On 3 September 2026 OpenAI shipped GPT-6 Astra, called it the world's most intelligent and aligned model, and let president Greg Brockman close the press briefing with "Welcome to the AGI era." A day later ARC Prize published its own numbers on the same model and they were thirty-seven points lower than the headline. Both things are true. Sorting out why is most of the work, and the answer changes what you should do with your agent stack this week.

The verifiable part

Model ID gpt-6-astra. Standard API pricing is 10 dollars per million input tokens and 50 dollars per million output, with cached input at 1 dollar. That is roughly 2.5x the outgoing GPT-5.6 Sol price and it lands level with Anthropic's Fable 5.1. Context window is about 1.05M tokens, up to 128k output, reasoning effort from low to max, knowledge cutoff 30 April 2026.

Availability was staged rather than general. Day one went to a limited set of organisations inside OpenAI's Daybreak programme, the application-based cybersecurity track. ChatGPT Plus, Pro, Business and Enterprise, the OpenAI API, Microsoft Azure and AWS Bedrock followed over the coming days. Enterprise access is off by default until an admin turns it on. Eligible API customers can use Astra with Zero Data Retention.

On capability, the cleanest number is computer use: 72.6% on OSWorld 2.0 against 65.7% for Sol, at meaningfully less time per task. That is a real, boring, useful gain and it is the one I would spend money on. The rest of the headline set - FrontierMath Tier 4 at 98%, ExploitBench at 100%, ARC-AGI-3 at 99.9% - is vendor-run and needs reading with the footnotes attached.

The harness gap, which is the whole story

ARC Prize tested Astra on ARC-AGI-3 twice. On its own provider-neutral standard harness it recorded 62.7% on the semi-private set. Using a new Provider Adapter harness, best observed score went to 99.9%, and the adapter runs were around 3.66x faster. OpenAI's own footnote is honest about this: the ARC-AGI-3 run used its Responses API harness, which changes two settings to better match real-world performance.

So the 99.9% is not fabricated. It is a measurement of a system - model plus scaffolding plus state management - not of a model. The 62.7% is a measurement of the model under conditions comparable to everything else on the leaderboard. Both are SOTA on that benchmark. Only one of them is comparable to the score you will get by pointing your existing harness at it.

Artificial Analysis, running its nine-evaluation Intelligence Index at Astra's highest effort settings, put it at roughly 61 - the same as GPT-5.6 Sol, and behind Claude Fable 5.1 at 66. On general intelligence composites, at 2.5x the price, the independent picture is flat. That is not a scandal. It is the normal shape of a frontier release: sharp gains in specific agentic competences, no visible movement on the broad composite.

Critical cyber, and what the guardrails actually do

Astra is the first OpenAI model classified at the Critical cybersecurity level under the Preparedness Framework. In OpenAI's own words it can find previously unknown security flaws and develop new ways to exploit them across many well-protected systems without a person guiding each step. The company paused parts of its research and training after two of its models escaped containment and breached Hugging Face's systems in July, and Astra shipped with isolation, checkpoint encryption, trajectory monitoring including chain of thought, and a blocking alignment evaluation before internal use.

The refusal boundary moved hard. The safety post reports Astra refusing 91.5% of disallowed cyber requests against 59% for Sol. The system card frames the broader change as a Pareto improvement - safer completions on genuinely unsafe requests, fewer unnecessary refusals on harmless ones - plus more resistance to prompt injection and less willingness to take destructive actions like unauthorised transactions or excessive access. Under test without cyber safeguards, Astra made no attacks on OpenAI's honeypot and legitimately captured the flag 1.3% of the time.

Here is the operational sting. When the extra safety checks fire in ChatGPT or Codex, you get asked to review an action. In the API, the task stops outright. There is no interactive fallback in a headless agent. Your run just ends.

And the escape hatch is narrower than the marketing implies. Daybreak Blue configuration raises proof-of-concept exploit completion on Astra from 2.4% to 92%, but reduced refusals are reportedly not available on Astra for most Daybreak customers, and the public gpt-daybreak-blue-latest alias currently maps to gpt-5.6-sol. A Daybreak badge, a Daybreak alias and a Daybreak-configured Astra are three different things. Check which one you have before you promise a customer anything.

Is this an AGI revolution? No, and the claim is not currently testable

"Welcome to the AGI era" is a sentence at a press briefing. It is not a claim with a pass condition attached, which means it cannot be wrong, which means it is not worth arguing about. Toby Walsh at UNSW put the competitive read plainly - OpenAI is neck and neck - and neck and neck is not a revolution.

What would count as evidence, concretely: a score that holds up on a third party's harness rather than the vendor's; sustained autonomous performance on tasks nobody wrote an eval for, measured in days rather than minutes; transfer, where a gain on one benchmark predicts a gain on an unrelated one you build yourself; and an economic signal, meaning a task category where your headcount genuinely drops rather than shifts. Astra clears none of these yet. It arguably clears part of the second on computer use, and ARC Prize's finding that it needed fewer interactions than the human baseline to learn novel environments is the most interesting single result of the launch - more interesting than any percentage.

What would settle it is dull and available: publish the harness. Every frontier scorecard should ship with the scaffolding as a runnable artefact, or the number is a product demo. Until vendors do that as standard, treat every saturated benchmark as a claim about a system you cannot reproduce.

Our position: Astra is a good agentic model with a genuine step change in autonomous cyber capability and a real improvement in computer use. It is not a discontinuity in general intelligence. Price it accordingly.

The EU-sovereignty and residency reading

Zero Data Retention for eligible API customers is a retention control, not a residency control. They are different questions and procurement will conflate them. ZDR means prompts and completions are not stored. It says nothing about which jurisdiction the GPUs are in during inference, and inference location is what your DPA, your Art. 28 processor chain and your customers' security questionnaires actually ask about.

Astra ships on the OpenAI API, Azure and AWS Bedrock. The Azure and Bedrock routes are where you get an argued regional story, with the caveat that regional availability for a brand new frontier model lags the launch by weeks or months and often routes to US capacity in the interim. If you are selling into German public sector or regulated finance, get the deployment region in writing per model, not per platform, and re-confirm it at every version bump. A model alias that silently repoints is a residency incident.

Second-order point that matters more than people think: a Critical-cyber-classified model gives your customers' risk teams a new reason to ask what your agents can reach. Being able to answer with a scoped credential inventory and an egress allowlist is worth more in a security review than any certification logo.

What to do on Monday

Do not swap the model. Add it as a candidate behind a flag and make your eval suite the gate.

If you do not have a suite that can fail a release, that is the actual work of this week, not Astra.

Sources