Abstract:
A few hours before Astra was released, the AI community was in chaos. On the evening of September 3, ChatGPT, Claude and Grok experienced large-scale service abnormalities almost simultaneously. A large number of users either could not open the models or their requests failed. At this moment, the official ChatGPT account was looking up at the stars: "The stars are almost aligned."
Someone soon started joking: Did Astra hack both Anthropic and xAI during deployment, and didn't even spare itself in the end?
Of course, this is just a joke created by netizens. There is currently no evidence that this failure is related to Astra.
But this joke appeared at the right time - just two days ago, OpenAI had just announced that this new model, which has not yet been officially released, has become the company's first model to cross the "Critical" cybersecurity capability threshold of the Preparedness Framework.
Then the stars really fell into place.
In the early morning of September 4th, Beijing time, OpenAI officially released GPT-6 Astra.
But not all of them are online. Astra is currently only open to a small number of organizations in the Trusted Access/Daybreak system and audited network security users - Plus, Pro, Business, Enterprise and API users will have to wait and see for a few more days.
Astra is coming, but Tathagata
On September 4, OpenAI released GPT-6 Astra "internally".
Currently, Astra is only open to a small number of institutions in the Trusted Access/Daybreak system. OpenAI said that Plus, Pro, Business, Enterprise subscribers and APIs will gain access in the next few days.
As for how many days this "few days" actually is, there is no more specific timetable for the time being.
At a closed-door media briefing before the release, OpenAI President Greg Brockman gave Astra a rather exaggerated footnote: "Welcome to the AGI era."
Welcome to the AGI era.
Aidan Clark, vice president of research at OpenAI, explained why Astra is special from another perspective: "This is the first time that more than 100,000 GPUs have been used for pre-training at the Stargate site in Texas. From the data center network to the inference core to the shape of the model itself, everything is designed from scratch around this training scale."
Aidan also said that Astra is also OpenAI’s first product to allow old generation models to be deeply involved in the training process.
To put it simply, the people training the next generation of AI have already begun to appear in the previous generation of AI.
Although it is far from "AI trains itself", the model has entered the development process of the next generation model.
After Anthropic called Fable/Mythos 5.1 "the most advanced coding and knowledge working model in the world" the day before yesterday, today, OpenAI also called Astra "the strongest and most aligned model in the world."
In terms of benchmark testing, the most scary numbers come from ARC-AGI-3.
This is an Agent benchmark that specifically tests whether a model can enter a 2D environment it has never seen before, discover rules through continuous trial and error, and accomplish goals. It is not like a traditional exam that tests how much knowledge is memorized, but is closer to throwing the AI into an unfamiliar game to see if it can figure out "how the world works" on its own.
Astra achieved the highest score of 99.9% under OpenAI’s own Provider Adapter configuration.
But this number needs to be taken apart. ARC Prize also uses a set of Standard harnesses that all manufacturers can compare uniformly. Here, Astra tops out at only 62.7%.
The biggest difference between the two is not that the topic has been changed. OpenAI previously discovered that the reason why Sol scored low was not because the model was stupid, but because the harness continued to format its memory. Therefore, what OpenAI did was to replace the harness of ARC-AGI-3 with the production configuration of its own Responses API, and then specially prepare two special settings for ARC-AGI-3, namely retained reasoning and compaction. The former allows the model to remember its previous thoughts between actions, while the latter uses summary instead of rough truncation.
After connecting to this production system, Astra jumped from 62.7% to 99.9%. In tasks successfully completed by both parties, the Provider Adapter overall ran approximately 3.66 times faster and token consumption was reduced by 49%.
In a sense, it's quite like opening a plug-in.
In difficult math, FrontierMath Tier 4 is 97.6%. Epoch AI, where FrontierMath is based, said OpenAI funded the development of the benchmark and has exclusive access to some of its questions.
Scores worthy of attention include:
DeepSWE v1.1 74.1%
BenchCAD 95.9%
Terminal-Bench science task 64.6%.
But this time OpenAI obviously did not just rely on a row of benchmarks to introduce Astra.
When you open the official website, the cases are posted almost one after another.
KiCad, Excel, Blender, Power BI, browser form filling, website QA; then looking for a house, finding a doctor, making an appointment at DMV, making tax forms, making PPT, developing games, and analyzing scientific research data.
In the past few generations of GPT releases, OpenAI mainly told users what the model could answer; with Astra, its focus seems to have changed and became: How many things do you have left that can be directly handed over to AI.
OpenAI even directly called Astra "the best computer use model in the world."
The progress of the model in "using computers" may be more important than the score. In Codex, Astra brings a new context mechanism: instead of just compressing the summary when the context window is full, you can keep notes across windows and search for earlier messages and tool output.
Astra can also continue to work on the part that does not depend on the answer when a certain question is unresolved, so as to avoid a single unresolved question from blocking the entire task.
Of course, capabilities are also directly written into the price.
The standard API price of GPT-6 Astra is: USD 10 per million input tokens, USD 1 for cached input, and USD 50 for output.
Compared with GPT-5.6 Sol’s current $4 input, $0.4 cache and $20 output, the price of Astra’s entire range has been directly increased to 2.5 times. OpenAI's positioning for it is also very clear: If you don't know which flagship model to choose, you can choose Astra; if you care more about cost, continue to use GPT-5.6 Terra or Luna.
It still provides 1.05 million token context and a maximum 128,000 token output. But long context also has additional costs: like the GPT-5.6 series, when a single input exceeds 272K tokens, the input cost of the entire request will be calculated as 2 times, and the output will be calculated as 1.5 times.
So, OpenAI has actually set a more expensive smart tier for Astra.
If you just ask a question and change a few paragraphs of copy, it may not be worth spending 2.5 times the price.
But if the model can really sit in front of the computer, work continuously for dozens of minutes or even hours, and complete the entire task that used to require people to switch software, check information, fill out forms, and modify files, then what really needs to be compared is no longer just how much money per million tokens.
A few technical points worth noting
Astra also has several technical points that may be more noteworthy than the Benchmark itself.
The first is reverse engineering.
OpenAI cited SRE-Bench in this release. This is a set of reverse engineering benchmarks launched this year by teams such as Columbia DAPLab: the model source code is not given, only the compiled binary program is given to see if it can re-understand the program logic and find key behaviors.
Astra has a success rate of 88.0% in one attempt and 99.2% in up to four attempts.
Under the same set of rules, GPT-5.6 Sol is only 55.9% and 68.7% respectively.
In human terms, when faced with a program that has been compiled and has almost no human-readable code, AI is beginning to be able to "take it back" bit by bit from the machine instructions.
This has direct implications for malware analysis, firmware research, vulnerability mining and digital forensics.
The second change is that Astra "is no longer easy to find lost items" in extremely long missions.
In the MRCR v2 eight-pin retrieval test, Astra's accuracy reached 100% when facing contexts from 256K to 512K; when it came to 512K to 1M tokens, it still had 96.3% accuracy. However, GPT-5.6 Sol only has 91.5% and 73.8% in these two intervals respectively.
In the past, many models claimed to support millions of contexts, but if an important piece of information is buried outside hundreds of thousands of tokens, the model may have almost forgotten it in the second half of the process.
Astra began to push "how big the context window is" to another more practical question: how long can an agent remember what happened before.
For an Agent that needs to work continuously for dozens of minutes or even hours, this may be more important than adding hundreds of thousands more token windows.
In addition, Astra has another unusual change.
It becomes more aligned, but also harder to monitor.
In a set of internal computer usage security tests published by OpenAI, Astra's violation rate dropped from 22.0% in Sol to 2.4%; in a test that specifically observed whether the model would bypass restrictions in order to complete the task, Astra's was 0%. The internal hallucination test also dropped from 9.4% on Sol to 2.0% on Astra.
At least according to OpenAI's own tests, Astra is significantly less "chaotic". But OpenAI chief scientist Jakub Pachocki also reminded: "The progress of intelligence does not guarantee the progress of alignment."
One of the reasons is that Astra began to write out his complete thinking process less and less.
A very important AI security method in the past was to monitor the chain of thought of the model: if the model was going to overstep its authority, attack a certain system, or secretly change its goals, you could see clues in its reasoning in advance.
But OpenAI found that Astra had greater control over its written reasoning. Some problems that in the past had to be solved by writing many steps can now be solved with less explicit reasoning; if the model knows that its thinking process is being monitored, these contents will be significantly changed or shortened.
Therefore, OpenAI can no longer just focus on the thinking chain.
In order to keep an eye on Astra and prevent it from committing the same attacks that appeared on Sol before, OpenAI installed "misalignment monitoring" in the production environment. It simultaneously observes the model's reasoning, actual actions, tool calls, and the entire task trajectory.
If the system determines that the model may be seriously deviating from the user's original intention, it can pause or even terminate the task directly.
In the API, the intercepted task may end directly; in ChatGPT or Codex, in some cases the user will be asked to reconfirm first:
"Is this really what you want me to do?"
At the product level, Astra’s API model name is directly gpt-6-astra, and it also enters Amazon Bedrock.
OpenAI also launched Fast mode: the price is doubled, and the maximum execution speed is about 2.5 times.
For casual chatting, this may not be attractive. But if an Agent originally needs to run in the browser and software for 40 minutes, and the time is reduced to ten or twenty minutes, the speed itself will become part of the product's capabilities.
On the subscription side, Astra will be included in the existing subscription quota; Pro, Business and Enterprise will also get the more powerful Astra Pro. Enterprise will not be turned on directly by default and needs to be turned on manually by the administrator.
Although, it can’t be opened yet...
Complex history, limited opening
Astra may be OpenAI’s most “historical” model release to date.
Many models are released first and then slowly expose problems, but Astra does the opposite - of course, some marketing methods are not ruled out. But before it was officially launched, OpenAI had spent nearly a month constantly explaining why it needed to be trained, tested and opened more carefully.
On August 7, OpenAI publicly stated for the first time that the latest internal assessment has made it impossible for the company to rule out the possibility that Astra has reached the "Critical" cybersecurity capability threshold under the Preparedness Framework.
On September 1, this "possibility" became a formal conclusion: Astra became OpenAI's first model rated as Critical in network security capabilities.
According to OpenAI's own standards, this means that with the right tools and access rights, Astra has been able to independently discover previously unknown vulnerabilities and develop available exploits in many hardened real-world systems without the need for step-by-step human guidance; or it can design and execute a set of end-to-end attack strategies against hardened targets by just giving it a high-level target.
This is no longer just a level of "being able to write attack code". On ExploitBench, Astra directly scored 100%.
In order to prevent the model from only memorizing public vulnerabilities, OpenAI prepared another set of internal tests and put in 20 V8 high-risk vulnerabilities that were only disclosed from June to August 2026. Astra not only uses fewer output tokens than GPT-5.6 Sol, but also achieves a significantly higher arbitrary code execution success rate.
During the test, it even discovered and exploited two previously unknown zero-days and linked them into an exploit chain. OpenAI said it is currently disclosing these two vulnerabilities to maintainers.
Expert testing is closer to real-life attacks. Faced with a hardened browser, Astra can escape from the sandbox all the way after finding unknown vulnerabilities and execute commands on the host machine; on the hardened operating system, it strings together multiple vulnerabilities into a local privilege escalation chain to obtain root privileges from ordinary users.
It was during this process that OpenAI discovered for the first time that the dangerous capabilities of the model had begun to affect how the model itself should be trained.
On August 18, OpenAI publicly admitted that the company had temporarily suspended the expansion of training scale, including suspending the latest model reinforcement learning training planned for deployment for two weeks.
At the same time, a large number of training and evaluation tasks involving Astra continue to be suspended because they have not yet been migrated to the new secure environment.
In the past, when discussing AI safety, we mostly asked whether the model could be safely handed over to users after training; but here at Astra, the problem has been advanced to the training stage.
OpenAI therefore re-hardened the entire research environment. The task of executing model generation code requires stricter sandboxing; high-risk workloads require stronger network isolation; Astra checkpoint adds encryption and access control; all Astra inference with tools is subject to additional monitoring.
This set of monitoring itself is not even cheap. OpenAI estimates that the computing overhead caused by the monitoring system alone is equivalent to approximately 20% of the inference computing power being monitored.
In other words, the cost of Astra is not only "training a larger model", but OpenAI also spends a considerable amount of additional computing power to keep an eye on what the model is doing.
This also explains why, after Astra was officially released, the most advanced network security capabilities were not directly released to everyone.
OpenAI made it clear that the default production version of Astra will still set limits on high-risk network attack requests; more advanced network security workflows will initially be open to a small group of Alpha testers, and then gradually expand to audited defensive users through Daybreak Blue.
Although ordinary users will also get Astra in the next few days, it does not mean that everyone will get exactly the same capabilities.
Such restrictions may even cause accidental injuries. OpenAI warns in advance that additional security checks may slow down, suspend or even stop normal tasks. Even some long-term Agent tasks that appear to have nothing to do with network security may also be mislabeled.
If tasks in ChatGPT or Codex are suspended by misalignment monitoring, the user may need to come back to confirm the operation before continuing; tasks in the API may be terminated directly.
This part of the change was easily overshadowed by the "AGI" after the release of Astra.
The more capable the model is, the more capabilities a person can directly obtain, it starts to depend more and more on how much authority the platform is willing to give you.
Then, after such a series of "Critical, suspension of training, isolation, monitoring, and graded opening", Greg Brockman said at the media briefing on the release of Astra: "Welcome to the AGI era."
He even said that if he were to judge personally, he thought "we have achieved it."
But when asked, "Has OpenAI officially announced the implementation of AGI?" Brockman admitted that AGI has become a "gray, fuzzy thing", more like a "mission concept" or "spiritual concept" rather than a technical standard that can be accurately drawn.
Earlier, in "Sources Podcast", Altman was reluctant to seriously discuss the issue of "when will we implement AGI". He believed that the term AGI was "at best, a very vague concept" and even almost called it an "insignificant marketing term."
The reason is not that OpenAI is further away from AGI. On the contrary, it is because in Altman's judgment, AGI may not be that important anymore.
What he really started to worry about was the next word: Superintelligence.
Altman said that a year ago, he did not believe OpenAI was on a short-term trajectory toward superintelligence. Now, he thinks it "could happen."
But I still want to complain, isn’t ASI an “insignificant marketing term”?
Comments