OpenAI Ships GPT-6 Astra, Its First Model Rated at Critical Cybersecurity Capability
OpenAI released GPT-6 Astra this week, a model that pushes beyond text generation into direct software interaction. The company describes it as the first model in its lineup purpose-built for computer use, coding, and professional workflows. It is available initially to a limited set of organizations and will roll out to ChatGPT Plus, Pro, Business, Enterprise users, the OpenAI API, Microsoft Azure, and AWS Bedrock.
The model's headline number is its performance on OSWorld 2.0, a benchmark for evaluating AI agents operating full desktop environments. Astra scores 72.6%, up from 65.7% for GPT-5.6 Sol. That gap represents a meaningful jump in the model's ability to navigate graphical interfaces, fill forms, update CRM records, conduct browser research, and install and test software.
Coding Benchmarks and the Context Note Mechanism
On Terminal-Bench 4.0, Astra scores 57.9%. On DeepSWE v1.1, it reaches 74.1%. Both numbers matter, but the more interesting development is a new experimental feature in Codex: persistent notes across context windows. Instead of relying on compaction to preserve state during long coding tasks, the model can maintain separate notes and search back through earlier context windows. The practical effect is that during a multi-hour coding session, Astra can retrieve the exact requirements, test results, or tool outputs from steps that happened thousands of tokens ago without the information getting compressed into a summary that loses nuance.
Astra supports contexts up to one million tokens, scoring 96.3% on MRCR evaluations in the 512K-to-1M range. That is a large enough window to hold an entire codebase plus its test suite plus a conversation history about architectural decisions.
Critical Cybersecurity Classification
The most consequential detail in the release is the cybersecurity classification. Astra is the first OpenAI model rated at the critical capability level under the company's Preparedness Framework. In testing without production safeguards, the model found and exploited two previously unknown vulnerabilities. It also demonstrated the ability to build exploits against hardened browsers and operating systems.
OpenAI is restricting the production version from performing advanced offensive tasks, but the company plans to expand defensive capabilities through its Daybreak program. The gap between what the model can do in a lab and what the production version is allowed to do is worth watching. It tells you where the capability frontier is moving even as the guardrails get tighter.
Hallucination Rates Drop, Monitorability Gets Worse
Internal evaluations show Astra hallucinating at 4.2%, down from 12.2% for GPT-5.6 Sol. That is a substantial reduction in fabricated output, and it matters for any deployment where factual accuracy is non-negotiable.
On the other hand, the company found Astra's written reasoning harder to monitor than its predecessor. In tests designed to measure whether a model could obscure its own reasoning chain, Astra performed worse than the previous generation. OpenAI flagged this as an active research area, which is a polite way of saying the model is getting better at being opaque about how it arrives at answers. For anyone building safety tooling on top of OpenAI models, that is a problem that will not solve itself.
The Competitive Landscape
Astra goes up against Anthropic's Claude Fable 5.1 and Google's Gemini 3.8 Flash. The benchmarks split the differences. Astra leads on Terminal-Bench 4.0 and several computer-use evaluations. Claude Fable 5.1 scores higher on Humanity's Last Exam, a benchmark designed to test deep domain knowledge across expert-level questions. Gemini 3.8 Flash supports native video and audio input, something Astra does not offer.
The Nvidia angle is also worth noting. Jensen Huang disclosed that Astra was trained on roughly 100,000 NVIDIA Grace Blackwell NVLink72 systems. That is a significant infrastructure commitment, and Huang used the announcement to push the AGI framing, writing that "AGI has arrived." Alex Finn echoed that framing on social media. Whether or not you buy the AGI label, the training infrastructure behind this model is a signal about where the next generation of systems will land computationally.
The model supports database migrations, CAD generation, data science workflows, and scientific computing as professional use cases. Whether any of those workflows actually benefit from a model that can interact with desktop software directly, as opposed to generating code that a human runs, is the question that will determine whether Astra's computer-use capabilities are a genuine product shift or a benchmark exercise.