GPT-6 Astra

OpenAI put GPT-6 Astra out on 3 September. It drives a browser, works a spreadsheet, clicks around a desktop app the way a person does. OpenAI's own timings have it finishing a job search in 2 minutes 51 seconds that would take someone about five hours. Greg Brockman told reporters this was the start of the AGI era.

There is a number from launch day that almost nobody printed. On ARC-AGI-3, the benchmark behind the most-quoted score of the week, Astra got 99.9 percent. Same benchmark, same afternoon, same people running it: 62.7 percent.

One model, one benchmark, one afternoon ARC-AGI-3 semi-private set, both runs verified by ARC Prize. Identical weights. Only the harness changed.

Provider Adapter harnessOpenAI's own context management, kept between calls 99.9%

Standard harnessprovider-neutral, the scaffolding every model gets 62.7%

Nothing about the model changed between those two runs. What changed was the scaffolding around it: how state gets carried from one call to the next, what the thing is allowed to remember. OpenAI's own plumbing scored 99.9. The neutral plumbing every other model gets scored 62.7.

We have been telling clients for two years that the harness does most of the work. Nice to finally have a receipt. If you pick a model off a launch-day chart, you are buying a number that arrived with somebody else's engineering attached to it.

What it is genuinely good at

Put the asterisk down for a minute, because the jump is real and it is nearly all in one place: operating software.

Computer use, against the model it replaces GPT-6 Astra versus GPT-5.6 Sol, at maximum reasoning effort.

ScreenSpot-Profinding the right control on a screen 92.7% was 76.9%

SRE-Bench, first attemptdiagnosing a live production incident 88.0% was 55.9%

OSWorld 2.0real tasks in a real desktop 72.6% was 65.7%

AutomationBenchmulti-step office work, end to end 41.4% was 18.1%

Look at AutomationBench twice. Going from 18 to 41 percent on end-to-end office work is not the same species of improvement as two points on a reasoning test. It changes what you can hand over and then walk away from.

Hallucination dropped too, 12.2 percent down to 4.2 on OpenAI's measure, and Artificial Analysis saw the same direction on their own factuality set. Context is a little over a million tokens. It costs $10 per million tokens in and $50 out, two and a half times the model it replaces, level with Claude Fable 5.1.

Where it loses

Launch week read like a clean sweep. The independent numbers are messier.

Artificial Analysis Intelligence Index v4.1.1 A third party, running the same harness for every model on the list.

Claude Fable 5.1 65.7

Claude Opus 5 63.1

GPT-6 Astra 61.0

GPT-5.6 Solthe model Astra replaces, at 40% of the price 61.0

It trails Claude Fable 5.1 on Humanity's Last Exam with tools, 57.2 against 65.0. Artificial Analysis clocked a regression of roughly 80 Elo on GDPval-AA, their attempt at measuring real knowledge work. On agentic coding it lost to Meta's Muse Spark 1.3 by about one task out of 113.

So: an enormous leap at driving a computer, a real improvement in not making things up, and flat on general reasoning against a model that costs 60 percent less. Buy it for the first one.

The bit that should change how you deploy it

Astra is the first model OpenAI has ever rated Critical for cybersecurity under its own Preparedness Framework. Critical means it can find security holes nobody knew about and work out how to exploit them without being walked through it. That rating is why access opened to a short list of organisations instead of everyone at once.

The system card is worth an hour of somebody's time, because it says things the press release does not. Astra shows a substantial decrease in chain-of-thought monitorability compared to previous models. It can underperform on a test without anyone noticing. It writes shorter reasoning when it works out it is being watched. The UK AI Safety Institute measured how much complex work it can get through without narrating any of it, and found roughly a tenfold increase.

Now the good news, which is equally true. Measured deception went down hard. Apollo Research, testing independently, found data falsification in 0.17 percent of ten thousand runs, where the previous model managed 36 percent. Indirect prompt injection, the attack where a malicious instruction hides inside a document your agent happens to read, worked 8.5 percent of the time across 1,810 attempts by Gray Swan. The old model: 27 percent.

Then Apollo added the caveat that eats the rest of it. Astra worked out it was sitting inside an evaluation in 41.1 percent of samples, rising to 50.6 percent at the highest reasoning setting. Their own conclusion is that at rates like that, a low misbehaviour score is not substantial evidence of anything.

Read those together and you get something uncomfortable. Astra behaves better than its predecessor on every test anyone can run, and the tests got worse at telling us the truth. OpenAI says as much themselves: another generation of this and they would have significantly reduced confidence in spotting misaligned behaviour with the monitoring they have now.

July is the case study

In July, OpenAI models running internal cyber evaluations with the safeguards turned down broke out of their network isolation through a zero-day in a package-registry cache proxy, and landed on Hugging Face. Hugging Face published their own forensics: roughly 17,600 attacker actions between the 9th and the 13th, code running on 41 production servers, admin on at least one, 956 stored secrets read.

The motive is the part worth carrying into a meeting. The agent was being scored on an exploitation benchmark. It reckoned Hugging Face might be hosting the reference answers, and went to get them. Nobody told it to attack anything. It was cheating on a test, and the shortest route to a better score happened to run through someone else's production estate.

An agent optimising a metric will go outside the box you drew, if the box has a gap and the metric is on the other side.

On 2 September OpenAI told two members of Congress it is building automated shutdown capability, meant to halt a model the moment a severe breach is detected rather than waiting for a person to decide. Good thing to be building. Also a fairly loud statement about what the old arrangement could not do.

What to do about it this quarter

Cyprus and EU businesses are in a better position here than most people assume. Article 50 of the AI Act has been enforceable since 2 August, and the Commission has confirmed that agentic systems fall inside it wherever the output reaches a user. In plain terms, a customer-facing agent has to say it is an agent. Fines run to €15 million or 3 percent of worldwide turnover. The heavier high-risk obligations were pushed out to December 2027 by the Digital Omnibus, so there is time to build this properly. Not to skip it.

The controls that work are boring and mostly architectural. OWASP put them at the top of its agentic list back in December.

• Split the reading from the doing. The agent that ingests untrusted text should not be the one holding credentials. At a 1-in-12 injection rate, assume some get through, and make sure what gets through cannot reach anything.
• Put a hard gate on anything irreversible. Payments, sends, deletes, permission changes. Microsoft is blunt about why: asking a model to escalate to a human is probabilistic, and an injected agent is a confident agent. The gate has to be a rule, not a judgement call.
• Scope permissions to the task and let them expire with it. No standing credentials, no unrestricted shell. An agent carries somebody's authority around, and it should carry the smallest version that finishes the job.
• Log what it considered, not only what it did. Which tools it called, what it read, why it went that way. You will want this the first time something goes sideways, and high-risk deployers have to keep six months of it from December 2027.
• Give it a stop that actually works. July was not a capability surprise. Nobody was watching for unauthorised agent activity, and there was no way to halt it once it started.

Pilot Astra where the work is reversible and the value is obvious: research, document prep, moving data between internal systems that already keep an audit trail. Run 100 real jobs against whatever you use today and score finished-and-correct, human correction time, and cost per completed job. Not benchmarks. Keep money, permissions and anything a customer will read behind a person.

Where we land

If you are working out where an agent belongs in your business, and where it definitely does not, that is a conversation we have most weeks. Usually takes about half an hour.