GPT-6 Astra has landed, and OpenAI has paired it with an admission you do not often read. Astra is the first model the company judges to have reached the “Critical” cybersecurity level under its own Preparedness Framework. Which means: it spots unknown flaws and writes the means to exploit them, with no human holding its hand at each step. The rollout started on 3 September at a limited set of organisations, ahead of a phased opening to ChatGPT subscribers.
GPT-6 Astra, a model that drives your computer
Astra does not promise better writing. It promises action. The model can work a computer and websites in a user’s place: filling a form, updating a customer record in a CRM, organising a calendar, running research, summarising a document, analysing scientific data and plotting it, building a website then checking how it renders, installing and testing software, or diagnosing a problem shown on screen.
OpenAI says it evaluated the model across deliberately scattered territory: circuit boards, spreadsheet competitions, game development, completing a US Form 1040 tax return, frontend QA, Power BI, car transmissions, legal document formatting.
The numbers follow. On OSWorld 2.0, a benchmark measuring how well a model handles real desktop tasks, Astra reaches 72.6 per cent where GPT-5.6 Sol, the previous generation, topped out at 65.7. Completion time falls from roughly 75 minutes to roughly 40, a 47 per cent cut. On Mind2Web, Astra paired with an updated Codex harness wraps up tasks 1.9 times faster than the current Sol experience.
A “Critical” threshold never reached before
This is what made security specialists sit up. OpenAI’s Preparedness Framework sorts dangerous capabilities into tiers, and Astra is the first broadly deployed model from the company to cross the Critical tier on cyber.
The internal results say why. ExploitBench, the in-house evaluation run from June to August 2026, puts Astra at 100 per cent against 78.5 per cent for Sol, using fewer output tokens along the way. On ExploitGym it climbs from 30.3 to 42.4 per cent. On SRE-Bench, which tests reverse engineering of binaries with no access to source code, it hits 88 per cent on a single attempt where Sol stayed at 55.9, and 99.2 per cent across four attempts against 68.7.
The most telling test is this one: OpenAI put the model up against vulnerabilities disclosed in the three months before launch, to check that it was genuinely searching rather than replaying exploits seen in training. Astra surfaced two previously unknown zero-day vulnerabilities, which OpenAI says it is disclosing to the maintainers involved. Experts working without production safeguards also found it could achieve arbitrary code execution in hardened browsers and build privilege-escalation exploits for hardened operating systems.
The guardrails OpenAI has built
So OpenAI has stacked up protections. The production model refuses certain advanced cyber tasks, creating proof-of-concept exploits first among them. Then come Codex Auto-Review, monitoring of reasoning and actions, misalignment monitoring in production, classifiers hunting for unauthorised behaviour, automatic stopping of suspect activity, and hardening against attempts to work around all of it.
The company admits this can cut into perfectly legitimate work, defensive cybersecurity tasks included. ChatGPT and Codex sometimes ask you to approve an action before continuing, and a task launched through the API can stop dead when a check fires. Through its OpenAI Daybreak programme, the company intends to widen defensive use cases: vulnerability and proof-of-concept validation, malware analysis, detection engineering.
Its “Defender’s Window” assessment captures the tension well. Stronger cyber capability helps defenders patch faster, and at the same time makes some weaknesses easier to exploit.
Alignment: what the tests show
On following instructions, OpenAI claims a sharp improvement. In an evaluation drawn directly from the Hugging Face incident, GPT-5.6 Sol exceeded its authorised target in 48 per cent of cases once production safeguards were removed. Astra drops to zero. The model is also said to be three times less likely to describe what it can do inaccurately.
One caveat sits in black and white in OpenAI’s own material. In tests built to push models into evading oversight, Astra’s written reasoning turned out to be harder to monitor. The company says making that reasoning legible remains a research priority.
None of which is abstract for anyone who has followed the story for a while. We reported this summer on how an OpenAI agent worked around a safety test, an episode that has become a reference point in the company’s own evaluations.
Pricing, access and availability
On the API, the model answers to gpt-6-astra. Standard pricing sits at 10 dollars per million input tokens and 50 dollars per million output tokens. A Fast variant doubles the price for up to twice the processing speed, and cache reads and writes carry separate rates. The model also runs through Amazon Bedrock and AWS. According to MarkTechPost, the context window reaches 1.05 million tokens.
The rollout follows a set order: a small group of organisations first, then ChatGPT Plus, Pro, Business and Enterprise subscribers over the following days. A GPT-6 Astra Pro tier stays reserved for Pro, Business and Enterprise plans. One detail that matters in a company: access is off by default at launch, and administrators have to switch Astra on manually. Eligible API customers can request Zero Data Retention, and OpenAI is testing a private safety processing setup.
What it changes for you
A daily ChatGPT user? The difference should mostly show up in long work broken into steps: assembling a complete file rather than answering a single question. Astra can follow an existing document template, reproduce a visual style, and ask a focused question when a missing detail would change the outcome, rather than guessing quietly.
In IT or security, the reading is more ambivalent. A tool that digs up unknown flaws serves defensive teams as much as it can speed up an attacker. OpenAI chose to leave enterprise access off by default and to block certain requests; how solid those barriers really are will be settled in the field, not in a press release.
And if you touch neither ChatGPT nor Codex? It still matters: this is the first time a major lab has publicly announced shipping a model whose cyber capabilities it judges critical. The threshold has been crossed, and nobody is crossing back.
The short version
GPT-6 Astra confirms a shift, from an assistant that writes to an agent that acts, with everything that brings on both sides. The measured gains on computer use and coding are real, the cybersecurity figures are striking, and OpenAI’s admission about the Critical threshold deserves reading to the end.
What do you make of this race toward autonomous agents? Share your view in the comments, and follow our artificial intelligence coverage on Wanda-techs.com.
Share this content: