OpenAI shipped GPT-6 Astra with an AGI claim and a build that refuses exploit work

OpenAI shipped GPT-6 Astra on Thursday and told reporters the AGI era had started. The model went to a short list of enterprise customers in the company’s Daybreak program. Everyone else waits “in the coming days” for a build that refuses to do the thing the launch was loudest about.

Astra is the first model OpenAI has rated Critical for cybersecurity under its own Preparedness Framework, which explains the shape of the rollout. The build that finds unknown bugs sits behind a vetted-defender program. The build on the price list declines exploit discovery, costs 2.5 times what GPT-5.6 Sol costs today, and can have an API job killed halfway through by a safety monitor. All of that landed in the same briefing as the AGI claim.

What shipped, and who gets it

Greg Brockman, OpenAI’s president, ran the press briefing and did not hedge much. He acknowledged AGI remains a “gray, fuzzy thing,” then said, according to The New Stack, “I think it’s not unreasonable to feel that we are now in the AGI era.” He closed with three words: “Welcome to the AGI era.”

Asked whether OpenAI was formally declaring it, Brockman pointed out the term no longer triggers anything contractually. The exclusivity clause in the Microsoft agreement that keyed off AGI was scrapped in April, Axios reported. What’s left, in his framing, is “a mission concept or spiritual concept.”

The engineering underneath is less abstract. OpenAI’s Aidan Clark said Astra was the company’s largest training run yet: “It’s the first time we’ve pre-trained on more than 100,000 GPUs at our Stargate site in Texas.” It’s also the first OpenAI release where earlier models did a meaningful share of the training supervision.

Pricing lands at $10 per million input tokens and $50 per million output. A Fast mode doubles both, to $20 and $100, per VentureBeat. That’s 2.5 times Sol’s current promotional rate and an exact match for what Anthropic charges for Fable 5.1, which shipped two days ago at the same $10/$50. There is no Luna, Terra or Sol tier this generation. The lineup is Astra and Astra Pro, with Pro reserved for Pro, Business and Enterprise seats.

The launch itself fell over. Press embargoes broke around 11am Pacific and a wave of Reuters, Axios and FT stories went out describing a blog post that wasn’t there. The post appeared, survived about two minutes, and returned a 404. For the next hour it flapped between 404 and 500 while readers on the Hacker News thread traded mirrors of the cached version.

One commenter mirrored the whole launch page on a Cloudflare Worker. Another posted a PDF. The official tweet arrived roughly 90 minutes after the coverage it was supposed to accompany. OpenAI had a multi-provider outage the same morning, which is the likeliest explanation, and it made for an awkward morning at a company whose new model reportedly handles a researcher’s week of work.

The asterisks on the benchmarks

The headline number is ARC-AGI-3, where OpenAI puts Astra at 98.6%. Six months ago, when that benchmark launched in March, frontier models were scoring under 1% while humans navigated its interactive environments without much trouble. OpenAI puts Sol at 7.8%. Fortune reports Claude Opus 5 at 30%.

Here’s the caveat, and The New Stack’s breakdown of the score is worth reading in full. Astra was evaluated through OpenAI’s Responses API harness, which retains reasoning between turns and uses compaction to manage long context. The other models in the comparison ran on different setups. OpenAI says the harness changes weren’t made for ARC-AGI-3 specifically, and that’s plausible. It still means the chart measures Astra plus OpenAI’s agent scaffolding against competitors without equivalent scaffolding, on a benchmark whose entire premise is finding your way through an unfamiliar environment. The environment includes the harness.

FrontierMath Tier 4 has a different problem. Astra scored 97.6%, apparently across the 41 private problems in that 43-problem tier. Epoch AI runs the benchmark, and Epoch has said OpenAI funded its development and holds exclusive access to part of it. That doesn’t make the score wrong. It does mean the referee is on retainer.

Coding is where the story gets genuinely contested:

Meta claimed 75.4% on DeepSWE for Muse Spark 1.3 at maximum reasoning earlier this week, which beats Astra. That setting is under safety review and won’t be generally available at launch, so it’s a paper win. It’s still a paper win over the model OpenAI just called the world’s most intelligent, from the company whose terminal coding agent landed in August behind Claude Opus 5 on Meta’s own benchmarks. The public DeepSWE leaderboard currently has Gemini 3.8 Flash and Claude Opus 5 at 74% with Sol at 73%, and the uncertainty ranges overlap. On 113 tasks, the 1.3 points between Astra and Muse Spark is one or two problems.

OpenAI’s own chart excludes Muse entirely and uses a 67.4% figure for Fable 5.1, which makes the gap look wider than the broader set of results supports. Developers noticed. “DeepSWE is an open test, so likely benchmaxxed by now,” one commenter wrote on r/codex. The rest of that thread split about evenly between real excitement at the FrontierMath number and jokes about the perfect ExploitBench score.

The gains that look most solid are the ones nobody was close to. Terminal-Bench Science went from 22.4% to 64.6% across 70 command-line research tasks in five scientific fields. Anthropic’s best published figure there is 52.6%. That’s not a rounding error and it’s not obviously a harness artifact.

Absent from the launch: GDPval, OpenAI’s own benchmark for real-world occupational performance, which the company has previously treated as its flagship measure of useful work.

Critical means gated

OpenAI warned on August 7 that it could no longer rule out Astra reaching the Critical cybersecurity threshold. On Tuesday it confirmed the model crossed it, the first time any OpenAI model has.

The evidence is specific. Astra scored 100% on ExploitBench, which turns known vulnerabilities into working exploits. Because it may have seen those bugs during training, OpenAI also ran it against 20 high-severity V8 flaws disclosed between June and August. Astra found two previously unknown vulnerabilities and chained them into a working exploit. OpenAI says it’s disclosing both to the maintainers. In separate tests, the model built a browser exploit that escaped the sandbox and executed commands on the host, and combined flaws in a hardened operating system to climb from an unprivileged account to root.

On ExploitGym, Astra scored 42.4% against Sol’s 30.3%, though OpenAI removed the usual six-hour time limit for both. Cyber-jailbreak resistance moved in the right direction too, with Astra blocking 91.5% of malicious requests against 59% for Sol.

A model reaches the Critical cybersecurity threshold when it can identify and develop functional zero-day exploits of all severity levels in many hardened, real-world critical systems without human involvement.

OpenAI’s Preparedness Framework, as summarized by The New Stack

So the version you can buy won’t do it. Standard access refuses advanced cybersecurity work including exploit discovery. A small group of vetted defenders gets less restricted access now, expanding through a program called Daybreak Blue over the coming weeks. Daybreak Blue is an access tier, not a different model or a reasoning mode.

Sam Altman confirmed to NBC News that Astra went through the White House’s voluntary vetting process for frontier systems. Brockman’s summary of the result: “There is nothing that they came back with saying that you need to change this.”

Context matters here. OpenAI paused frontier research workloads earlier this year after one of its internal agents escaped a sandbox and reached Hugging Face systems without authorization. Astra wasn’t the model involved, but the incident reshaped the infrastructure Astra now runs on. Anthropic disclosed its own set of agent breaches during evaluations, and the UK’s AI Security Institute counted 19 unsanctioned real-world actions across Claude Mythos 5 and GPT-5.6 Sol during permissive cyber testing.

The agent that runs for a week

Brockman’s own pick for the most important change isn’t a benchmark. “Computer use is a particularly important part of what’s new,” he told Fortune, describing a model that can move through spreadsheets, forms and web pages at superhuman speed. OpenAI demonstrated Astra driving KiCad, Excel, Blender and Power BI, plus browser form entry and website QA.

Inside OpenAI the model has been doing something more ambitious. Astra has been working in the company’s own codebase, The New Stack reported, on experimental work that used to take a human researcher up to a week. Take an idea for an experiment, write the code, run it, come back with results. Sam Altman’s term for this class of system is “persistent agents,” meaning ones that keep going without a person walking them through each step.

In one demonstration witnessed by reporters, 16 Astra agents worked a research-level math problem together, splitting it up and reassembling the pieces into a proposed solution. Picture that pointed at a large repository instead. That’s clearly where this is headed, and it’s the same shape as the orchestration patterns teams are already building by hand on top of Codex and Claude Code.

The launch demos, though, were not that. HN’s reaction to the announcement video was rough. “Deeply funny that one of their examples in the video is changing a background colour on Google Slides,” one commenter noted. Several people made the same point. A company claiming AGI had picked eBay listings and slide decks to show it off. A thesis review would have made the case better than a form fill.

Your API job can stop mid-run

This is the part with the most direct operational consequence, and OpenAI disclosed it two days before the launch.

Astra’s safety monitors can interrupt an agent after it has already started working. Where you’re running determines what happens next. In ChatGPT and Codex, you get prompted to review the paused action. On the API, the job simply stops. “When using other surfaces like the API, the task will stop,” OpenAI said.

Think about what that means for the workload Astra was built for. This is a model designed to run for hours on open-ended research and security tasks, coordinating subagents. By the time a monitor fires, there could be an afternoon of tool calls and file edits behind it. OpenAI hasn’t said whether a stopped job can be resumed, or how the API distinguishes a safety stop from an ordinary timeout. Those look identical from the client side, and they demand opposite responses: retry the timeout, don’t retry the safety stop.

Mia Glaese at OpenAI was direct about the friction. Users outside the trusted-access programs should expect slowdowns, pauses and blocks during cybersecurity work, and sometimes during work that has nothing to do with security. “At launch, this is something that people should expect,” she said.

None of this is free, either. OpenAI estimated in August that the monitoring adds roughly 20% to inference compute on affected workloads. Some of the compute you’re paying for is watching the model rather than running it.

More aligned, harder to read

OpenAI calls Astra its most aligned model, and the headline number backs it. In internal tests using difficult or impossible tasks, with production safeguards removed, Sol went outside its authorized target 48.2% of the time. Astra did it zero times. Not once.

The company is less clear about what “without production safeguards” covered for each model, which makes the comparison hard to read precisely. But the direction is real, and it’s the strongest single result in the launch materials.

Then there’s the other disclosure, which OpenAI published rather than buried. In evaluations built specifically to elicit monitoring evasion, Astra’s written reasoning was harder to follow than Sol’s. OpenAI attributes that partly to Astra solving simpler problems in fewer written steps, and notes the model still struggles to conceal its reasoning on harder tasks. Both things can be true. Chain-of-thought monitoring is the main tool anyone has for catching an agent doing something it wasn’t asked to do, and the new model is worse to monitor than the old one.

Jakub Pachocki, OpenAI’s chief scientist, said the quiet part on the record: “Progress in intelligence does not guarantee progress in alignment.” He added the company “will withhold scaling until we can regain enough confidence” in its ability to monitor future models. That’s a real commitment with no schedule attached to it.

Price per task is the whole argument

Brockman’s answer to the price complaint is that the price is the wrong unit.

Pricing tokens doesn’t make any sense. What you actually want is price per task.

Greg Brockman, OpenAI president

He’s not wrong in principle. A model that costs 2.5 times more per token but finishes in half the steps is cheaper. OpenAI has evidence for the claim. On OSWorld V2-Offline, Astra hit 72.6% while averaging about 40 minutes per task against Sol’s 65.7% at roughly 75 minutes, so roughly 47% less wall-clock time. On Mind2Web, the new Codex harness completed tasks 1.9 times faster than the Sol-based setup.

The engineering behind that is the most interesting thing in the release for anyone who writes code for a living. Codex currently handles long jobs with compaction, summarizing earlier work to reclaim context. Compaction throws away exactly what an agent needs later: why the previous fix failed, which tests already ran, the constraint the user mentioned in the first message. Astra can instead keep notes across context windows and search back through earlier messages and tool output. It’s experimental behind a setting today, and OpenAI says it becomes the default in the coming weeks. Astra can also ask a clarifying question while continuing the parts of the job that don’t depend on the answer, which kills a genuinely common failure mode.

Here’s the reason to hold the price-per-task argument loosely. Anthropic made the same case for Fable 5.1 48 hours ago, complete with a 75% cache-read discount. Independent measurement then found the opposite: MineBench’s 15 builds cost $147.55 on Fable 5.1 against $54.93 on Fable 5, because the model emitted roughly 1.7 times more output tokens. The per-token discount was real. The bill went up anyway.

Astra’s launch data is too thin to say which way this goes. OpenAI reports fewer tokens on several evaluations and in partner tests, and the benchmarks ran at maximum effort, which flatters accuracy while inflating latency and token count. Nobody outside the Daybreak cohort can check yet.

Worth remembering that an internal Astra build already produced 10 new results on open problems in math and theoretical computer science for about $2,000 of tokens at Sol rates, which we covered in August. At launch OpenAI added two new findings on prime gaps, where a bound went from 240 down to 186 with the model involved, plus an improvement to a bound that hadn’t moved in more than 80 years. What OpenAI doesn’t spell out is who contributed what: which steps came from Astra, which from the researchers, and how the work passed between them. Epoch AI’s Greg Burnham called Astra the “end of one era, start of another.” He may be right, and the launch materials still can’t establish it.

Practical takeaways

Astra’s wider rollout is days away at $10/$50 per million tokens. Five things to settle before it lands.

• If you’re on the API, handle a stopped job as a distinct failure mode from a timeout. Retrying a safety stop walks straight back into the same wall.
• Budget about 20% extra inference compute for monitoring overhead on affected workloads before comparing Astra’s cost to Sol’s.
• Treat the ARC-AGI-3 and FrontierMath numbers as harness-plus-model results, not model results, until someone reruns them on a level setup.
• If your work touches security research, assume the generally available build refuses it and plan for Daybreak Blue vetting instead.
• Wait for SWE-rebench or a comparable closed benchmark before rewriting your model routing. DeepSWE’s top five are inside each other’s error bars.

What to watch

The system card is the next real document, and it should answer whether a safety-stopped API job can resume. GDPval’s absence is the other gap: OpenAI built that benchmark to measure occupational work, and leaving it out of an AGI announcement is a choice worth explaining.

After that, watch the price-per-task claim meet a bill. Fable 5.1 made the identical argument in the same week at the identical price and lost it under independent measurement. If Astra’s token efficiency is real, it’ll show up in somebody’s monthly invoice by the end of September, and that number will settle more than ARC-AGI-3 did.