Computer-use safety must also exist outside the model
A model that operates browsers and desktops can turn an incorrect interpretation into a real account or data change. OpenAI's computer-use guidance says to isolate the environment, allow-list destinations and actions, and treat screen, document and tool content as untrusted input.
Users should confirm purchases, transmission of personal information or files, deletion and other hard-to-reverse actions immediately before execution. Typing sensitive information into a form counts as transmission. Runs also need step, time and cost limits, cancellation, and verification against the actual application state rather than the model's closing sentence.
What Astra misalignment monitoring does
Misalignment monitoring asynchronously reviews whether an agent is interpreting instructions correctly in consequential settings such as sensitive-data access or transmission and destructive changes. It may stop a conversation or create a project safety alert when it identifies a concern.
With Responses API conversations that preserve context through persisted reasoning, WebSockets or OpenAI compaction, the system can identify continuations and block further execution. Other Responses requests may generate alerts without automatic stopping. Chat Completions requests are not covered by this monitoring system.
A stop is not a rollback
Because review is asynchronous, an action may finish before a concern is detected. Stopping a request does not undo earlier changes, and there is no general resume mechanism. A flag is a signal for review rather than proof of a violation; monitoring can miss a problem or flag legitimate work.
Operators still need approval gates before sending, paying or deleting; action logs; idempotency keys; reversible workflow design; and verification of the resulting state. Safety in the Astra era is not just a careful model. It is a system that narrows what the agent can do and keeps accountable human judgment at consequential boundaries.