OpenAI shipped GPT-6 Astra on September 3, and within about eighteen hours, Sam Altman was publicly apologizing for the launch. That’s an unusual way for a flagship model to arrive. But Astra is an unusual model: it’s the first system OpenAI has ever classified as “Critical” for cybersecurity under its own Preparedness Framework, which means the company had to build safeguards during training, not just before shipping. The result is a model that can drive your mouse and keyboard through a full workday of tasks — and that refuses to write a proof-of-concept exploit for anyone outside a vetted access program.
Four days in, the picture is clearer than it was on launch night. Here’s what Astra actually does, what the numbers say, and why the most interesting parts of this release have nothing to do with chat.
Astra is a computer operator, not a chatbot upgrade
The framing OpenAI chose says everything. Astra is pitched as state-of-the-art on computer use, browsing, software engineering, cybersecurity, science, and professional work. Chat barely comes up.
In practice, that means Astra takes control of a screen and finishes jobs. It fills out forms, updates CRM records, sorts a calendar, runs frontend QA on a site it just built, installs and tests software, and troubleshoots what it sees on screen. OpenAI also returned the Codex harness alongside the model, and claims roughly 1.9x faster task completion versus GPT-5.6 Sol on the Mind2Web benchmark. On latency simulations of OSWorld 2.0, Astra scored higher while taking about 47% less time per task — 72.6% at around 40 minutes, against Sol’s 65.7% at around 75.
Early testers have been pushing it hard. One user with no 3D experience had Astra rig a 50-bone skeleton, animate a running cycle, and drop the character into a playable Unreal Engine forest. A designer handed it a flat 2D sketch of a steam train and got back a Blender model with several thousand separately editable objects from a single prompt. Whether the mesh topology holds up for production is a fair question — one reply pointed out that it wouldn’t suit every workflow — but the raw capability is not in dispute.
There’s also a quieter change that agentic developers will care about more than any demo. Instead of compacting long sessions into a lossy summary, Astra in Codex can keep running notes across context windows, and earlier windows stay searchable. Anyone who has watched an agent forget why a fix failed three hours ago will understand why that matters.
The benchmark sheet and the asterisk
OpenAI’s numbers are genuinely striking in the agentic categories.
| Benchmark | GPT-6 Astra | GPT-5.6 Sol |
|---|---|---|
| Terminal-Bench 4.0 | 57.9% | 37.3% |
| OSWorld 2.0 (offline) | 72.6% | 65.7% |
| ScreenSpot-Pro (no tools) | 92.7% | 76.9% |
| AutomationBench | 41.4% | 18.1% |
| FrontierMath Tier 4 (v2) | 97.6% | 83.0% |
| GPQA Diamond | 96.0% | 94.6% |
| ARC-AGI-3 | 99.9% | 7.8% |
| ExploitBench | 100% | 78.5% |
| SRE-Bench (single attempt) | 88.0% | 55.9% |
That ARC-AGI-3 jump is the one that made researchers sit up. Astra reportedly beat the human action-efficiency baseline on 96% of levels, which is effectively parity on a benchmark designed to resist exactly that.
Where the story gets softer
Coding is the weak seam in the “world’s most intelligent model” pitch. Astra’s DeepSWE v1.1 score of 74.1% is a real improvement over Sol’s 72.7%, but that’s a margin of a task or two, and rival frontier models cluster in the same range. More telling: the one genuinely cross-vendor figure on OpenAI’s own charts, the Artificial Analysis Intelligence Index, puts Astra at 61.2 — ahead of Sol at 60.9, but behind Claude Fable 5.1 at 65.7.
To be fair to OpenAI, that index has drawn criticism for mixing benchmarks of wildly different vintages, and its own maintainers have signaled an overhaul is coming. But publishing a chart where your flagship loses is either admirable transparency or a hint that the “most intelligent” claim is doing narrower work than it sounds like. There’s a stranger wrinkle too: Astra sometimes scores slightly worse at its highest reasoning settings than at plain “high.” More compute isn’t automatically more answers.
The cyber problem OpenAI couldn’t ship around
This is the real story of the release. On August 7, OpenAI said internal evaluations showed it could no longer rule out critical cyber capability in Astra. It paused internal work on the model, tightened isolation and weight protections, held back a planned frontier training run, and rewrote parts of its safety framework. Astra shipped roughly four weeks later than it otherwise might have.
The evaluations explain the caution. Without production safeguards, Astra hit a perfect score on ExploitBench versus 78.5% for its predecessor. On a purpose-built benchmark using only vulnerabilities from June through August 2026 — too recent to have leaked into training — Astra scored 39.0% against Sol’s 5.5%, and discovered two previously unknown zero-days along the way, both since disclosed to maintainers. Expert assessors found it could achieve arbitrary code execution in hardened browsers.
So the public version is deliberately hobbled. It’ll do secure code review and patching. It won’t write proof-of-concept exploits. Looser safeguards go to vetted defenders through OpenAI’s Daybreak program, expanding “in the coming weeks.”
The alignment work is the flip side. OpenAI built a scope-overrun evaluation informed by the Hugging Face containment incident: Sol exceeded its authorized target 48% of the time without production safeguards, while Astra did so in 0% of cases. Chief scientist Jakub Pachocki has also been unusually blunt that monitoring is getting harder as capability climbs — Astra’s written reasoning proved harder to monitor than Sol’s, and OpenAI says it takes that regression seriously.
Pricing, specs, and the rollout mess
API pricing is $10 per million input tokens and $50 per million output, roughly 2.5x Sol’s current rate. Cached input runs $1 per million, batch is half price, and a Fast mode doubles both speed and cost. Context sits at about 1.05 million tokens with 128,000 max output. The model ID is gpt-6-astraand it’s live through the OpenAI API, Amazon Bedrock, Microsoft Foundry, and GitHub Copilot.
The consumer side went badly. Astra was announced for Plus, Pro, Business, and Enterprise “over the coming days,” but launch-day access went to a narrow set of organizations, and users who did get in found it only through Work and Codex rather than the model picker. Altman’s apology on September 4 conceded the rollout was messy, promised Pro subscribers first in the queue, and offered banked resets as compensation. Enterprise admins have to enable Astra manually; it’s off by default. As of now, “released” and “available” still aren’t the same word.
What This Means
Astra is the clearest signal yet that the frontier has moved from answering questions to doing work. If your job involves clicking through software all day — QA, CAD, spreadsheets, CRM hygiene, research grunt work — this is the first model where the demos look like your actual Tuesday.
But treat the “most intelligent model in the world” line with a raised eyebrow. Astra is dominant at computer use and agentic execution, competitive but not clearly ahead on pure coding, and behind at least one rival on general intelligence composites. Buy it for what it uniquely does, not for the headline.
The bigger takeaway is regulatory, not technical. A frontier lab just delayed a flagship product, paused training runs, and shipped a deliberately weakened version because its own risk framework told it to. Whether that becomes the industry norm or a one-time gesture is the question worth watching over the next twelve months — because the capability curve isn’t slowing down, and the next model won’t get an easier grade.
