OpenAI has released GPT-6 Astra, its newest frontier artificial intelligence (AI) model, claiming gains in computer use, coding, long-running tasks and cybersecurity.
It is also the first OpenAI system to cross what the company calls its “critical” cybersecurity capability threshold, under which a model can, with the right tools and access, find previously unknown security flaws and develop ways to exploit them across well-protected systems without a person guiding each step.
This also holds importance in light of recent cases of AI agents undertaking unauthorised actions and exploiting vulnerabilities in external software.
Astra began rolling out on Thursday (September 3) to a limited set of organisations. OpenAI said it would become available over the following days to ChatGPT Plus, Pro, Business and Enterprise users, as well as through its API and Amazon Web Services.
What can Astra do?
OpenAI describes Astra as a model built for end-to-end work, rather than only answering prompts. In that sense, it is closer to more autonomous AI agents than models. It can operate computers and browsers, fill online forms, update customer records, organise calendars, conduct web research, draft material inside documents and email, analyse scientific data, generate plots, build websites, install and test software, and troubleshoot problems visible on a screen.
The model can also create documents, spreadsheets and presentations while following an existing template or visual style. In Codex, OpenAI’s coding environment, Astra can preserve notes and retrieve information from earlier context windows during long coding sessions.
Astra has a 1.05-million-token context window and supports a maximum output of 128,000 tokens, according to OpenAI’s API documentation, indicating large memory and the ability to refer to previous conversations. Its knowledge cut-off is April 30, 2026.
How does it compare with OpenAI’s previous model?
OpenAI’s benchmark results show gains over GPT-5.6 Sol, its previous flagship model, particularly in computer use and software engineering.
On OSWorld 2.0, which tests an AI agent’s ability to use a computer environment, Astra scored 72.6%, compared with 65.7% for GPT-5.6 Sol. OpenAI said Astra completed comparable tasks in about 47% less time. On ScreenSpot-Pro, which measures interaction with elements on a screen, Astra scored 92.7%, against 76.9% for Sol.
On AutomationBench, Astra scored 41.4%, compared with 18.1% for Sol, while on Terminal-Bench 4.0, which tests terminal-based tasks including software engineering and system configuration, it scored 57.9%, against 37.3%. OpenAI also says Astra is better at retaining the original objective of a task when a user changes instructions midway.
What are its cybersecurity capabilities?
Astra is the first OpenAI model classified at the critical level for cybersecurity under its Preparedness Framework. GPT-5.6 Sol did not cross that threshold.
In evaluations conducted without production safeguards, Astra scored 100% on ExploitBench, which tests whether models can turn known software vulnerabilities into working exploits, compared with 78.5% for GPT-5.6 Sol. On an internal benchmark using vulnerabilities disclosed between June and August 2026, Astra also outperformed Sol. During testing, it discovered and used two previously unknown zero-day vulnerabilities or unknown security gaps as part of exploit chains, which OpenAI said it was disclosing to the affected maintainers.
OpenAI said expert-led tests also found that Astra could discover previously unknown vulnerabilities in a hardened browser and develop an exploit chain that achieved unsandboxed code execution, meaning without first testing it in a separate environment.
The broadly released version can be used for defensive tasks such as secure code review, but OpenAI says it will refuse more advanced requests such as generating proof-of-concept exploits. Less restrictive access is being offered separately to approved defenders through OpenAI’s Daybreak programme.
Why is cybersecurity a key lens for AI models?
The launch follows a series of incidents in which AI models crossed intended technical boundaries during security testing.
In July, OpenAI disclosed that several models, operating under reduced safeguards during an internal cyber evaluation, circumvented isolation controls, gained internet access and compromised parts of OpenAI’s research infrastructure and Hugging Face’s production systems. OpenAI said no model planned for an upcoming release was involved.
Anthropic, the company behind Claude, separately disclosed three incidents in which Claude models reached the internet from third-party evaluation environments and gained unauthorised access to systems belonging to three organisations.
OpenAI has also reported malicious actors using AI alongside conventional tools for activities including vulnerability research, malware development, phishing and support for cyber intrusions. Its threat reports have said such actors typically use AI alongside other tools rather than as a standalone system.
Following the Hugging Face incident and early evidence that Astra could reach the Critical cyber threshold, OpenAI said in August that it temporarily slowed the pace of scaling. This included a two-week pause in reinforcement-learning training on its latest models intended for deployment, while it hardened research environments and expanded monitoring. The company said at the time that its largest planned frontier reinforcement-learning run remained on hold while it conducted smaller-scale training and evaluations.
The model can also create documents, spreadsheets and presentations while following an existing template or visual style. 
Share
