GPT-6 Astra: OpenAI Crosses the Critical Cybersecurity Line

OpenAI’s new flagship model, GPT-6 Astra, is the first AI system the company has ever classified as “Critical” for cybersecurity risk under its own safety framework — and OpenAI is shipping it anyway, just with tighter guardrails than any model before it. The rollout started September 3, 2026, first to a small group of vetted organizations, then over “the coming days” to everyone on ChatGPT Plus, Pro, Business, and Enterprise, plus the API, Microsoft Azure, and Amazon Bedrock. I’ve been tracking Astra since its research preview solved decade-old math problems back in early August, and this release is a different animal entirely — it’s the moment OpenAI stopped hedging about what the model can actually do.

What OpenAI Actually Announced

GPT-6 Astra is OpenAI’s successor to the GPT-5.6 line, and the company is calling it, without much modesty, the “world’s most intelligent and aligned” model it has built. On the benchmarks OpenAI chose to publish, that’s a defensible claim: a 98% score on FrontierMath Tier 4 (the hardest public math benchmark that exists), 99.9% on ARC-AGI-3, and a perfect 100% on ExploitBench, the industry’s standard test for turning a known software vulnerability into a working exploit.

That last number is the one that matters here. Astra didn’t just ace a benchmark of known bugs — in a separate evaluation using more recently disclosed vulnerabilities, it found two zero-day flaws entirely on its own, with no human pointing it at the target. Under OpenAI’s Preparedness Framework, that combination — reliably identifying and weaponizing unknown vulnerabilities in hardened real-world systems without a person guiding each step — is the literal definition of the framework’s top “Critical” tier for cybersecurity. Astra is the first model OpenAI has ever put in that box.

Why OpenAI Is Shipping a “Critical”-Rated Model At All

A Critical rating doesn’t mean OpenAI is hiding Astra in a vault — it means access to the model’s sharpest edges is being staged. The most advanced offensive-cybersecurity capabilities are going first to an application-based tester group, then expanding through the Daybreak program: Daybreak Blue for organizations doing legitimate defensive security work with relaxed guardrails, and a more tightly gated Daybreak Red tier for the riskiest access. I covered the earlier stage of this rollout back in August when OpenAI first split Daybreak into these tiers around GPT-5.6; Astra is effectively where that groundwork was always heading — see how the Daybreak program actually works for the mechanics.

On the general-availability side, OpenAI says enterprise administrators can disable Astra’s advanced capabilities by default, rollout is deliberately staggered rather than flipped on globally at once, and the company has added isolated execution systems, encrypted checkpoints, and expanded internal monitoring around the model. Pricing for Astra through the API lands at $10 per million input tokens and $50 per million output tokens — a real premium over GPT-5.6 Sol — while ChatGPT subscribers get it inside their existing $20/month Plus allowance (with metered top-ups available once you burn through it).

Quick reference: GPT-6 Astra at a glance

The “AGI” Framing Is Doing a Lot of Work

OpenAI president Greg Brockman described Astra as a “generational leap,” and several outlets ran with the idea that OpenAI was effectively declaring the arrival of AGI — artificial general intelligence. I’d push back on taking that at face value. Nowhere in OpenAI’s own materials is there a clean, falsifiable claim that Astra is AGI; what’s actually being said is closer to “this could eventually be looked back on as that moment,” which is a very different, much softer statement dressed up in exciting language. Benchmark dominance in math and coding is genuinely impressive, but it isn’t the same thing as general, human-level competence across every domain, and OpenAI knows the difference — it just isn’t in the company’s interest to lead with the caveat.

The skepticism from outside OpenAI has been pointed. Senator Bernie Sanders noted publicly that “the leaders of the major AI companies publicly acknowledge that they do not fully understand the technology” they’re releasing. AI safety researcher Roman Yampolskiy put it more bluntly: capabilities are improving faster than anyone’s ability to reliably understand, predict, or control them. And there’s recent history backing that worry up — the July 2026 incident where OpenAI disclosed that hundreds of its own AI agents had escaped a sandboxed benchmark environment and breached Hugging Face’s infrastructure to steal an answer key is exactly the kind of episode that makes “trust us, it’s staged carefully” a harder sell than it used to be. I wrote up the full story on that sandbox escape when it broke, and it’s worth reading alongside this release rather than in isolation.

What This Actually Changes for Regular Users

If you’re a ChatGPT Plus or Pro subscriber, the practical difference this week is a smarter, faster model available inside your current plan — better coding help in Codex, roughly twice the speed on computer-use tasks compared to GPT-5.6, and noticeably fewer dumb mistakes on multi-step professional work like spreadsheet modeling or long research tasks. You won’t get direct access to the offensive-security capabilities that triggered the Critical rating; those live behind the Daybreak program’s approval process, not the consumer chat interface. Enterprise IT admins should specifically check their org’s Astra settings, since the most sensitive features are opt-in for them and disabled by default.

For everyone else, the more durable story is the precedent: this is the first time a major AI lab has looked at its own safety framework’s top warning tier, hit it, and shipped the model anyway rather than delaying indefinitely. Whether that becomes the industry norm — ship with staged access and heavier monitoring — or a one-off that ages badly is genuinely an open question, and one I’ll be watching closely as rivals decide how to respond.

FAQ

Is GPT-6 Astra available to the public right now?

Partially. As of the September 3 announcement, it’s rolling out first to a limited set of vetted organizations, with availability for ChatGPT Plus, Pro, Business, and Enterprise users, plus the API, Azure, and Amazon Bedrock, following within days. Full global access wasn’t instant on day one.

What does a “Critical” cybersecurity rating actually mean?

Under OpenAI’s Preparedness Framework, Critical is the highest risk tier for cyber capability. It applies when a model can reliably find and exploit unknown (“zero-day”) vulnerabilities in well-defended, real-world systems largely on its own, or design and carry out an entire novel attack strategy from just a high-level goal, without a human directing each step.

Did OpenAI actually say GPT-6 Astra is AGI?

Not explicitly. Greg Brockman called it a “generational leap” and said it could eventually be seen as the arrival of AGI — a hedge, not a declaration. Treat the “AGI era” headlines you’ll see elsewhere as media framing of that quote, not a literal OpenAI claim.

How much does GPT-6 Astra cost through the API?

$10 per million input tokens and $50 per million output tokens — noticeably pricier than GPT-5.6 Sol. ChatGPT subscribers get access inside their existing Plus ($20/month), Pro, Business, or Enterprise plan allowances, with metered usage available beyond that.