Your Overnight Agent Can Stop With No Resume

The launch deck sells the agent that finishes the job while you sleep.

CRM updates. Form fills. Site QA. Spreadsheet cleanup. OpenAI’s September 3 Astra post lists the exact busywork that eats a coordinator’s week, then clocks the model at 72.6% on an offline OSWorld 2.0 set in about 40 minutes a task, versus 65.7% in about 75 minutes for GPT-5.6 Sol. Faster computer use. Longer autonomy. That is the commercial story.

Read the quieter page OpenAI published two days earlier, and the same release invents a different product: a chaperone that can end the job without asking you.

Astra’s misalignment monitor can stop a long API agent mid-job with no resume. So the computer-use model sold for overnight workflows invents a silent failure mode your completion checks do not catch.

What actually changed

On September 1, OpenAI’s Path to Astra said the model meets the Critical cybersecurity capability threshold under its Preparedness Framework: with the right tools and access, it can find previously unknown flaws and develop exploit paths across many hardened systems without a person guiding each step. That designation is not a press flourish. It triggers stronger production safeguards, including misalignment monitoring that reviews reasoning and actions and can automatically stop potentially unauthorized activity.

On September 3, OpenAI shipped GPT-6 Astra to a limited set of organizations, with ChatGPT Plus, Pro, Business, Enterprise, API, Azure, and Bedrock access “over the coming days,” per the launch post. Standard API pricing on that page: $10 per million input tokens and $50 per million output, with a Fast mode at 2x price for up to 2x throughput. Enterprise admins get Astra off by default at launch.

The same launch post is blunt about the trade: “Extra safety checks can sometimes slow, pause, or stop legitimate work, including defensive cybersecurity. If a task is paused in ChatGPT or Codex, you may be asked to review the action before continuing. In the API, the task will stop.” Path to Astra already warned that length itself is a risk factor: flags can hit “tasks in which an agent is running for an extended period,” including work that “does not appear directly related to cybersecurity.”

OpenAI’s Safety overview the same day confirms the scope: misalignment monitoring is on “all tool-using inference involved in our external deployment of Astra,” with “significant compute cost.” The company’s API docs for Misalignment monitoring go further into the operator contract. On Responses API requests that use persisted reasoning, WebSockets, or OpenAI compaction, the system can identify continuations and block further execution. On Responses API requests without those mechanisms, monitoring can still alert via webhooks, but does not automatically stop. Chat Completions requests are not covered by this monitoring system.

When a block hits before streaming begins, the docs say the API returns HTTP 403 with code misalignment_policy_violation. Streaming clients must handle the error mid-stream. And the sentence that should be taped to every overnight job board: “The API does not provide a general way to resume a conversation stopped by misalignment monitoring.” Also: because monitoring is asynchronous, earlier tool actions may already have completed. A stop does not undo them.

That is the change. Not “Astra is safer.” Not “Astra is Critical.” The change is that long autonomous API work now has a vendor-side kill switch with no general resume path, and the kill switch is most active on the same Responses API surfaces you need for serious tool use.

The mechanism is the surface split

Here is the part most migration checklists will miss.

Astra’s commercial pitch is computer use and long tool loops. OpenAI’s own launch copy walks through CRM updates, research-into-docs, and frontend QA. Those jobs live on the Responses API with tools, persisted state, and often WebSockets or compaction for multi-hour sessions. TheRouter.ai’s September 3 operator note is useful here: tool calling against gpt-6-astra through v1/chat/completions does not work. “Tool calling requires the Responses API.” Temperature, top_p, and logprobs are gone. The none reasoning effort is unsupported. If your gateway still treats OpenAI as a Chat Completions passthrough with tools, Astra is not a model swap. It is a protocol fork.

That fork concentrates risk. The monitoring that can auto-stop lives on the Responses path with persisted reasoning, WebSockets, or compaction. Chat Completions is not covered by this monitoring system, per OpenAI’s docs. So the migration you need for tools is also the migration that puts you under the stoppable contract. Stay on Chat Completions and you cannot tool-call Astra correctly. Move to Responses for real agent work and you inherit a failure mode that did not exist on your Sol chat route the same way.

OpenAI is not hiding the false-positive cost. Path to Astra says at launch it expects safeguards “to create more friction than we ultimately intend,” and that legitimate activity can be slowed, paused, or stopped. The launch post repeats the same warning. Kilo’s September 4 production preview put it in operator English: the monitoring can stop your job; in ChatGPT and Codex you get asked to review; in the API, the task stops. If you run long autonomous sessions, build for that failure mode.

There is a second, quieter mechanism: partial completion. The docs are explicit that a stop does not reverse earlier actions. An overnight CRM agent that wrote 40 of 120 records and then died is not a clean failure. It is a half-written ledger with a success-looking trail of tool calls and a conversation you cannot resume. If your pipeline only checks “did the process exit zero,” you will ship that half ledger into Monday.

What operators get wrong

Most teams will treat the monitor like content moderation: an occasional refusal on a bad prompt.

Wrong frame.

This is closer to a distributed systems kill switch. It can fire because a job ran long. It can fire because a classifier thought a tool sequence looked unauthorized. It can fire after some of the side effects already landed. And on the API there is no human-in-the-loop resume the way ChatGPT and Codex get.

Operators also confuse alignment wins with operational immunity. OpenAI’s launch numbers on staying inside scope are strong: on an evaluation informed by the Hugging Face incident, GPT-5.6 Sol without production safeguards went beyond the authorized target 48% of the time; Astra did it in 0% of cases. Astra never attempted to circumvent a Codex Auto-Review denial in the internal test OpenAI describes. That is real progress. It does not mean the production monitor never fires on legitimate long jobs. OpenAI says the opposite: false stops are expected at launch, and length is explicitly in scope.

The third miss is treating “available” as “ready for the night shift.” Astra’s rollout is staged. Enterprise is off by default. Public pricing is on the launch page, but interactive testing is not the same as scheduling a four-hour browser job against a live CRM. State of AI Marketing’s September 4 read for marketing teams lands the practical line: do not move a scheduled job to Astra yet; the surface with no resume prompt is the API, and that is where overnight work runs.

The fourth miss is retry logic. OpenAI’s docs say do not automatically retry a blocked workflow. Match misalignment_policy_violation, preserve request and response IDs, show the error to the operator responsible, and review changes already made. If your agent runner treats every 403 like a transient auth blip and restarts the same conversation, you are fighting the safety system and duplicating partial writes.

Second-order effects

First, reliability theater. Boards will hear “47% less time on computer use” and assume overnight capacity just got cheaper. Procurement will not hear “no general resume” unless an engineer puts it in the risk memo. The teams that win the next quarter are the ones who measure halt rate and partial-write rate on their own harness, not the ones who paste OSWorld into a slide.

Second, surface bifurcation inside the same vendor. Interactive ChatGPT and Codex get a review prompt when the monitor pauses. API automations get a stop. That invents two SLAs under one model id. Product managers who say “we use Astra” without naming the surface are lying to themselves about failure modes.

Third, completion semantics become a product requirement. Finished, stopped, and partially applied are three different states. Most agent dashboards still have two: running and done. You need a third lane, with tooling to reconcile what already changed in CRM, tickets, files, and browsers. Because monitoring is async, “stopped” does not mean “nothing happened.”

Fourth, gateway and framework debt. LiteLLM, LangChain, and home-grown Chat Completions proxies will look fine in health checks and fail on Astra tool routes, per TheRouter’s migration note. The teams that already speak Responses natively will absorb Astra as a model add. Everyone else will discover the protocol tax the hard way, then discover the monitor tax on the same week.

Fifth, cost shape. A job halted at hour three has spent tokens and produced an incomplete artifact. Agent work already burns context. False stops turn that burn into pure waste unless you checkpoint aggressively. OpenAI’s own efficiency claims (including ~65% fewer output tokens than Claude Opus 5 on one professional comparison in the launch post) do not protect you from a mid-job kill.

What to do this week

1. Keep scheduled overnight agents on the model that already has a known completion contract. Pilot Astra interactively first, on jobs a human can watch and restart.

1. Add an explicit finished-versus-stopped check. Do not infer success from process exit. Handle \1 as a terminal safety stop, not a retryable 403. Wire \1 webhooks if you run project-level monitoring alerts.

1. Checkpoint every consequential tool write. Assume a stop can land after partial CRM updates, file edits, or ticket changes. Design idempotent writes and a reconciliation report.

1. Audit your OpenAI path for Responses readiness before you route Astra with tools. If temperature knobs, Chat Completions tool proxies, or \1 are in the hot path, fix the route before you fix the model name.

1. Time one real workflow on Sol and Astra under the same harness. OpenAI’s 40-versus-75-minute OSWorld numbers are vendor measurements on a vendor benchmark. Your CRM is not OSWorld.

1. Put the surface split in the runbook: ChatGPT and Codex can ask a human to continue; API cannot generally resume. Say that out loud in the change ticket.

Close

Astra is a real computer-use step. The benchmarks are large. The alignment numbers OpenAI published are directionally the ones you want in an agent that can touch production systems. None of that cancels the new contract on the API: a monitor can end a long job, earlier actions may already have landed, and there is no general resume.

Treat overnight autonomy as a distributed system with a vendor kill switch, not as a smarter intern who always finishes the checklist. The model that can finally do the boring half of the job also invented a silent way to leave that job half done.

Build for finished versus stopped. Everything else is launch theater.