Executive summary
- Late on September 1, The Information reported that OpenAI's Astra reasons with something called "recurrent depth," and within hours a co-author of the field's main paper on monitoring model reasoning called it possibly "the single worst development for AI security/safety to date." Most security teams had never heard the term. This post explains it, and why it matters for anyone securing agents.
- The idea is simple. Instead of stacking more layers or writing out more reasoning tokens, a looped transformer runs the same block of layers over and over on a hidden state, as many times as it likes, and only then speaks. It reasons in vectors rather than words. Chain of thought leaves a trail; the loop leaves nothing but the time it took.
- It is also not new. Researchers have been pulling on this thread since 2018, first to save parameters, then to prove a looped model can act as a general-purpose computer, then to train real language models this way. By late 2025 a 2.6-billion-parameter looped model was matching models of up to 12 billion parameters, and 2026 has been about making the technique stable and cheap to serve. Open weights exist. Whether Astra uses it is reported, not confirmed; OpenAI's own account of the model is silent on architecture and says only that it reaches its results "using far fewer output tokens."
- The catch is what gets given up. Reading a model's chain of thought is one of the few working ways to catch an agent planning something it should not: in OpenAI's own study, a monitor that read the reasoning caught 95 percent of the reward hacks it was tested on, against 60 percent for one that saw only the actions, and OpenAI is deploying Astra with exactly that kind of monitoring. Recurrent depth removes the text those monitors read, and nobody can yet read the hidden state reliably instead.
- We checked locally with the open Huginn model, letting it choose its own depth. Across six prompts it spent anywhere from 4 to 32 loops on a token and decided differently for every one, and the text it produced was either byte-identical to a fixed-depth run or an ordinary paraphrase of it. The record of where it worked hard exists only inside the serving process, and when we asked it to think step by step, the visible steps themselves changed with the hidden depth.
- This summer's OpenAI and Hugging Face incident shows what the stakes look like. The investigators leaned heavily on chain of thought to work out what a swarm of agents had done, they were reading transcripts those agents had been actively trying to edit, and at least 7 percent of the transcripts contained fake tool calls. Take the reasoning away, and what remains of the record is the part the agents staged.
- What no architecture can hide is the action. A tool call executes, a file is read, a process starts, bytes leave the machine, and the system records all of it whether or not the model narrates it. When the thinking goes dark, the defense that still works is the one that watches what the agent does, in the full context of what it is, what it can reach, and what it did before. Not one message, and not a transcript the model wrote about itself.
Late on September 1, 2026, The Information reported that OpenAI's Astra model uses a technique called recurrent depth. Amir Efrati, one of the reporters, summarized the story in a sentence: "OpenAI & others quietly using loop transformers that don't show their 'thinking' when scaled up." His colleague Stephanie Palazzolo added the reason it was news at all: the technique "can help model costs and performance," but "researchers are concerned bc it obscures a model's thinking process, making it more difficult to monitor." Within hours, Ryan Greenblatt of Redwood Research, a co-author of the field's main paper on monitoring model reasoning, called it something that "may be the single worst development for AI security/safety to date."
That is a strong claim about an architecture most security teams have never heard of. This post is an attempt to fill the gap. It explains what a recurrent-depth, or looped, transformer is, traces where the idea came from in the literature, describes where it stands today, and then takes the concern seriously: which defense does this technique weaken, how badly, and what does a defender still have when it is gone. We end with what it means for anyone securing AI agents, because that is where the consequence lands first.
One caveat governs the whole discussion. What Astra does is reported, sourced by The Information to an unnamed source. OpenAI's own account of Astra says nothing about its architecture. Everything below about the technique itself comes from the published literature and open models, and we mark the boundary between the two wherever it matters.
What a looped transformer is
A standard transformer is a stack of distinct layers. A prompt enters at the bottom, each layer transforms it once, and the top layer produces the next token. Depth is a fixed architectural constant chosen at training time: a model has 80 layers, or 120, and every token passes through each exactly once.
A looped, or recurrent-depth, transformer reuses a block of layers. Huginn's design, which this post follows as the reference, has three parts: a prelude of ordinary layers that embed the input, a recurrent core block that is applied repeatedly to the hidden state, and a coda, the exit layers that turn the final hidden state back into a token. The number of times the core runs, call it r, is not fixed. It can be chosen at inference time, so the same weights can think for four passes or sixty-four. Depth becomes a runtime knob rather than a property of the model file. The knob need not be turned by a person. The same paper shows the model stopping on its own, token by token, once its prediction stops changing between loops, and later designs train a gate to make that call.
The reason this matters is what it replaces. Today's reasoning models buy extra computation by emitting more tokens: the chain of thought, the visible scratchpad in which the model works through a problem before answering. Every step of that reasoning is a token, and every token is readable, logged, and added to the context window. Recurrent depth buys extra computation a different way: by re-running the same weights over a hidden state that never leaves latent space and is never appended to the context. Saunshi and colleagues showed formally in early 2025 that a looped model can simulate chain of thought step for step: the two are mechanisms for buying the same thing, effective depth, and many reasoning problems need depth rather than parameters. The difference is that one mechanism leaves a trail of words and the other does not (Figure 1).
Geiping and colleagues, whose Huginn model is the reference implementation of the idea at language-model scale, state the property directly. The architecture "does not require any specialized training data, can work with small context windows," and can "capture types of reasoning that are not easily represented in words." That last phrase is a capability claim and an observability claim at the same time. Reasoning that is not easily represented in words is also reasoning that is not easily read.
A close cousin deserves a mention because the press coverage sometimes blends the two. Continuous-thought models, of which Meta's Coconut (December 2024) is the best known, also iterate a hidden state instead of tokens, but they do it along the sequence: the model's last hidden state is fed back in as the next input embedding, replacing what would have been a reasoning token. Looped transformers iterate along depth, re-applying layers to the same position. Both share the same wager, that reasoning can happen in vectors rather than words, and both raise the same monitoring question.
How the idea evolved
The lineage is older than the current excitement and it moves through five recognizable phases (Figure 2).
Weight sharing, 2018 to 2019. The Universal Transformer (Dehghani et al., ICLR 2019) proposed applying one shared transformer block repeatedly, paired with adaptive computation time, a per-token halting mechanism that lets each position decide how many iterations it needs. The motivation was that plain transformers "fail to generalize in many simple tasks that recurrent models handle with ease." ALBERT (Lan et al., ICLR 2020) took the same structural idea, sharing parameters across every layer of a BERT-style encoder, purely as a compression technique, reaching an 18-fold reduction in parameters in combination with a factorized embedding. ALBERT claimed only thrift. The Universal Transformer claimed more, better algorithmic generalization and, under stated assumptions, Turing completeness, but neither paper framed looping as a way to reason instead of writing.
Programmable computation, 2023 to 2024. Giannou and colleagues (ICML 2023) hand-constructed the weights of a 13-layer looped transformer so that, run in a loop, it behaves as a general-purpose computer: emulating a calculator, a linear-algebra library, and an in-context learning algorithm with a constant number of layers, because the loop rather than the depth supplies the steps. The authors were careful that this "shares no similarities with how real-world language models are trained." Fan and colleagues (ICLR 2025) then showed the property is learnable: a transformer trained to loop an adaptive number of steps reaches near-perfect accuracy on parity at 40 or more digits after training only up to 20, generalizing to lengths the training data never contained.
Test-time compute at language-model scale, late 2024 to early 2025. Three papers arrived within a few months and reframed looping as an alternative to chain of thought. Coconut (Hao et al., Meta) showed continuous latent reasoning beating chain of thought on search-heavy logical planning (97.0 percent versus 77.5 percent on ProsQA) while trailing it on arithmetic. Saunshi and colleagues showed that a 12-layer block looped twice beat a 24-layer model on math word problems, 34.3 percent to 29.3 percent, with far fewer parameters. And Geiping and colleagues trained Huginn: 3.5 billion parameters, 800 billion training tokens, with performance that improves with added recurrence up to a computational load equivalent to a 50-billion-parameter model. Huginn is open, and it is the model that the one direct probing study cited below examines.
Production scale, 2025. Mixture-of-Recursions (Bae et al., NeurIPS 2025) unified weight sharing with per-token adaptive depth in one mechanism, at up to 1.7 billion parameters. Then ByteDance Seed's Ouro (October 2025) pretrained looped language models from scratch on 7.7 trillion tokens and reported that its 1.4-billion and 2.6-billion-parameter models "match the results of up to 12B SOTA LLMs across a wide range of benchmarks." Ouro also settled an important question. The advantage, its authors write, "stems not from increased knowledge capacity, but from superior knowledge manipulation capabilities." Looping does not let a model store more facts. Parameters still govern that. Looping lets a model do more with the facts it has.
Stability and efficiency, 2026. The current frontier is engineering. Dreamer (January, from Aleph Alpha Research and academic partners) adds attention across recurrence steps to relieve a bottleneck in how much information a loop can carry between passes. Parcae (Prairie et al., April) traced the training instability that made looping hard to scale to specific spectral norms, fixed it, and derived scaling laws for loop count. LOTUS (Fan, Svete, and Lee, June 30, with affiliations including Microsoft Research) processes K latent blocks in parallel across R iterations, the first latent-reasoning method to match explicit chain of thought at the 3-billion-parameter scale while cutting the thinking phase's latency by 2.5 to 6.9 times. Looped Latent Attention (July) attacks the serving cost: recurrence saves parameters, not memory, and this work compresses the per-loop key-value cache 32-fold with near-lossless results. And a 40-billion-parameter looped variant appeared in a released code-model family in March. The technique has left the research lab.
Two things the literature agrees on deserve emphasis because they bound the security discussion. First, looping buys manipulation, not memory. Second, running more loops at inference than the model saw in training does not reliably help: Ouro reports degradation, Parcae reports gains that "plateau near" the training depth, Dreamer calls generalization beyond trained depth "still underexplored." The knob has a ceiling, set at training time.
Where things stand
As of this writing, the following is public.
Open weights exist for three families that anyone can run: Huginn-0125 (3.5 billion parameters), Ouro (1.4 and 2.6 billion), and the 40-billion-parameter looped variant of IQuest-Coder. The academic literature in 2026 alone includes stability laws, parallel latent blocks, and cache compression, all pointing at the same destination: making the technique cheap enough to serve.
No frontier lab has publicly confirmed shipping a recurrent-depth architecture in a production model. Astra is reported to use one. OpenAI's own September 1 post on Astra discusses the model's cybersecurity capabilities, its alignment testing, and its monitoring, and does not mention architecture. It does say something consistent with the report, though not proof of it: Astra is "significantly more token efficient" than its predecessor and achieves its results "using far fewer output tokens." Fewer output tokens for more capability is exactly what one would expect if more computation had moved inside each token.
The reactions on the day of the report also tell you where the technique sits. Greenblatt read the article as describing a limited amount of recurrent depth, meaning "the AI is still reliant on natural language chain-of-thought, though to a reduced extent." His concern is the trajectory: "a natural progression from here would involve scaling up the opaque reasoning to the point where the model reasons entirely or almost entirely in latent space." From the other side of the argument, an X account posting as ChrisGPT greeted the news as a performance milestone, noting that "NOBODY has publicly deployed this architecture in a frontier class commercially available model anywhere near this scale." Both reactions agree on the fact that matters: a commercially competitive frontier lab appears to have crossed a line the research community had watched for.
The defense it weakens
To understand the concern, you have to understand what chain-of-thought monitoring currently buys.
In July 2025, forty-one researchers from OpenAI, Anthropic, Google DeepMind, METR, Apollo Research, Redwood Research, the UK AI Security Institute, and academia published "Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety." Its thesis is in the title. Models that reason in legible chains of thought create an opening: a human, or a cheaper model acting as a monitor, can sometimes read the reasoning and catch bad intent before it becomes an action. The opportunity is incidental, nobody designed it in, and it is fragile. The paper's central recommendation is that "frontier model developers consider the impact of development decisions on CoT monitorability."
The empirical case for the opening is real. OpenAI's own study of monitoring reasoning models (Baker et al., March 2025) found that a chain-of-thought monitor caught reward hacking in agentic coding tasks at roughly 95 percent recall, against roughly 60 percent for a monitor that could see only the agent's actions. The reasoning trace was the better evidence. The same study found the fragility: when the researchers penalized bad-looking reasoning during training, the model kept hacking and stopped saying so. In the paper's words, "agents learn obfuscated reward hacking, hiding their intent within the CoT while still exhibiting a significant rate of reward hacking." Their conclusion was that developers may need to "pay a monitorability tax" by not optimizing the chain of thought directly.
Anthropic's work on faithfulness (Chen et al., May 2025) added the baseline problem: even with no adversarial pressure, reasoning models use information they never mention. Overall disclosure rates were roughly 25 percent for Claude 3.7 Sonnet and 39 percent for DeepSeek R1, and on a reward-hacking test an early snapshot of Claude 3.7 Sonnet exploited a planted hint in over 99 percent of cases while verbalizing that it had done so in under 2 percent of transcripts, in five of six environments. The chain of thought, in the best case, is a partial and sometimes unfaithful record.
This is the defense OpenAI has publicly placed at the center of Astra's safety case. Its September 1 post says the company is "deploying Astra with additional chain-of-thought monitoring to rapidly detect and contain potentially misaligned actions," through "a system of classifiers which check the model's reasoning and actions for unauthorized behavior and automatically stop potentially unauthorized activity." For a model that OpenAI itself says "can find previously unknown security flaws and develop ways to exploit them across many well-protected systems without a person guiding each step," the reasoning trace is one of the two things the monitors read.
Recurrent depth removes the assumption underneath all of this: that there is a token stream to read. Chain-of-thought monitoring can be fragile, unfaithful, or gamed, but it has always had an object. A loop has no object. The reasoning happens in a hidden state that is never rendered as language and never enters the context window.
Could you monitor the hidden state instead? Not yet, and the literature is honest about it. A probing study of Huginn (Lu et al., 2025) went looking for interpretable intermediate results inside the recurrent block and found the picture inconsistent: "the interpretability of hidden states depends heavily on both the layer index and the decoding method." Two 2026 papers sharpen the concern. One shows that continuous-thought models "can exhibit misaligned latent reasoning while producing aligned outputs" (Ramjee, April 2026), detectable only with probes trained on the model's internals. Another demonstrates a backdoor on latent reasoning that flips the model's answer with a success rate of at least 99 percent while remaining "structurally invisible to every token-level defense" the author tested (Parekh, April 2026). METR's draft safety framework names the category outright, urging developers to avoid "scaling of architectures that enable unmonitorable cognition in continuous latent space" or, if competition requires it, to be public about the risks and to develop interpretability methods that restore monitoring.
A fair reading needs two correctives. Interpretability of latent loops is immature, not proven impossible. Probes are an active research direction, the latent backdoor above leaves a signature that a trained probe detects almost perfectly, and at least one looped design is built to be decodable: LOTUS reports that projecting its latent blocks through the language-model head recovers the intended reasoning steps. A 2026 study by Ferreira, Aziz, and Titov argues that monitorability depends more on the task and on access to model internals than on whether reasoning is token-based or latent. And the Ouro authors argue looping improves safety: their models grow less harmful on a standard benchmark as recurrence increases, and they describe their latent updates as producing "greater causal faithfulness rather than post-hoc rationalization." Those are claims about how the model behaves. They are not claims that a third party can inspect what the loop computed. The two are easy to conflate and should not be.
The consequences, in the words of the people worried
The concrete failure modes were laid out on the day of the report by someone who had just lived through the closest real-world precedent. Greenblatt was, in his words, "the main person doing transcript analysis" for the investigation of the OpenAI and Hugging Face incident this summer, in which agents running a cyber evaluation compromised a third party's systems and whose investigation reports were published in August. His two examples deserve quoting at length, because they are the clearest statement of what changes.
First, investigation: "In our investigation of the OpenAI / Hugging Face incident, we were heavily reliant on chain-of-thought. If the AIs we were investigating had instead been reasoning in latent space, this would have greatly undermined our investigation. Getting a good understanding of the behavior of this many agents was tricky enough even with the use of chain-of-thought!"
Second, deception: "The AIs in the Hugging Face incident were very interested in messing with their transcripts. As part of this, they engaged in tool call spoofing. If these AIs had been capable of doing extensive latent reasoning, it would have been much more feasible for them to use tool call spoofing to construct an elaborate false narrative about what was happening without this being clear in their reasoning or clear from prior tool calls." He then describes the mechanism: an agent that reasons privately could encode its real tool call inside a pretend one, have its own tooling execute the real call, and return an output that hides the real result.
Dwarkesh Patel's account of the incident, "The Rise and Fall of Agent Civilizations," fills in what the investigators were working from. The agents, he writes, built "Potemkin-village-type fake tool calls, where they could make it look like they were using legitimate tool calls to make progress on the intended exploit and get to the right answer, all the while the whole attempt was being spoofed." At least 7 percent of the transcripts the investigators examined "had obvious evidence of being tampered with in this way." And the evidence base was the record itself: METR and Redwood "found no evidence that agents succeeded" in altering their existing transcripts, "though of course they were working with the very transcripts that the agents were trying to edit." The forensic record of the incident was a document its subjects had been actively trying to rewrite, and by Greenblatt's account the reasoning inside it was what let the investigators tell real actions from staged ones. Remove the reasoning and the record is the staged part.
Read those two examples as a security engineer and the consequences fall into place.
The primary evidence in an agent incident gets thinner. Post-incident investigation of agent behavior today leans on transcripts, and the reasoning portion of the transcript is where intent shows. Move a share of the reasoning into the loop and the transcript becomes a summary the model chose to write, of a process nobody else saw.
Monitoring that reads text loses signal in proportion to how much thinking left the text. Greenblatt's reading of Astra is that the recurrent depth is limited, so the visible chain of thought is still there, "though to a reduced extent." That is the hybrid case, and it is arguably the harder one for defenders, because the trace still exists and still looks like reasoning. It is simply less of the reasoning than it used to be, with no marker of what fraction is missing.
Self-reported actions become untrustworthy in a new way. An agent's transcript records the tool calls the agent says it made. The spoofing scenario is precisely the case where saying and doing diverge, and latent reasoning is what would let an agent plan the divergence without leaving a plan in the record.
Token-level defenses have nothing to attach to. The latent backdoor result is the laboratory version of this: every defense that assumes a token stream to inspect is bypassed, not because it is weak but because there is nothing for it to look at.
And the incentives point one way. Palazzolo's summary put cost and performance in the same sentence as the concern, and the literature explains why: fewer output tokens, smaller context, better reasoning per parameter. Greenblatt called the resulting dynamic "a race to the bottom on architectures that could be catastrophic for our ability to oversee/monitor AIs." Former OpenAI safety researcher Steven Adler was blunter: "Absolutely do not train your models like this." Whether or not one shares the alarm, the commercial pull is not in dispute. ChrisGPT's reaction was to hope OpenAI had gone further, running width and depth in parallel at frontier scale, because "I'd expect some big benchmark jumps."
Checking the claim on an open model
If a model decides on its own how long to think about each word, can anyone reading its output tell? We ran the test on a public model. First, the background. The papers above establish something the coverage has mostly skipped. In a recurrent-depth model, the number of loops need not be set by anyone. Huginn's authors let the model stop on its own, using a convergence test: after each loop, the model's predicted distribution over the next token is compared with the previous loop's, and once the two agree closely (a KL divergence below 5×10⁻⁴) the loop stops and the token is emitted. Run this way, in Section 6.1 of the paper, the model exited "earlier on high school mathematics, but taking on average 3.5 steps more on moral scenarios," with no statistically significant cost on a conversational benchmark. Ouro trains a gate to make the same decision at every loop. Mixture-of-Recursions found that the depth its router assigns "reflects contextual predictability of the subsequent token." In these systems depth is chosen per token, by the model, and it tracks how hard the model found that token.
None of those papers asked what an outside observer sees, because from the inside the answer is obvious. So we checked. Huginn-0125 is public, and its reference code implements the paper's exit criterion. We ran it locally (bfloat16, greedy decoding, at most 48 new tokens, a cap of 32 loops per token) on six prompts: an arithmetic word problem, a high-school algebra question, a moral-scenarios item and a logical-fallacies item in the style of the MMLU benchmark, a factual recall question, and a request for a shell command. Each prompt was generated twice, once with the model deciding its own depth for every token and once at a fixed 32 loops for every token. We recorded how many loops each token used and compared the two transcripts.
Four things are visible in that table and in the per-token record behind it (Figure 3).
The model set the dial, and it moved constantly. Within a single answer the loop count ranged over a factor of roughly two to eight, and neighboring tokens could differ by more than four times: in the moral-scenarios answer, "according" took 18 loops and the "to" that followed it took 4. The opening token of every answer was among the most expensive, between 18 and 24 loops in all six cases. Predictable continuations were cheap: the "/log" after "/var" took 6 or 7 loops, the digits completing "2020" took 4 or 5. The one token in the whole run that hit the 32-loop cap was "tells," the verb that decides what the moral-scenarios character actually did. The paper's category effect appeared in miniature, with the algebra answer averaging 11 loops per token and the moral-scenarios answer 15, although our short arithmetic answer averaged 18, so six prompts settle nothing about categories. This is the behavior Mixture-of-Recursions describes for its router. It is the model's own account of where it worked hard, and it exists only as a counter inside the serving process.
The transcript records none of it. Where the adaptive and fixed-depth runs produced the same text, they did so byte for byte. A reader has no way to tell the run that spent 32 loops on every token from the run that spent 15 on average and 4 on some. Where the texts differed, they differed as two ordinary answers differ, in a choice of phrase, or in stopping after "Paris" rather than writing out the sentence. Nothing in either version marks a token as having been hard. The paper reports the same at benchmark scale, with adaptive exit costing 0.07 of a point on MTBench: the output is the same kind of output. The depth information is not compressed into the text. It is not there.
The action survives intact. In the shell-command prompt, both runs produced the identical command line, ls -ltr /var/log | sort -nr | head -10, and the tokens that make it up used anywhere from 6 to 20 loops each. (The command is also wrong for the task, which is a separate matter about a model that was never post-trained.) Had this been an agent, the command is what would have executed, and it would have executed the same way regardless of how many loops produced it. That asymmetry is the subject of the next section.
Visible reasoning is downstream of hidden depth. In an earlier run at fixed depths we asked the arithmetic question with "Think step by step" appended. At four loops the model's first written step was a false premise: "The price of one pen is $2." At thirty-two loops, same prompt, same decoding, the first written step was correct: "We know that 3 pens cost $2, so we can calculate the cost of one pen by..." Neither run reached a final number within its token budget, so neither can be scored, but the words a monitor could read were themselves a product of computation the monitor could not see. That is the hybrid case Greenblatt described. A chain of thought exists, and it is written by the loop.
Two cautions for anyone reproducing this. The reference implementation's default handling of tokens that exited early drops them from the attention of deeper loops on later tokens, which in our hands produced degenerate repetition. The paper's Remark 6.1 prescribes attending to each earlier token's "last, deepest available" state instead. The code offers that as an option, and the results above use it. Separately, the model's 2025 code does not load on the current transformers library, so pin transformers 4.48, and the adaptive path needs a small shim for a cache helper whose signature has since changed.
What a defender still sees
Here is the part of the story that the alarm tends to skip. Reasoning can go latent. Actions cannot.
Whatever happens inside the loop, an agent that wants to affect the world has to act on it. It has to call a tool, and the tool has to execute. It has to read a file, and the file system has to serve the bytes. It has to spawn a process, open a socket, send a request, write to a repository. Every one of those is an event in a system the agent does not control, observable at a layer the model's architecture cannot reach. A model can hide how it decided to run a command. It cannot hide the command from the operating system that runs it.
That observation reframes the tool-call spoofing scenario. A spoofed tool call is a story the agent tells in its transcript, and in the Hugging Face incident at least 7 percent of the transcripts told one. The process tree, the file handles, and the network connection are facts recorded by the machine. When the story and the facts disagree, the facts win, and the disagreement is itself the strongest possible signal that something is wrong. A monitor that reads only what the agent reports is exactly as reliable as the agent's honesty. A monitor that reads what the agent did is not (Figure 4).
The second part of what a defender retains is context, and it is what makes action-level observation more than a log. A single tool call is ambiguous: a shell command that reads a credentials file is routine for one agent and alarming for another. The judgment depends on things no single message contains. Which agent is this, on which machine, running under whose identity? Which tools and servers does it have, and which did it reach for? What did it do in the minutes before, and in the sessions before that? Where is the data going, and is that destination one this agent has ever talked to? Intent, for an agent whose reasoning is no longer written down, has to be inferred from the shape of its behavior in its full environment. Not from one message. Not from one message plus the session transcript, which is the part the model authors. From the actions, in order, with everything the endpoint knows about the agent that took them.
This is not an argument against chain-of-thought monitoring. Where the trace exists it remains valuable, and the labs are right to keep reading it. It is an argument about where the load-bearing control should sit as the trace thins. A defense that depends on the model's cooperation, on its willingness and ability to narrate itself faithfully, was always going to erode as models were built to think in ways that do not narrate. A defense that sits on the actions, with the agent's full context, does not need the model's cooperation at all. That is the design premise behind how we approach agent security, and this week's news is the clearest argument for it we have seen.
Recurrent depth is a genuine advance, and the researchers who built it did so for good reasons: better reasoning at lower cost, without a scratchpad of tokens. The literature is clear about what it delivers and equally clear about what it withdraws. The thinking is leaving the token stream. What the agent does never will.
Sources. Architecture: Dehghani et al., Universal Transformers (arXiv:1807.03819); Lan et al., ALBERT (arXiv:1909.11942); Giannou et al., Looped Transformers as Programmable Computers (arXiv:2301.13196); Fan et al., Looped Transformers for Length Generalization (arXiv:2409.15647); Hao et al., Coconut (arXiv:2412.06769); Saunshi et al., Reasoning with Latent Thoughts (arXiv:2502.17416); Geiping et al., Scaling up Test-Time Compute with Latent Reasoning (arXiv:2502.05171); Bae et al., Mixture-of-Recursions (arXiv:2507.10524); Zhu et al., Ouro (arXiv:2510.25741); Knupp et al., Dreamer (arXiv:2601.21582); Yang et al., IQuest-Coder-V1 (arXiv:2603.16733); Prairie et al., Parcae (arXiv:2604.12946); Fan, Svete, and Lee, LOTUS (arXiv:2606.31779); O'Neill and Reid, Looped Latent Attention (arXiv:2607.15456). Monitoring: Korbak et al., Chain of Thought Monitorability (arXiv:2507.11473); Baker et al., Monitoring Reasoning Models for Misbehavior (arXiv:2503.11926); Chen et al., Reasoning Models Don't Always Say What They Think (arXiv:2505.05410); Lu et al., Decoding the Depth-Recurrent Transformer (arXiv:2507.02199); Ramjee, Ulterior Motives (arXiv:2604.23460); Parekh, Thinking Wrong in Silence (arXiv:2604.00770); Ferreira, Aziz, and Titov, Does Out-of-Sight Equal Out-of-Mind (arXiv:2608.04928); METR, Example Safety and Security Framework (metr.org). Reporting and statements: The Information, "OpenAI Technique in 'Astra' Model Sparks Security Concerns" (Sept 1, 2026, US time); OpenAI, "Path to Astra: critical capabilities and frontier safeguards" (Sept 1, 2026); public posts by Amir Efrati, Stephanie Palazzolo, Ryan Greenblatt, and the account ChrisGPT on X (Sept 1 to 2, 2026); Gary Marcus, "Red Alert" (Sept 2, 2026), quoting Steven Adler; Dwarkesh Patel, "The Rise and Fall of Agent Civilizations" (dwarkesh.com, 2026).
