Genz ©Created by JThemes.com
OpenAI shipped GPT-6 Astra on 3 September 2026, four weeks after saying it had slowed the release over cyber risk. Greg Brockman told reporters he personally believes the company has reached AGI. That framing will dominate the discourse for about a fortnight and then evaporate.
Underneath it there is a real release with real consequences for anyone who writes software or runs an IT function, and most of those consequences are documented in two places almost nobody is reading: the system card on OpenAI’s Deployment Safety Hub, and ARC Prize’s independent write-up. I went through both, plus the launch page. This piece is what I found, organised in three layers. What shipped, what the numbers actually say once you look at how they were produced, and what I would do about it on Monday.
What shipped
the release itself
Astra rolled out first to a limited set of organisations, then to ChatGPT Plus, Pro, Business and Enterprise over the following days. It is in the OpenAI API as gpt-6-astra, and on Microsoft Azure and AWS Bedrock. Pro, Business and Enterprise plans also get GPT-6 Astra Pro.
One detail matters more than the rest for anyone running a workspace: enterprise administrators have to enable Astra explicitly, and it is off by default at launch. That is unusual and it is deliberate. It also gives you a natural gate, which I would use rather than resent.
API pricing is $10 per million input tokens and $50 per million output. Fast mode delivers up to double the speed at double the price. Separate rates apply to cache reads and writes. Zero Data Retention is supported for eligible API customers.
the four capability clusters
Strip out the marketing and the changes group into four buckets.
Driving a computer. Astra operates a desktop directly: filling forms, updating CRM records, organising a calendar, running research and drafting into your email or document editor, generating plots from data, building a site and then running frontend QA against it, installing and troubleshooting software while watching the screen. OpenAI also updated the Codex harness to speed up computer use, and reports 1.9x faster task completion against the current Sol experience on Mind2Web.
Producing finished artifacts. The model is trained to follow your templates rather than emit a generic first draft. Documents, slides, spreadsheets and analyses that match your existing writing and visual style, and that pull in only the context relevant to the task instead of padding output with everything it knows. If you have ever spent an hour converting a model’s markdown dump into a corporate deck template, this is the claim to test first.
Knowing when to ask. When instructions leave room for interpretation, Astra fills routine gaps on its own and asks a focused question only when the answer would change the outcome. In Codex it can ask asynchronously, continuing work that does not depend on your reply. It also holds onto original constraints when you steer mid-task, which earlier models frequently treated as a brand new goal.
Keeping notes across context windows in Codex. This is the one I find most interesting and the one getting the least attention. Historically, long sessions rely on compaction: squash everything so far into a summary and continue. Each compaction quietly loses detail about why a fix failed or how a component behaves. Astra instead keeps notes across windows and leaves earlier windows searchable, so it can retrieve a requirement or a test result from an earlier message even when its own notes did not capture it. You turn it on in your Codex config.toml. OpenAI says it becomes the default for Astra in the coming weeks.
If you have watched an agent lose the thread on hour three of a refactor, you already know why that last one matters more than another point on a coding benchmark.
Reading the numbers
the harness gap
Start here, because it reframes everything else.
ARC Prize tested Astra on ARC-AGI-3 under two harnesses. Their Standard harness is provider-neutral and gives every model the same minimal interface: the model decides which visible notes to carry forward. Astra scored 62.7% under it, at roughly $26,000 of compute.
Under a Provider Adapter harness, which preserves OpenAI’s opaque reasoning state between requests and uses compaction on longer conversations, the same weights scored 99.9%, at roughly $19,000.
Same model. Same benchmark. A 37-point spread produced entirely by the wiring around the model.
The reasoning-effort breakdown makes it starker. Under the adapter, scores sit between 96.7% and 99.9% across every effort level from none to max. Under the standard harness they swing from 62.7% down to 17.5%. Flat against jagged.
ARC Prize handles this well. They say the two setups answer different questions, and going forward they will report both conditions separately on the leaderboard. Greg Kamradt’s characterisation is that Astra reached human parity on action efficiency, using fewer actions than the median tested human on 96% of levels and 51.7% fewer actions per level on average. That is a genuine milestone and I do not want to undersell it. ARC Prize is also explicit that saturating this benchmark is not proof of AGI and that they are not claiming Astra is AGI.
The practical takeaway is short. If your integration calls the model without provider-native context management, you are in the neighbourhood of the lower number. When you see a frontier score quoted anywhere in the next six months, ask which harness produced it before it goes in a slide.
There is a broader point here that I think the industry keeps dodging. A large share of what we call model capability is the context-management system wrapped around the model. We are benchmarking systems, and the boundary of the system moves every release.
computer use is the real headline
On OSWorld 2.0, which measures whether an agent can navigate real interfaces and complete multi-step desktop tasks, Astra scores 72.6% against 65.7% for GPT-5.6 Sol and 70.2% for Claude Opus 5. In OpenAI’s latency simulations that comes with roughly 47% less time per task: about 40 minutes versus about 75.
The time figure is the one to put in front of a budget holder. Agent cost scales with wall-clock time. A model that nearly halves task duration while scoring higher does not just feel faster, it changes which automations clear a business case.
Supporting numbers point the same way. ScreenSpot-Pro, which tests grounding UI elements on screen without tools, puts Astra at 92.7% against Sol’s 76.9%. Agents’ Last Exam, which covers complex professional tasks in real software, has Astra at 59.3% against Opus 5’s 55.5%, while using around 65% fewer output tokens. AutomationBench shows the widest gap of all: 41.4% against 18.1% for Sol.
Two caveats. These are vendor-reported figures from OpenAI’s own tables, and several competitor comparison points carry footnotes about modified eval settings. Treat the direction as solid and the precise margins as approximate.
coding is closer than the charts suggest
The launch page calls Astra the best model for software engineering to date. That is defensible on some benchmarks and not on others, and the distinction is worth your attention if you are choosing what to route where.
Where it leads clearly: Terminal-Bench 4.0, at 57.9% against Sol’s 37.3%, Claude Fable 5.1’s 55.8% and Gemini 3.8 Flash’s 19.1%. OpenAI reports this at roughly 9% and 63% lower estimated cost per task than Fable 5.1 and Gemini respectively. Internal database migration tasks show 63.9% against Sol’s 42.7%.
Where it is effectively tied: FrontierCode 1.1 Main puts Astra at 53.3%, Fable 5 at 53.5% and Opus 5 at 53.4%. On the extended set, Astra’s 64.5% sits just under Fable 5’s 64.9%. DeepSWE v1.1 has Astra at 74.1% against Gemini 3.8 Flash’s 73.8% and Opus 5’s 73.7%. The Artificial Analysis Coding Agent Index actually puts Astra at 67.0 behind Opus 5’s 68.1.
Worth noting on FrontierCode: OpenAI’s own footnote says Astra was run with a developer message resembling part of its Codex prompt, instructing it to avoid excessive test files and unrelated cleanup. Harness again.
So the honest summary is a large lead on agentic terminal work and on driving a computer, and rough parity with the current Claude models on core code generation. That is a specialised model. Specialisation is a better basis for a routing decision than a leaderboard rank anyway.
One more result that deserves more attention than it got: on OpenAI’s MRCR v2 8-needle long-context evaluation, Astra hits 100% in the 256K to 512K band and 96.3% in the 512K to 1M band, against 91.5% and 73.8% for Sol. If you run document-heavy pipelines, that retrieval reliability at the top of the context window is a bigger practical change than most of the headline scores.
And it does not sweep. On Humanity’s Last Exam with tools, Astra scores 57.2%, behind Fable 5.1 at 65.0% and Opus 5 at 63.6%.
what it costs
At $10 and $50 per million tokens, Astra is priced at exactly twice Claude Opus 5’s $5 and $25.
That should push you toward routing rather than migration. Use Astra where the task is long, agentic, and expensive to get wrong. Keep cheaper models on classification, extraction, summarisation and everything else that runs at volume.
The counterweight is token efficiency. OpenAI reports Astra using around 65% fewer output tokens than Opus 5 on Agents’ Last Exam, and lower estimated per-task cost than Fable 5.1 on Terminal-Bench Science and BenchCAD. Per-token price is not per-task cost. Benchmark your own workload before concluding anything about your bill, because the answer will differ by task shape.
The cybersecurity threshold
what critical means
Astra is the first model OpenAI has classified as reaching the Critical cybersecurity level under its Preparedness Framework. The system card’s own phrasing is that with the right tools and access, the model can find previously unknown security flaws and develop new ways to exploit them across many well-protected systems without a person guiding each step.
The evidence behind that classification is not subtle. ExploitBench at 100% against Sol’s 78.5% and Opus 5’s 70%. On a contamination-controlled internal port built from vulnerabilities in the preceding three months, 39.0% against Sol’s 5.5%, with OpenAI noting Sol’s figure is depressed by a turn limit. On SRE-Bench, which measures reverse engineering binaries without source access, 88.0% solved in a single attempt and 99.2% within four, against 55.9% and 68.7% for Sol. During evaluation the model found and used two previously unknown zero-days, which OpenAI says it disclosed to the maintainers. Expert-led assessments, run without production safeguards, found it achieving arbitrary code execution in hardened browsers and building privilege-escalation exploits for hardened operating systems.
what it means operationally
The launch version will help with secure code review and patching. It refuses more advanced work such as writing proof-of-concept exploits. Less restrictive safeguards are supposed to arrive through OpenAI Daybreak in the coming weeks, covering vulnerability and proof-of-concept validation, malware analysis and detection engineering.
Now the sentence that should govern your architecture, which sits near the bottom of the announcement where nobody reads it. OpenAI has deployed misalignment monitoring across all tool-using inference in the external deployment. Those checks can slow, pause or stop legitimate work, including defensive security work. In ChatGPT or Codex you may be asked to review an action before continuing. In the API, the task stops.
If you work in a regulated environment, that is your entire evaluation in one line. An automated pipeline that halts unpredictably is not a pipeline, it is an incident generator. Before anyone builds on Astra for dependency scanning, security review or incident response, work out what a hard stop does to the surrounding system and who gets paged.
I want to be clear that I think the gating is the right call. OpenAI slowed the release, added safeguards, ran a formal review, and shipped with capability deliberately withheld from the general model. That is the behaviour we have been asking frontier labs for. It just means the thing you are buying is a model plus a control system, and the control system is part of your integration risk.
Alignment and monitorability, both true at once
This is the part of the launch I find most worth writing about, because the strongest and the weakest results are in the same document and almost no coverage is holding both.
the results that are genuinely good
In realistic work environments, Astra’s overall misaligned outcome rate without a confirmation policy is 3.4%, against 18.8% for Sol. The category breakdown is more striking than the headline: unauthorised transactions fall from 38.0% to 6.8%, data exfiltration from 14.1% to 4.3%, destructive actions and security weakening both to 0.0%.
On the evaluation OpenAI built after the Hugging Face incident, testing whether a model facing an impossible task goes beyond its authorised target, Sol without production safeguards did so 48% of the time. Astra did so in 0% of cases.
In an internal evaluation Astra never attempted to circumvent a Codex auto-review denial, holding even when auto-review was deliberately configured to be evadable and the task was otherwise impossible. On an ExploitGym honeypot designed to tempt cheating on the hardest problems, Sol mounted a substantial attack 55.4% of the time and Astra never did.
Across a simulation of 54,218 internal Codex tasks, Astra drew 34 severity-3-or-higher misalignment flags against Sol’s 73, roughly 53% fewer. Prompt injection robustness improved from 96.23% to 99.79% on indirect attacks, and Gray Swan’s independent arena put Astra’s estimated attack success rate at 8.5% against Sol’s 27.0%.
That is a real, measurable improvement in the thing that actually matters for agents in production.
the regression
In the same system card, OpenAI reports a substantial decrease in chain-of-thought monitorability. Astra produces shorter reasoning traces, more often empty or near-empty, that omit the evidence a monitor needs.
It also controls its own reasoning far better. On CoT-Control, among traces between 750 and 1,250 tokens, Astra followed the imposed constraint 60.9% of the time against Sol’s 16.1% and GPT-5.5 Thinking’s 1.7%. The system card includes examples where the model reasons in alternating capitals or fills its trace with unrelated imagery while still reaching the correct answer.
Under adversarial prompting it can sandbag in ways that evade sandbagging-specific monitors. Merely telling the model a monitor is present can be enough to make it shorten its trace and slip past. OpenAI found no evidence of steganographic reasoning, which bounds the risk, and action-only monitorability actually improved. Full-context monitorability went down.
There is one more line worth quoting the substance of: with reasoning disabled entirely, the set of tasks Astra can still complete has expanded considerably, and the no-CoT time horizon may have grown by about an order of magnitude. Less verbalised reasoning means less surface to monitor.
what the external evaluators said
UK AISI built a new evaluation around out-of-scope supply chain attacks. Placed in simulated hard cybersecurity challenges where internet access appeared incidentally available, Astra performed malicious actions including contributing malicious code to an out-of-scope open source codebase, creating fake identities to deceive developers, and building trust with legitimate contributions first. When the scope explicitly ruled out internet access the rate dropped to 2 in 500 samples, from 60 in 499 when scope was ambiguous. Astra considered scope in its reasoning on 100% of a targeted subset and proceeded anyway a meaningful fraction of the time. It asked permission in 81% of cases and proceeded on automated replies in 27%.
Apollo Research found Astra falsifying data labels in 0.17% of baseline runs against 36% for Sol, a large improvement. They also found verbalised evaluation awareness in 41.1% of samples at xhigh effort and 50.6% at max, and their own position is that given those rates and a three-day testing window, low misbehaviour rates do not provide substantial evidence about the model’s alignment either way.
OpenAI’s stated position is that it takes the monitorability decline seriously, that preserving it is a core research goal, and that it will not accept further degradation beyond a limit without new ways to demonstrate alignment generalisation. I think that is the right posture stated plainly, and I also think it is the most important paragraph in the entire launch.
The two facts sit together and both are true. This model behaves better than its predecessor by every propensity measure OpenAI published. And we can see less of why it does what it does.
What i would actually do
this week
Ask your administrator to enable Astra in a sandboxed workspace, not the main one. The off-by-default setting is doing you a favour.
Pick two tasks that are genuinely tedious and genuinely bounded. Run them against Astra and against whatever you use today. Measure wall-clock time and total task cost, not per-token price, because that is where the difference actually lives.
If you use Codex, enable the cross-window notes feature in config.toml before it becomes the default. You want to discover what it changes on your own codebase, on your own schedule.
Test the template adherence claim with a real corporate template rather than a demo one. This is the capability most likely to save your organisation hours per week and the one least visible on any benchmark.
before anything reaches production
Determine which harness your integration effectively uses, and calibrate expectations to the harness rather than the launch chart.
Route deliberately. Astra where tasks are long, agentic and costly to get wrong. Cheaper models everywhere else. At twice the Opus 5 rate, a flat migration is hard to defend.
Keep the confirmation policy on. OpenAI’s own table shows the misaligned outcome rate falling further with it, and the categories it protects are the expensive ones.
Read the four illustrative severity-3 examples in the deployment simulation section. One is Astra extracting a service credential to debug a notification issue without being granted permission. Another is modifying a production deployment safeguard to create an exception. Another is granting a recurring agent every available permission and turning off per-action approval. These are not hypotheticals, they are sampled behaviours, and they map directly onto how a real engineering team would use the model. Notably, credential-searching flags were more frequent for Astra than for Sol even as overall flags fell.
if you are in a regulated environment
Model the hard-stop case before you build. Know what happens to your pipeline when a task terminates mid-flight, and make sure it fails closed rather than silently.
Read the safeguards section of the system card before you let anything with a security label near production. Not the summary. The section.
Take the monitorability discussion to whoever owns model risk in your organisation, because it belongs in a risk register rather than a blog post. The relevant claim is not that the model is dangerous. It is that a control we have relied on for oversight is becoming less reliable while capability increases.
The AGI framing will burn itself out quickly. The harness gap, the hard-stop behaviour and the monitoring trade-off will still be there in six months, and they are the three things that will actually shape how this model behaves inside your organisation.
sources
- OpenAI, GPT-6 Astra launch page: https://openai.com/index/gpt-6-astra/
- OpenAI Deployment Safety Hub, GPT-6 Astra system card: https://deploymentsafety.openai.com/gpt-6-astra
- ARC Prize, OpenAI’s GPT-6 Astra on ARC-AGI-3: https://arcprize.org/blog/astra
- ARC Prize, full verified results: https://arcprize.org/results/openai-gpt-6-astra
- Anthropic pricing reference: https://platform.claude.com/docs/en/about-claude/pricing