Launched by OpenAI on September 3, 2026, GPT-6 Astra combines reasoning, tool use and control of digital interfaces to carry out tasks that go beyond simply producing text. The published results show significant progress in computer use, professional work and cybersecurity, but they remain dependent on the tools, protocol and effort level chosen. The central question is therefore less whether the model can act than under what conditions an organization can delegate an action to it without losing control over the outcome.
What OpenAI actually launched
OpenAI presents GPT-6 Astra as its most capable model for end-to-end work. The model can take text and images as input, produce text, call functions and use tools for search, file analysis, code execution, terminal and computer use. OpenAI cites examples such as filling out forms, updating a CRM, organizing a calendar, searching online, creating documents, analyzing scientific data and testing interfaces.[1][2]
The announced rollout covers ChatGPT Plus, Pro, Business and Enterprise, as well as the OpenAI API, Microsoft Azure and Amazon Bedrock. Access is disabled by default in Enterprise workspaces at launch and must be enabled by the administrator. In the API, the published standard rate is $10 per million input tokens and $50 per million output tokens. Priority processing is billed at twice the standard rate.[1][2]
These terms matter as much as the model’s capabilities. A demonstration carried out in an environment equipped with numerous tools does not automatically reflect the experience of a user in ChatGPT, nor that of a company that has restricted connectors and permissions. Astra is the decision engine, while the agentic system provides the environment, access, execution rules and control mechanisms.
What is actually new
GPT-6 Astra invents neither tool calling nor computer use by AI. Agents could already browse, run code and chain multiple operations. The announced progress lies in the combination of three dimensions: a better understanding of objectives, more reliable execution in complex interfaces and the ability to carry out long tasks using fewer steps or tokens.
This combination narrows the gap between a useful answer and a directly usable result. A conversational model can explain how to update a customer file. An agent connected to a CRM can identify the relevant record, propose the change, apply it if its permissions allow, then check the final state. The difference therefore does not come solely from the model. It comes from the shift from content generation to a chain of actions executed in a real environment.
The novelty must nonetheless be qualified. OpenAI publishes high scores, but several evaluations use the maximum reasoning level, a specific harness and substantial budgets. The capabilities observed under these conditions do not guarantee the same reliability in every application, especially when the interface changes, the data is incomplete or an instruction is open to several interpretations.[1][5]
MSc Generative AI
and Agentic AI
Become an expert in generative and agentic AI: LLMs, transformers, enterprise deployment. Silicon Valley learning trip included. RNCP Level 7 certification (Bac+6).
How Astra acts in a digital environment
An Astra-based agent works in a loop. It interprets the objective and the state of the environment, chooses an action, uses a tool, observes the result, then decides whether to continue, correct its course or ask for clarification. A task that is simple for the user can thus produce a long sequence of clicks, searches, reads and checks.
Take the preparation of a sales meeting. The system can search for public information about the company, consult authorized internal documents, extract the relevant details from the CRM, write a summary and place it in a document. Each step, however, depends on prior configuration: accessible sources, read or write permissions, confirmation conditions and data retention rules.
This distinction avoids attributing to the model an autonomy it does not have on its own. Astra does not spontaneously have access to the browser, terminal, files or business applications. It acts only through the tools that the product or developer connects to it. An organization can therefore significantly reduce risk by limiting these tools, even if the model remains technically capable of broader tasks.
Technology Framework
| Capability or constraint | What to understand |
|---|---|
| Context | Announced window of 1,050,000 tokens, with higher pricing beyond 272,000 input tokens. |
| Output | Up to 128,000 tokens. Long trajectories can increase cost, duration and the surface for errors. |
| Reasoning | Five effort levels: low, medium, high, xhigh and max. The best published scores often use the best-performing setting observed. |
| Modalities | Text and image input, text output. Audio and video are not directly supported by the documented model. |
| Tools | Web search, file search, code interpreter, hosted terminal, file editing, computer use, MCP and tool search. |
| Customization | Fine-tuning is not supported according to the documentation consulted. Behavior depends mainly on instructions, tools and the execution environment. |
| Access | ChatGPT Plus, Pro, Business and Enterprise, OpenAI API, Azure and Amazon Bedrock. Enterprise activation is disabled by default at launch. |
| Knowledge | Announced cutoff date of April 30, 2026. Web search or connected sources are still needed for more recent information. |
Why this development matters for work
The main consequence concerns compound tasks. Digital work rarely relies on a single application. Research must be cross-checked against internal documents, an analysis must be formatted, and its result must then be shared or integrated into business software. An agent capable of moving through these steps can reduce intermediate handling and the number of requests needed.
This development first affects chains of actions, not jobs taken as homogeneous blocks. In human resources, marketing, finance, project management, research or administration, certain operations can be entrusted to an agent while interpretation, judgment calls and accountability remain human. The gains will therefore depend on how tasks are broken down and where validation is required.
For employees, expertise is partially shifting toward delegation. They need to know how to formulate a verifiable objective, provide useful context, restrict access, identify sensitive decisions and check the result. This shift does not eliminate domain knowledge. It makes it essential for spotting inconsistent data, an unnecessary action or a plausible but incorrect conclusion.
For the company, the benefit cannot be reduced to speed. A faster agent that is difficult to audit can increase operational risk. The evaluation must include the end-to-end success rate, cost per task, the frequency of human intervention, the quality of logs, recovery after errors and the consequences of an incorrect action.
MasterAgentic AI
with Claude Cowork
Move from conversational AI to operational AI. 2 days to automate your complex tasks — no technical skills required.
What the results actually support
The published results place Astra ahead of GPT-5.6 Sol on several evaluations of agentic work, science and cybersecurity. They show progress in the system tested, but not general superiority across all uses. OpenAI specifies that its tables report the best score obtained across effort levels and that the research environment may differ from ChatGPT in production.[1]
| Evaluation | GPT-5.6 Sol | GPT-6 Astra | Cautious reading |
|---|---|---|---|
| OSWorld 2.0 | 65.7% | 72.6% | Progress on an offline subset with partial scoring. The result does not mean that 72.6% of real-world tasks are completed without error. |
| Agents’ Last Exam | 53.6% | 59.3% | Improvement on complex professional tasks, with about four in ten tasks still unresolved under this protocol. |
| AutomationBench | 18.1% | 41.4% | A significant gain, but the score remains below half of the benchmark’s maximum. |
| FrontierMath Tier 4 v2 | 83.0% | 97.6% | A very high result in the published evaluation, without demonstrating general mastery of all mathematics. |
| ARC-AGI-3 | 7.8% | 99.9% | The best score depends on a Provider Adapter. ARC Prize reports 62.7% with its standard harness and 99.9% with the provider adapter. |
| ExploitBench | 78.5% | 100% | The test covers known vulnerabilities. On a more recent internal port, OpenAI reports 39.0% for Astra and 5.5% for Sol. |
The ARC-AGI-3 case illustrates the need to read the protocol before the score. ARC Prize confirms that the model reaches 99.9% with an adapter that preserves an opaque reasoning state between requests and applies conversation compression. With the organization’s standard harness, Astra scores 62.7%. Both results are high, but they do not measure exactly the same system.[5]
OSWorld 2.0 targets long workflows carried out in real applications. The benchmark includes 108 tasks that take a median human user about 1.6 hours. Its design is closer to real work than simple question-and-answer tests, but it remains a controlled environment with defined conditions, applications and scoring methods.[6]
Permissions become a central issue
The more an agent can act, the more important the separation between capability and authorization becomes. A model may know how to send a message, modify a database or run a command without having to be granted the right to do so in every context. The principle of least privilege must therefore apply to agents just as it does to human accounts and software services.
A cautious architecture starts with limited read permissions, allowlists of authorized actions and isolated environments. Financial transactions, deletions, external publications and production changes should trigger human confirmation. Logs should record the request, the tools used, the data accessed, the actions executed and the approvals received.
Indirect prompt injection remains a significant risk. A web page, document or message read by the agent may contain an instruction designed to hijack its course. OpenAI claims that Astra is more resistant to these attacks than its predecessors, but its system card does not present the problem as solved. OWASP also lists excessive agency among the vulnerabilities that can turn an ambiguous or manipulated output into a harmful action.[3][8]
Organizations must also plan for failure. An operational agent needs a kill switch, spending limits, a maximum number of steps, rollback to the previous state where possible and a clear procedure for escalation to a human. Oversight should not come into play only after an incident. It must be built into the design of the workflow.
MSc Generative
and Agentic AI
Become an expert in generative and agentic AI: LLMs, transformers, enterprise deployment. Silicon Valley learning trip included. RNCP Level 7 certification (Bac+6).
Cybersecurity puts Astra in a category of its own
OpenAI rates GPT-6 Astra at the “Critical” level for cybersecurity capabilities under its own Preparedness Framework. This rating means that, with the appropriate tools and access, the model can search for unknown vulnerabilities and develop exploitation methods against protected systems without human guidance at each step. It is an internal capability threshold, not a public certification issued by a regulator.[3][4]
The 100% score on ExploitBench should be considered alongside another figure published by OpenAI. To limit the risk of contamination from known examples, the company built an internal port based on twenty recent vulnerabilities. Astra reaches 39% on it, while discovering two zero-day vulnerabilities used in an exploit chain. This difference shows that a saturated benchmark can mask a still significant difficulty on recent cases.[1][4]
OpenAI describes a defense-in-depth approach based on safety training, real-time monitoring, actor controls, trusted access, checkpoint encryption and trajectory tracking. The system card nevertheless acknowledges a worrying limitation: the controllability of internal reasoning has decreased compared with GPT-5.6 Sol, and Astra is less likely to leave incriminating clues in its chain of thought. Monitoring observable actions therefore becomes at least as important as analyzing the reasoning produced.[3]
The dual-use nature is clear. The same capabilities can help a defensive team discover a flaw and facilitate an attack if they are combined with malicious objectives or access. Responsible evaluation cannot be limited to the technical quality of the model. It must examine who is using it, on which systems, with which tools, under what oversight and with what ability to interrupt it.
What to watch now
The first question concerns reliability in production. Useful feedback will need to measure tasks actually completed, silent errors, human interventions and the ability to recover from a bad action. Successful demonstrations are not enough to decide whether an agent can take part in a financial, legal, medical or industrial process.
The second question concerns total cost. Token pricing does not always include tool calls, execution infrastructure, monitoring, rework and the time spent on validation. An automation can appear cost-effective at the model level while remaining expensive if it requires constant supervision or produces errors that are hard to detect.
The third question concerns how work is organized. Companies will need to determine which tasks should remain learning opportunities for employees, which decisions require human judgment and how to allocate responsibility when an agent prepares or executes an action. NIST recommends embedding risk identification, measurement, governance and management throughout the system’s life cycle, according to the context of use.[7]
GPT-6 Astra gives more concrete shape to agentic AI, but its real impact will depend less on the number of software applications it can operate than on the quality of the limits surrounding its actions. The decisive indicator will be organizations’ ability to achieve measurable time savings while maintaining explainable decisions, reversible actions and identifiable human accountability.
Further reading
To take the analysis of agentic AI, workplace automation and the governance of systems capable of acting further, explore these articles from the aivancity blog.
Sources
[1] OpenAI, September 3, 2026. GPT-6 Astra: A New Generation of Intelligence. View the source
[2] OpenAI Developer Documentation, accessed September 27, 2026. GPT-6 Astra Model. View the documentation
[3] OpenAI, September 3, 2026, updated September 22, 2026. GPT-6 Astra System Card. View the System Card
[4] OpenAI, September 1, 2026. Path to Astra: Critical Capabilities and Frontier Safeguards. View the source
[5] ARC Prize Foundation, September 3, 2026. OpenAI’s GPT-6 Astra on ARC-AGI-3. View the source
[6] Yuan, M. et al., 2026. OSWorld 2.0: Benchmarking Computer Use Agents on Long-Horizon Real-World Tasks. View the study
[7] NIST, updated April 8, 2026. Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. View the publication
[8] OWASP GenAI Security Project, accessed September 27, 2026. LLM06:2025 Excessive Agency. View the source