Appearance
OpenAI’s September 3 release of GPT-6 Astra is significant for a reason narrower than the launch claim that it is the company’s most intelligent model. Astra combines a substantial increase in tool-using and computer-using performance with a security milestone: it is the first model OpenAI has classified at the Critical cybersecurity capability level under its Preparedness Framework.
Those two developments belong together. Astra’s strongest results increasingly depend on a system around the model that preserves state, exposes tools, and lets it act over long trajectories. Independent testing by the ARC Prize Foundation makes that dependence unusually visible.
ARC-AGI-3 shows how much the harness matters
ARC-AGI-3 tests agents in unfamiliar interactive environments where they must explore, infer goals, build a model of the environment, and plan actions. ARC Prize evaluated Astra with two different harnesses.
With its provider-neutral Standard harness, Astra at maximum reasoning effort scored 62.7% on the semi-private set. With the Provider Adapter, which preserves opaque reasoning state between requests and compacts longer conversations, Astra reached 99.9% at high reasoning effort. ARC Prize reported both as state of the art at the time.
The difference is too large to treat the harness as an implementation detail. The Standard harness lets a model carry forward notes it chooses to keep. The Provider Adapter preserves additional state across requests. On a benchmark that requires learning an unfamiliar environment over many actions, memory architecture changes the effective capability of the system.
ARC Prize also found that Astra used fewer actions than the median tested human on 96% of levels. That is an action-efficiency result, not a claim that Astra matches humans across general intelligence. Humans in ARC Prize’s controlled testing can solve all of the benchmark environments, and the benchmark covers a deliberately narrow class of interactive reasoning tasks.
OpenAI is moving the same general idea into its own agent stack. In Codex, the company says Astra can keep notes across context windows while earlier windows remain searchable, rather than relying only on repeatedly compressing the session into a summary. The practical implication is that long-horizon evaluation increasingly needs to specify not only the model, but also what state the harness preserves and what tools it provides.
The capability gain is broad, but not uniform
OpenAI reports substantial gains over GPT-5.6 Sol on several tool-oriented evaluations. In its launch results, Astra scored 72.6% on the offline subset of OSWorld 2.0 versus 65.7% for Sol while taking roughly 40 minutes per task instead of 75 minutes in the company’s latency simulations. On Terminal-Bench 4.0, OpenAI reports 57.9% for Astra versus 37.3% for Sol.
These are useful signals, but most of the launch benchmark table was produced by OpenAI or reproduced in its evaluation environment. It should not be read as an independent ranking of every frontier model.
The same table also argues against a simple “best at everything” interpretation. OpenAI lists Astra at 61.2 on Artificial Analysis’s Intelligence Index, below several Claude models in the comparison, and at 57.2% on Humanity’s Last Exam with tools, below the 65.0% result shown for Claude Fable 5.1. On Artificial Analysis’s Coding Agent Index, Astra is also not the top entry in OpenAI’s table.
The durable development is therefore not a universal benchmark sweep. It is the concentration of progress in agentic work: computer use, software engineering, long-context state, scientific workflows, and cybersecurity.
The cybersecurity threshold changes the deployment problem
The accompanying GPT-6 Astra System Card states that Astra is OpenAI’s first model to reach its Critical cybersecurity threshold. Under that framework, a model reaches the threshold if it can either develop functional zero-day exploits across many hardened real-world critical systems without human intervention, or devise and execute end-to-end novel attack strategies against hardened targets from a high-level goal.
That is OpenAI’s own capability classification, not an independent industry certification. The system card says the assessment combines automated public and private benchmarks with expert-led testing, including third-party testing by Irregular.
The technical results are still notable. OpenAI reports 100% on ExploitBench, compared with 78.5% for GPT-5.6 Sol, and says Astra achieved arbitrary code execution at a much higher rate on a newer internal benchmark built from vulnerabilities disclosed between June and August 2026. During that evaluation, the company says Astra discovered and used two previously unknown vulnerabilities that it was disclosing to maintainers.
A Critical classification changes what must be treated as part of the safety boundary. Tool permissions, network access, credential scope, monitoring, and the ability to sustain a long sequence of actions become more consequential when the underlying model can perform more of the vulnerability-discovery and exploitation loop itself.
OpenAI says it strengthened cyber safeguards for Astra and restricts advanced exploit-development assistance in general access. The system card also explicitly considers the risk of harmful actions initiated without an authorized user request, not only deliberate misuse by a malicious user.
Stronger capability does not remove monitoring problems
The launch also documents a limitation that cuts against a simple safety narrative. OpenAI reports that Astra’s written reasoning is harder to monitor than GPT-5.6 Sol’s in tests that ask the model to evade monitoring. The company attributes this partly to Astra having more control over how much reasoning it writes down and being able to solve simpler problems with fewer visible steps.
Reuters independently reported the launch and highlighted the same monitorability concern. OpenAI says the model still struggles to conceal the reasoning needed for more complex tasks, but the decline is important because reasoning traces are one of the signals used by monitoring systems.
This is a useful reminder that stronger alignment results on one evaluation do not establish general safety. Better task-boundary behavior, stronger refusal training, runtime monitoring, and monitorability are separate properties. A system can improve on some while becoming harder to inspect on others.
What changed
Astra matters because several trends that were previously easier to discuss separately now meet in one deployed model.
The model is better at acting through computers and tools. Its peak performance on a demanding agentic benchmark depends heavily on persistent harness state. Its cybersecurity capability has crossed a threshold that OpenAI itself treats as requiring stronger deployment controls. And the same release documents a reduction in one important monitoring signal.
For developers and researchers, that makes “model capability” a less complete unit of analysis. Evaluations of frontier agents increasingly need to describe the whole execution system: model, memory, compaction, tools, permissions, safeguards, and monitoring. ARC Prize’s 62.7% versus 99.9% harness result is a particularly clear demonstration of why.
The evidence does not justify claims that Astra has reached general human-level intelligence, nor that its safety mechanisms settle the risks created by stronger autonomy. It does show that agent infrastructure can materially change measured capability and that frontier cyber performance has reached a level its developer considers qualitatively different from previous releases. Both are likely to remain relevant well beyond this launch cycle.