What is GPT-6 Astra?

On Thursday, 3 September 2026, OpenAI introduced GPT-6 Astra, which it presents as a new generation of its models. The company's announcement leads with work, not chat: Astra is pitched as a model that can operate a computer, filling in web forms, updating customer records, organizing a calendar, running checks on a website it built, and installing and testing software. OpenAI also calls it its most aligned model so far, meaning the one that best sticks to what the user actually intended.

Astra arrives with an unusual label. OpenAI says it meets the Critical threshold for cybersecurity under its Preparedness Framework, the internal system the company uses to rate how dangerous a model's abilities could be. That rating shapes almost everything about how Astra is being released.

What Astra can do

The headline is computer use: the model looks at a screen and works through software the way a person would, clicking, typing and checking results. OpenAI reports that on OSWorld 2.0, a test of real computer tasks, Astra scored 72.6% in about 40 minutes per task, while its previous top model, GPT-5.6 Sol, scored 65.7% in about 75 minutes.

OpenAI also highlights:

• Office work. Documents, spreadsheets and slide decks that follow your templates and style.
• Coding. OpenAI calls Astra its best software engineering model to date. In Codex, an experimental feature lets Astra keep notes across long sessions instead of repeatedly squeezing its history into a summary.
• Judgment on vague requests. When instructions leave gaps, Astra fills routine ones from context and saves its questions for points that would change the result.
• Math and science. OpenAI says Astra helped produce new results on gaps between prime numbers, and it has published the proofs.

As always, these are the company's own figures. Outside testers will need time to confirm them.

Who can use it, and what it costs

OpenAI says Astra is rolling out first to a limited set of organizations, then over the coming days to ChatGPT Plus, Pro, Business and Enterprise subscribers and to developers through the API. Pro, Business and Enterprise users also get Astra Pro, a stronger variant. In Enterprise workspaces, Astra is switched off at launch until an administrator turns it on. Free accounts are not on the list.

For developers, the model is called gpt-6-astra and is priced at $10 for every million tokens sent in and $50 for every million tokens it writes. A "fast mode" runs up to twice as quickly at twice the price. Eligible API customers can use Zero Data Retention, meaning OpenAI doesn't store their prompts and outputs.

A clear task description helps an agent like this as much as it helps a person:

Open the spreadsheet "Sample orders.xlsx". Sort it by order date, highlight any row where the total is over $500, and add a summary row with the count and sum of those orders. Don't change any other cells. Before saving, show me what you changed.

Why is access to GPT-6 Astra limited?

The main reason is cybersecurity. OpenAI tested Astra without its production safeguards on benchmarks that ask a model to turn known software flaws into working attacks. It scored 100% on ExploitBench; GPT-5.6 Sol had managed 78.5%. When OpenAI tested it on vulnerabilities disclosed in the previous three months, to rule out memorized answers, Astra discovered and used two previously unknown flaws, called zero-days; OpenAI says it is disclosing both to the affected software makers. That ability could help defenders find and patch weaknesses faster, but it could equally help attackers.

So the public version comes with limits. Astra will help with defensive work such as secure code review and patching, but it refuses more advanced offensive tasks, such as writing proof-of-concept exploits. OpenAI says vetted security teams will get looser access in the next few weeks through a program named OpenAI Daybreak.

There is a second reason. OpenAI reports that, compared with GPT-5.6 Sol, Astra's written reasoning is more difficult to monitor in tests that asked it to hide its intentions, and it says it takes that decline seriously. To compensate, it is running classifiers that check the model's reasoning and actions in real time and can pause or stop work that looks unauthorized. OpenAI warns that these checks will sometimes interrupt legitimate tasks: in ChatGPT and Codex you may be asked to review an action, and in the API the task simply stops.

Not everyone reads the "Critical" label the same way. An analyst quoted by InfoWorld argues that it reflects a change in testing rather than a change in the model, since OpenAI said in August that it could not rule out Critical capability before confirming it on 1 September. Either way, the staged rollout is the practical result: more capability, released more slowly, with more watching.