI limits Astra to still produce readable chains of thought to maintain some transparency.
- Loop transformers represent a shift in AI model design, balancing reasoning power, size, and interpretability.
Chapters
- 00:00OpenAI Astra and cybersecurity concerns
- 01:03Neuralese and internal model reasoning
- 02:20Arithmetic chain length experiments
- 03:10Tokenization and vector processing in transformers
- 03:57Layer depth limits reasoning steps
- 05:37Challenges of increasing model depth
- 06:35Loop transformers and recurrent processing
- 08:24Examples of looped models: Oro and Hoogan
- 09:23Loop transformers’ efficiency and training
- 11:10Implications for AI safety and monitoring
Full Transcript — Download SRT & Markdown
Speaker A
It was the first model the company had rated critical for cybersecurity risk, the highest level on its scale.
Speaker A
One of the safeguards the post described was extra monitoring of Astra's chain of thought, the reasoning a model writes out step by step before it gives an answer.
Speaker A
About 4 hours later, the news site The Information reported that Astra uses recurrent depth, or a loop transformer, where the model processes the same text several times over.
Speaker A
The report cited one unnamed person with knowledge of the model's development. 45 minutes after it went up, Steven Adler, a former safety researcher at OpenAI, weighed in.
Speaker A
"If the report was true," he wrote, "the company seemed to be violating one of the few red lines that exist in the AI industry."
Speaker A
People started using the word neuralese for reasoning that happens in a model's internal numbers instead of in text we can read.
Speaker A
At 10:37 that night, OpenAI's chief scientist, Jakub Pachocki, responded.
Speaker A
He called the reporting confused and said he wanted to prevent a race toward models whose reasoning can't be monitored.
Speaker A
And he wrote that, "In the depth of their computation, OpenAI's current frontier models, Astra included, were within a factor of two of GPT-4."
Speaker A
He didn't say how Astra is built. Two days later, the model launched and OpenAI's own safety report said its chain of thought had become substantially harder to monitor than that of earlier models.
Speaker A
A week after that, a researcher outside OpenAI gave models chains of arithmetic, where every step needs the result of the step before.
Speaker A
For each model, the researcher found the longest chain it could get right half the time without writing anything down.
Speaker A
The best of the other models managed about four steps. Astra managed about seven.
Speaker A
So, how does a model take seven steps without writing anything down when the others manage four?
Speaker A
And why would the way it does that worry the people whose job is to watch what these models are doing?
Speaker A
Here's an unfinished sentence that Anthropic gave its model Claude 3.5 Haiku. Fact, the capital of the state containing Dallas is—
Speaker A
The model continues it with Austin.
Speaker A
To get there, the model first splits the text into tokens, short chunks like a word or a piece of a word.
Speaker A
Each token becomes a vector, a list of a few thousand numbers, and that vector flows through a stack of layers.
Speaker A
In each layer, it first reads from the vectors of the earlier tokens, which is what attention does.
Speaker A
Then it goes through a small feed-forward network on its own. Every layer has its own weights.
Speaker A
And a layer doesn't replace the vector, it adds its result on top.
Speaker A
So, the vector becomes a running sum of everything the layers have contributed, which is why it's usually called the residual stream.
Speaker A
After the last layer, one more matrix turns the vector into a score for every token in the vocabulary, a logit.
Speaker A
The highest scores become the most likely next tokens.
Speaker A
But the prompt never mentions Texas.
Speaker A
To say Austin, the model has to work out that Dallas is in Texas, and only then that the capital of Texas is Austin.
Speaker A
When researchers at Anthropic traced this prompt through the model, they found both of those steps, with Texas worked out before Austin.
Speaker A
Partway through the stack, the model's internal state comes to represent Texas, and the layers after that use it to push up the logit for Austin.
Speaker A
And when the researchers reached in and swapped that internal Texas for California, the model answered Sacramento.
Speaker A
Texas has to come first because a layer can only read what earlier layers have already added to the stream.
Speaker A
So, the layers that use Texas have to come after the layers that work it out.
Speaker A
That means the number of layers a token passes through, the model's depth, limits how many steps like these it can chain before it has to commit to a token.
Speaker A
This is most likely the depth Bahdanau and Cho meant, and it's what the arithmetic test was counting, steps like Dallas to Texas chained one after another inside a single pass through the layers.
Speaker A
Two steps fit easily inside one pass, but plenty of problems need a longer chain of steps than one pass through the layers can hold.
Speaker A
We could simply give the model more layers. Every new layer brings its own weights though, and a model with more weights needs more memory to run and more text to learn from.
Speaker A
DeepMind's Chinchilla study found that training text should grow in proportion to the number of weights.
Speaker A
Or we can keep the model the same size and let it write out its reasoning. A chain of thought.
Speaker A
The model generates its intermediate steps as ordinary tokens and reads them back as input.
Speaker A
Every token it writes is another full pass through the layers, so it can take as many steps as it needs.
Speaker A
But very little gets from one pass to the next. The vector coming out of the last layer is turned into logits. One token is sampled, and that one token is all the next position receives.
Speaker A
Later tokens can still attend to earlier ones, but only at the same layer. A new token's fourth layer sees the earlier tokens as they were at their own fourth layer.
Speaker A
Nothing ever reads the finished vector at the very end.
Speaker A
The model's vocabulary has about 49,000 tokens, and 16 yes or no questions are enough to pick out any one of them.
Speaker A
Each yes or no answer is one bit, so each written step hands the next one a single token, at most about 16 bits of information, and anyone can read that token.
Speaker A
A loop transformer doesn't write a token between its steps.
Speaker A
When the vector reaches the end of the stack, it isn't turned into logits at all.
Speaker A
It goes straight back into the first layer and runs through the same layers again.
Speaker A
Nothing is sampled and no weights are added.
Speaker A
The whole vector carries over 2,048 numbers in a small model, each stored in 16 bits, and nobody reads any of them.
Speaker A
Google built a transformer like this in 2018, the universal transformer.
Speaker A
For years, the idea stayed mostly in small experiments.
Speaker A
But since 2025, several groups have trained looped language models with billions of weights, and some have released them for anyone to run.
Speaker A
Let's look closely at one of them. Oro came out in 2025 from researchers at ByteDance and several universities.
Speaker A
Its smaller version has 24 layers, and every token goes through them four times.
Speaker A
That's 96 layer steps from only 24 layers worth of weights.
Speaker A
An ordinary model with 96 separate layers would need more than 3 and 1/2 times as many weights.
Speaker A
It's less than four times because only the layers would be copied, and the parts that turn tokens into vectors and vectors back into scores stay the same size.
Speaker A
On disk, Oro is just its 24 layers, but when it runs, each token goes through a computation four times as deep.
Speaker A
Each set of weights shows up once on every pass, and the only thing that changes from one appearance to the next is the vector passing through.
Speaker A
Hoogan came out the same year from researchers in Germany and the United States.
Speaker A
Instead of looping the whole stack, it keeps two ordinary layers at each end and loops only the four layers in between about 32 times for each token.
Speaker A
On every pass, it feeds the loop the output of those entrance layers again, which keeps a long loop from drifting away from the text it started from.
Speaker A
Google's universal transformer told its layers which pass they were on. Hoogan doesn't because its authors found that a model given the step number couldn't then run for longer than it was trained to.
Speaker A
Meta's Coconut from 2024 closes the loop a different way, through the text instead of the layers.
Speaker A
It hands its final vector to the next position as if it were that position's input.
Speaker A
We can also stop a looped model after any pass and read out an answer.
Speaker A
We just turn its vector into logits the same way an ordinary model does after its last layer.
Speaker A
Oro's authors did this on MMLU, an exam of about 14,000 multiple-choice questions. Stopped after one pass, Oro gets 41% right, wher
Speaker A
A model can even be built to store almost no facts and run almost entirely on steps.
Speaker A
The tiny recursive model from a researcher at Samsung has just two layers and 7 million weights.
Speaker A
It solves puzzles by running those two layers over notes it keeps as numbers again and again several hundred times for a single puzzle.
Speaker A
It only works on puzzles and can't write text, but its author reports that it solves 45% of the first ARC benchmark of visual puzzles.
Speaker A
If loops are this good at steps, it's strange that, as far as anyone knows, every looped language model a company has released stops after two to four passes.
Speaker A
Part of the reason is that a loop is hard to train. To train one, we unroll it. So, four passes become a network four times as deep whose weights happen to be shared.
Speaker A
Then we send the error at the output backward through all of it and every pass has to be held in memory until that backward sweep reaches it.
Speaker A
And because the same weights act on the vector again and again, whatever one pass does to the vector, the next pass does again.
Speaker A
Huggins builders found out what that means on their first large training run. With every pass, the vectors of all the tokens in a sentence became a little more alike until they were all the same vector.
Speaker A
They changed how the layers were normalized, and on the second run, the model recovered.
Speaker A
But when they ran it with one pass and then with 32, it [music] scored the same either way.
Speaker A
It had learned to ignore the vector coming background, so its loop did nothing at all.
Speaker A
Only the third run trained properly. Oro's authors had trouble, too. They started with eight passes, saw the training error spike, and cut back to four after the first 3 trillion tokens.
Speaker A
Huggins builders also kept training from needing more memory as the loop got longer. The number of passes changes at random from one batch to the next, [music] around 32 on average.
Speaker A
The error is only sent back through the last eight, so only those eight passes have to be held in memory.
Speaker A
Because it never learned to expect any particular number of passes, it can be run for fewer or more afterwards.
Speaker A
On a test of common sense questions, it's close to guessing after one pass, improves until about 32, and then holds steady.
Speaker A
After those first 3 trillion tokens, Oro was trained only with four passes, and running it for longer makes it worse.
Speaker A
A version of its larger model that also writes out its reasoning solved 65% of the 30 problems from the 2024 American Invitational Mathematics Examination at four passes.
Speaker A
At eight passes, it solves only 39%. Not every token needs all of those passes though.
Speaker A
Networks that choose how many steps to take for each input are an older idea than any of these models, and Oro makes [music] that choice with a tiny extra layer, an exit gate.
Speaker A
After every pass, the gate reads the vector and turns it into a number between zero and one, the chance of stopping now if the token hasn't stopped already.
Speaker A
Say that for one token it gives 0.2 after the first pass, then 0.5, then 0.5.
Speaker A
So, there's a 0.2 chance it stops after the first pass and 0.8 that it keeps going.
Speaker A
Half of that 0.8 stops after the second pass, which is 0.4. Half of the remaining 0.4 stops after the third, another 0.2, and the last 0.2 goes on to the fourth pass.
Speaker A
So, the four chances add up to one. The model keeps a running total and stops at the first pass where it reaches a threshold set in advance.
Speaker A
With a threshold of 1/2, the total is 0.2 after the first pass and 0.6 after the second, so this token stops there.
Speaker A
Oro makes a prediction after every pass and is trained on all four, each weighted by the gate's chance of stopping there.
Speaker A
Oro's authors argue that a gate trained only this way ends up never stopping early.
Speaker A
A later pass usually predicts a little better, so training nudges the gate toward the last pass.
Speaker A
The layers then get trained mostly to make that last pass good, so it gets better still, and in the end, every token takes every pass.
Speaker A
To prevent that, they added a second goal to the training, one that rewards keeping the gate's four chances spread out.
Speaker A
After a second stage of training that tuned only the gate, Oro matched its four pass exam score using fewer than three passes on average.
Speaker A
Hoogen doesn't need a gate at all. It stops when its prediction after one pass is nearly the same as after the pass before.
Speaker A
So far, though, very little of this saves time in practice. Serving software processes many tokens together [music] and assumes they all take the same path.
Speaker A
The code released with Oro runs all four passes for every token and uses the gate only to choose which passes answer to read. And the looped models that companies are known to have released since then run a fixed two passes for
Speaker A
every token. When every token takes every pass, four passes are four times as many layer steps, and they run one after another, just [music] as in an ordinary model 96 layers deep.
Speaker A
A loop also needs more memory than its weight suggest. When a later token attends to an earlier one, it reads two vectors that the earlier token left behind at every layer.
Speaker A
[music] The key is what the later token checks to decide how much to take from that earlier token, and the value is what it actually takes.
Speaker A
Both are computed once and kept in the KV cache. A key is just a layer's weights applied to the vector entering that layer.
Speaker A
In a loop, the same weights meet a different vector on every pass, so every pass leaves its own keys and values behind, and sharing the weights doesn't make the cache any smaller.
Speaker A
That's also another reason an early exit is hard to use. A token that stopped after two passes has no keys or values for passes three and four, and later tokens may still need to read them.
Speaker A
We can work out how big this gets for Oro's smaller model. Each token leaves a key and a value of 2,048 numbers at every one of 24 layers, and on each of four passes, and each number takes two bytes.
Speaker A
That comes to about 3/4 of a megabyte for every token. 16,000 tokens of text need about 12 gigabytes of cache, four times the size of the model itself.
Speaker A
All that extra running lets a small model keep up with much bigger ones. Oro's larger model splits 12 standard benchmarks evenly with Alibaba's Qwen-3, an ordinary model three times its size that was trained on nearly five times as
Speaker A
much text. Its widest leads are in mathematics and reasoning [music] though those are its authors' own measurements, run on their own test setup.
Speaker A
But it doesn't do less computation than the bigger model. Each token takes about one multiplication for every weight it passes through.
Speaker A
Oro has about a third of Qwen 3's weights, but every token runs through them four times, so it does about a third more multiplications per token than Qwen 3.
Speaker A
Hugging has 3.5 billion weights. Run for 32 passes, it does as much computation per token as an ordinary model of about 50 billion, and its answers come out roughly level with an ordinary model of 7 billion.
Speaker A
Three researchers in Germany measured what a repeated pass is worth by training 116 small models.
Speaker A
Every one of them took the same number of layer steps per token. Some with every layer separate, and others reusing a smaller block.
Speaker A
They found that running a block some number of times does the work of that number of separate copies raised to a single power.
Speaker A
If a repeated block were worth as much as a new one, the power would be one, and if repeating added nothing, it would be zero.
Speaker A
It came out at 0.46. 4 to the power of 0.46 is about two, so a block run four times does about the work of two separate copies.
Speaker A
Oro's own small experiments agree, with ordinary models of the same total depth coming out ahead every time.
Speaker A
So, for the same computation, an ordinary model still gets more done than a loop.
Speaker A
But one group gave a looped model of 20 billion weights and an ordinary one of 30 billion the same time for each training step. [music] And after about 600 billion training tokens, the looped model pulled ahead.
Speaker A
However much computation it takes, a loop also changes what passes from one step to the next.
Speaker A
When a model needs more steps than one pass can hold, it has to write [music] them out.
Speaker A
Each written step hands the next one a single token at most about 16 bits that anyone can read.
Speaker A
A loop hands on 2,000 numbers that nobody reads. That gives the model a far wider channel between its steps, [music] and it means that anyone trying to watch what the model is doing has numbers to read instead of words.
Speaker A
Labs already watch written reasoning. A second model, acting as a monitor, reads the first model's chain of thought and flags anything that looks like trouble.
Speaker A
In March 2025, OpenAI described a reasoning model that was given coding tasks checked by tests.
Speaker A
In its chain of thought, the model wrote that it would get around the tests instead of solving the problems, and a monitor reading that chain of thought caught it.
Speaker A
That July, 41 researchers from OpenAI, Google DeepMind, Anthropic, [music] and other organizations, Jakub Pachocki among them, called this kind of monitoring a new and fragile opportunity for AI safety.
Speaker A
Their paper warned it could be lost to architectures that reason in numbers instead of words, and it cited Coconut and HuggingFace.
Speaker A
That December, OpenAI called on researchers across the industry to preserve chain of thought monitoring for as long as possible.
Speaker A
Steven Adler didn't say which red line he meant, and no company had signed a commitment to avoid such architectures.
Speaker A
Most likely, he meant the shared understanding that a frontier model's reasoning should stay in text.
Speaker A
We can still turn a loop's vector into logits after any pass and see which answer the model favors at each step.
Speaker A
Ouro's authors did this on a thousand pairs of questions, asking each time whether the two mean the same thing, [music] and between the third pass and the fourth, the answer changed on more than one pair in every five.
Speaker A
But knowing which answer a model favors doesn't tell us how it got there. HuggingFace was given arithmetic problems, and when researchers looked inside its passes for the intermediate results, they found only limited evidence of steps they could read out.
Speaker A
And a 2026 study of Ouro turned its vector into a token at every layer.
Speaker A
At the end of each pass, where the model is trained to make a prediction, that token usually matched the one the model went on to write. And partway through a pass, it almost never did.
Speaker A
Only a separate reader, trained for the purpose, could make sense of the vector in between.
Speaker A
The first systematic test of monitoring on looped models came a month after the report.
Speaker A
Oro was given a hint in its prompt and told to hide that it used it.
Speaker A
[music] And a monitor read its written reasoning to see whether the hint showed. On some tasks, running Oro for eight passes instead of four made that harder for the monitor to catch. And a different looped model, one that runs
Speaker A
its layers twice, was no harder to monitor than ordinary models matched to it by size, layers, or depth.
Speaker A
So, what do we actually know about Astra? When it launched on September 3rd, 2026, OpenAI's own safety report said its chain of thought is substantially harder to monitor than earlier models.
Speaker A
The same report measures how well a model can control what shows up in its own reasoning when it's told to, which matters because a model that can steer its reasoning could keep things out of a monitor's sight.
Speaker A
The previous model managed it 16% of the time. Astra managed it 61% of the time, nearly four times as often.
Speaker A
The report doesn't describe how Astra is built, and it says OpenAI is quite confident that this rise in control isn't disproportionately due to architecture.
Speaker A
At first, the claim that Astra loops rested on that one news report and its unnamed source.
Speaker A
In October, a Microsoft page about another OpenAI model, GPT-6.1 Soul, briefly said that it runs two inference passes instead of three, until Microsoft took the line down.
Speaker A
A week later, The Information reported again that the loop is central to the way Astra works.
Speaker A
It said OpenAI had limited its use so that Astra still writes a readable chain of thought.
Speaker A
OpenAI still hasn't confirmed or denied any of it. Pahotsky's own words that night don't settle it either.
Speaker A
If depth means the number of layer steps between a token going in and a prediction coming out, then a loop multiplies that number.
Speaker A
And a depth within a factor of two of GPT-4's leaves room for a loop without requiring one.
Speaker A
He gave no count of layers or passes, and he added that monitoring is getting harder for reasons that don't depend on architecture.
Speaker A
Two passes through a stack as deep as GPT-4's would already make that factor of two.
Speaker A
For scale, the looped language models that companies have released run their layers two to four times.
Speaker A
Hugen runs its loop about 32 times. The arithmetic test points toward more depth, but not necessarily toward a loop.
Speaker A
A chain of arithmetic is a chain of dependent steps, just like the columns of a binary sum.
Speaker A
Seven of them without writing a token, where the next best model manages four, is the kind of gain more depth would give.
Speaker A
A loop is one way to get that depth, and more layers would be another.
Speaker A
The benchmark's author thinks a loop is the likely explanation and says it's unproven. Daniel Kokotajlo, who like Stephen Adler used to work at Open AI, wasn't reassured.
Speaker A
He replied to Pahotsky that even if Open AI goes no further, others might. He called for an industry-wide standard for how monitorable a model has to remain.
Speaker A
So, a loop gives a model more steps with the knowledge it already has without adding weights, and its training decides how far it can run.
Speaker A
But each of [music] those steps hands on a vector instead of a word. And nobody has yet worked out how many of a model steps can safely happen where no one can read them.
Speaker A
Thanks for watching.
Topics:loop transformerOpenAI AstraneuraleseAI reasoningchain of thoughtcybersecurity risklanguage modelsAI transparencymodel architecturerecurrent depth
