What's this about?
The OpenAI Responses API now returns 404 Not Found for the model slug "gpt-6-astra", where genuinely nonexistent slugs return 400. The same 404 is returned for 5.6 Cyber, which is known to exist. A similar quirk in Bedrock surfaced Fable 5.1 a day before its launch.
Why does a 404 leak more than a 400?
Because the two errors are answering different questions. A 400 means the request was malformed — the string you sent is not a valid model identifier. A 404 means the request was well-formed but the resource is not available to you, which implies the identifier is real and registered somewhere in the system. Staging a model's configuration before launch creates the registration; the error code is a side effect nobody thought of as a channel.
Why is it worth noticing?
3,261 likes
- It is a small, clean example of an information leak through error semantics — the same class as the "error channel is a channel" note in the QubesOS entry a few days ago.
- The precedent is good: the identical trick surfaced Fable 5.1 a day early, so the inference has a track record.
- Astra is the model OpenAI designated Critical for cyber capability two days ago, so "staged on the API" is a schedule signal worth having.