Every frontier release of the past three years has been sold on a benchmark. This one is the first where the number that matters is a classification.
OpenAI says Astra is the first model to reach the Critical cybersecurity threshold under its own Preparedness Framework. In their description, with the right tools and access it can find previously unknown security flaws and develop ways to exploit them across many well-protected systems, without a person guiding each step.
And the response to reaching that threshold was to withhold it. Advanced cybersecurity work is limited at launch to a small group of alpha testers, with wider access routed through a defensive programme afterwards. The flagship capability of the release is the one almost nobody can use.
What actually shipped
It went to trusted partners as a limited preview on 3 September 2026 and to paid users the following day. The model page lists a context window of 1,050,000 tokens with a maximum output of 128,000, at ten dollars per million input tokens and fifty per million output, with cached input at one dollar.
The benchmarks OpenAI leads with are worth reading as a statement of intent rather than as scores. Agents' Last Exam, AutomationBench and ScreenSpot Pro are all measures of getting computer work done across professions, not of knowledge or conversation. This is a model aimed at doing your job in your tools.
The other claim is the one that would matter most if it holds. OpenAI says Astra is its most aligned model to date, and specifically that it is far more likely than GPT-5.6 Sol to respect explicit safety and security restrictions and to stay inside its authorised scope. For anyone letting a model act rather than draft, that is a more useful property than another benchmark point.
Critical is a threshold, not an adjective
It is worth being precise, because the word is doing real work. Critical is a defined level in OpenAI's Preparedness Framework, not a marketing intensifier, and reaching it triggers obligations rather than a press release.
What follows from it is procedural and quite revealing. OpenAI delayed parts of Astra's development and release to strengthen protections against cyber misuse, and then shipped saying it expects the safeguards at launch to create more friction than ultimately intended.
Read that sentence again, because companies do not usually write it. Telling your customers in advance that your own guardrails will get in their way is a statement about how close to a line you think you are. It is the most informative thing in the announcement, and it is not a number.
Capability and access have come apart
Here is the shift that actually reaches the rest of us, and it is not about cyber.
For three years, what a model could do and what you could do with it were the same question, so a capability announcement was a plan you could make. That has now separated. Two organisations paying for the same model can have materially different capability depending on which tier, programme or tester group they are in.
So a spec sheet has stopped being a forecast. If you are deciding what your team will be able to do next quarter, the honest input is not the announcement, it is a test of the access you actually hold. The gap between the published capability and your capability is now a real quantity, and nobody else can measure it for you.
The practical version is unglamorous: take three tasks you actually need done, run them on the access you have bought, and write down what came back. That is your capability. Everything else is somebody else's.
The reasoning got harder to read, just as we started relying on reading it
One technical detail deserves more attention than it is getting. Astra uses a technique described as recurrent depth, which obscures some or all of the model's reasoning, and AI safety researchers have raised concerns about what that does to monitorability.
That concern is usually framed as a problem for safety teams. It is also a problem for ordinary working practice, because for two years the practical answer to "how do I check this" has been to read the chain of thought. Where the reasoning was legible you could see the wrong turn, not just the wrong answer. That surface is thinning.
It is compounded by something OpenAI presents as a straightforward win: in several evaluations Astra reaches stronger results while using substantially fewer output tokens. Fewer tokens for more work done is genuinely good, and it also means less text in front of you per unit of work performed.
Put those together with what Grok Bot shipped a month ago and the direction is consistent across two labs: more of the work happens out of sight, and less of it arrives as something to read. Neither company is hiding anything. The reviewable surface is simply shrinking as a side effect of the thing getting better.
Dearer per token, cheaper per task
Ten and fifty per million is a step up in price, and OpenAI's answer is that cost per task falls anyway because the model spends fewer output tokens getting there.
That may well be true, and it is worth noticing what it does to budgeting rather than whether it is true. The unit everyone plans in, tokens, has stopped being the unit that matters, tasks. A per-token comparison between models can now point the opposite way from a per-task one, and only the second is the thing you pay for. Run your own task end to end and count the total; a spreadsheet of rate cards will mislead you.
There is also a cliff to know about. Past 272,000 input tokens, the rate becomes twice the input and cache price and one and a half times the output price, applied to the whole request rather than to the excess. That is the second frontier lab in a month to ship that shape, after Grok's own threshold, and it points the same way: the expensive requests are the long-running ones that accumulate context by working well.
What this does to the skill that matters
When you could read the working, checking was a kind of reading, and the skill was noticing the wrong turn in a plausible paragraph.
As the working becomes less legible and more of it happens in a tool rather than in a message, that skill stops being available. What replaces it is less comfortable: deciding, in advance, what a good outcome would look like specifically enough that you could recognise one later without being shown how it was reached.
That is a harder discipline than reviewing, and it has to happen before the work rather than after it, which is exactly why it tends not to happen at all. It is also the only version of checking that survives a model you cannot watch.
So the useful question about GPT-6 is not whether it is a step towards general intelligence, which is the argument the release invites and which nobody will settle this year. It is narrower and more answerable: for the work you are about to hand over, can you say now what you would accept, and would you be able to tell afterwards whether you got it. If not, a more capable model does not help you. It just gets to the unverifiable answer faster.
