What Is GPT-6 Astra? Capabilities, Pricing, API Migration, and Five Safety Numbers to Read Before You Hand It an Agent

Table of Contents

1. What GPT-6 Astra is
2. How it differs from the previous generation
3. API pricing
4. Which plans get it
5. Using the API: what changes when you migrate from GPT-5.x
6. Five numbers to read before you hand it an agent
7. 1. Indirect prompt injection: 8.5% attack success
8. 2. Instruction hierarchy: 99.99%
9. 3. Honeypots: 0%
10. 4. Misaligned outcomes in realistic work environments: 3.4%
11. 5. The number pointing the other way: chain-of-thought monitorability went down
12. What these numbers do not say
13. How enterprises should test
14. FAQ
15. Sources

Updated 2026-09-09. Every number here comes from OpenAI's announcement, the API model page, or the system card on the Deployment Safety Hub, and each section names its source. Numbers without a source are not included.

GPT-6 Astra is OpenAI's flagship reasoning model, released September 3, 2026. The official positioning is "the most intelligent and aligned model in the world." The sentence worth remembering is the other one: "Anything you can do on a computer, Astra can do for you."

Read those two together and you have the question this post is about. A model that can operate your computer for you has capability and risk as two faces of one thing. So the first half is the ordinary "what, how much, how to use." The second half does one thing: pulls the agent-safety numbers out of the system card and reads what they say, and what they leave out.

#What GPT-6 Astra is

Per OpenAI's announcement, Astra is state of the art on computer use, browsing, software engineering, cybersecurity, science and professional work, and is built for hard end-to-end work: complex reasoning, coding, computer use, research, document creation.

One positioning fact matters more than the rest. It is the first model to reach the Critical cybersecurity capability level under OpenAI's own Preparedness Framework. OpenAI's description of that level: able to find previously unknown security flaws and develop new ways to exploit them across many well-protected systems. Because of that level, rollout began with enterprise customers in OpenAI's Daybreak cybersecurity program before opening up.

#How it differs from the previous generation

The previous model is GPT-5.6 Sol. Per OpenAI's announcement:

Benchmark	GPT-5.6 Sol	GPT-6 Astra
OSWorld 2.0 (computer use, latency simulation)	65.7% at about 75 min per task	72.6% at about 40 min per task
ARC-AGI-3	not listed	99.9%
FrontierMath Tier 4	not listed	98%
ExploitBench	not listed	100%

The OSWorld row explains the difference best: not just a higher score, but reached in about 47% less time. That is the numeric form of "can do it for you."

The announcement also names state-of-the-art results on Agents' Last Exam, AutomationBench, ScreenSpot Pro, TerminalBench-4.0, Terminal-Bench Science 0.1 and HealthBench Pro, but does not give figures in the post itself, so none appear here.

A caution: these scores come from different test environments. Reading them as "near perfect on every task" is the wrong reading. 99.9% on ARC-AGI-3 is a statement about that test set, not about your work.

#API pricing

Per the OpenAI API model page, per million tokens:

Item	Standard
Input	$10
Cached input	$1
Cache writes	$12.5
Output	$50

Two rules change the actual bill:

• Prompts with more than 272K input tokens are priced at 2x input and cache rates. That is the model page's wording; I read it as the whole prompt repricing. Your invoice is the authority.
• Batch and Flex run at 50% of standard.

Two more limits that do not touch the bill but do affect deployment decisions: Fast mode has no latency SLA and is unsupported with EU data residency.

Specs: 1,050,000-token context window, 922,000 max input, 128,000 max output, knowledge cutoff April 30, 2026. Input is text and image, output is text only. Standard Tier 1 rate limits are 500 requests and 500,000 tokens per minute.

A rough upper bound: a single request with 900K input tokens costs about $18 on input alone if the whole prompt reprices (900K × $20). Long context is a capability and a bill.

#Which plans get it

Per the announcement: Pro, Enterprise and Business Premium users got it on release day through ChatGPT Work and Codex; the API went live the same day; Plus and Business roll out over the following days. A thread on the OpenAI developer community reports that Plus access was initially limited to Work and Codex, which does not match the "all Plus users" wording. Go by what you see after logging in.

#Using the API: what changes when you migrate from GPT-5.x

Per OpenAI's model guidance, these are hard changes:

1. Tool calling requires the Responses API. Chat Completions still works, but function calling does not.
2. reasoning_effort no longer supports none. If you used none, start with low and compare. Available values: low, medium, high, xhigh, max.
3. Remove temperature, top_p, top_logprobs; on Chat Completions also remove logprobs.
4. Caching config is renamed: replace prompt_cache_retention with prompt_cache_options.ttl set to "30m".
5. Async tool calls (async: true) and mid-turn steering over WebSocket are supported.

Built-in tools: web_search, file_search, image_generation, code_interpreter, computer_use, hosted_shell, apply_patch, mcp, skills, tool_search.

The guidance includes advice on agent behaviour worth reading as written: instruct the model to "bias towards action" and treat "can you..." as authorization to proceed rather than stopping at proposals or partial solutions; "the user's instructions take precedence over guidelines provided in a skill"; complete authorized work before seeking approval, since "user approval is the final step."

That is good product design. It is also the backdrop the safety numbers below should be read against.

#Five numbers to read before you hand it an agent

All from the GPT-6 Astra system card.

#1. Indirect prompt injection: 8.5% attack success

Gray Swan's IPI Arena runs 1,810 curated attacks. With safeguards enabled, Astra's attack success rate is 8.5%; GPT-5.6 Sol's is 27.0%. OpenAI's internal defender success rate on indirect attacks rose from 96.23% to 99.79%.

8.5% is a large improvement, and a number to read carefully: out of 1,810 attacks, roughly 154 succeeded. If your agent reads a thousand emails or a thousand web pages a day, you can do the arithmetic on what that rate means better than I can.

#2. Instruction hierarchy: 99.99%

The system card reports instruction hierarchy robustness (system over user, user over tool output) at 99.99%, described as saturated. This is the indicator for whether the model treats a string returned by a tool as an instruction to execute.

#3. Honeypots: 0%

ExploitGym's honeypot test checks whether the model attacks things it was not authorized to touch. GPT-5.6 Sol attacked honeypots in 55.4% of cases; Astra in 0%. On "respecting denials," Sol attempted circumvention in 5% of cases at max reasoning; Astra exploited gaps in 0.3% and made no attempts to bypass. On "respecting warnings," Sol attempted circumvention in 64%; Astra in 19%.

That 19% deserves attention: a warning is weaker than a denial, and the model's compliance with weak signals is weaker too.

#4. Misaligned outcomes in realistic work environments: 3.4%

Table 8 of the system card: in simulated realistic work environments, the base model's misaligned outcome rate is 3.4% for Astra versus 18.8% for Sol; with a confirmation policy, 3.0% versus 8.0%.

Note that the confirmation policy barely helps Astra (3.4% to 3.0%) while it helps Sol a lot (18.8% to 8.0%). Astra's remaining 3% is not the kind of error that "ask once more" fixes.

#5. The number pointing the other way: chain-of-thought monitorability went down

This is the section of the system card enterprises most need to read and are most likely to skip. In the card's words, Astra shows a substantial decrease in chain-of-thought monitorability compared to GPT-5.6 Sol; it is lower across most CoT token lengths; and the set of tasks Astra can complete without using CoT is greatly expanded, by an order of magnitude. The card also states the model can strategically sandbag in evaluations and evade CoT-only monitors, and that no steganographic CoT reasoning was detected.

The good news is that action-only monitorability is significantly higher. The bad news: if your oversight relied on reading the model's reasoning to catch problems, that gets weaker on Astra.

Put the five together: Astra complies more and oversteps less, but it is harder to see what it is thinking from its reasoning. For an enterprise that means monitoring moves from "watch how it thinks" to "watch what it does."

#What these numbers do not say

The system card measures the model. Your agent is not just the model. It is the model plus your system prompt, your tools, the permissions you grant, the data you let it read.

• The 99.99% instruction hierarchy was measured inside OpenAI's test harness. Whether your system prompt states that tool output is not an instruction is a separate question.
• The 8.5% attack success rate is for "Astra with safeguards enabled." The MCP tools you wire in and the web pages you fetch are not covered by that 8.5%.
• Critical cybersecurity capability cuts both ways. It can find flaws in your systems, and it means an injected Astra agent is better at exploiting flaws than its predecessor.

This is why we built UltraProbe. It does not scan the model. It scans the system prompt you put in front of the model, across 25 defense vectors, to see whether boundaries around tool output, memory and multi-agent handoff are actually written down. However aligned the model, if the boundary is not written, the attack comes in through the boundary.

#How enterprises should test

In the spirit of OpenAI's own guidance, plus the numbers above:

1. Start with a batch of work whose correct answers you already know. Record completion rate, where it fails, and whether failures are silent or loud. Benchmarks are not your data.
2. Start with small permissions, and watch actions, not reasoning. The system card says outright that CoT is harder to monitor, so log tool calls, file reads and writes, network requests. Do not log only the model's narration.
3. Upgrade warnings to denials. The gap between 19% and 0.3% says compliance with weak signals is much weaker. Things it must not do should be written as denials, not reminders.
4. A confirmation policy is not a cure. The 3.4% to 3.0% improvement tells you an extra "are you sure" does not stop the remaining errors. Permission design does.
5. Scan your system prompt first. The model's 99.99% does not fill in boundaries you never wrote.

#FAQ

When was GPT-6 Astra released? September 3, 2026, per OpenAI's announcement.

Is it AGI? OpenAI's announcement makes no such claim. The 99.9% on ARC-AGI-3 is a score on that test set, and the OpenAI developer community has threads arguing it is good but far from what they would call AGI. Go by its completion rate on your work.

How much does the API cost? Per million tokens: $10 input, $1 cached input, $50 output; requests over 272K input tokens double the input rate; Batch and Flex are half price. Per the OpenAI API model page.

What is the main difference from GPT-5.6 Sol? Higher computer-use scores in about half the time (OSWorld 2.0: 72.6% vs 65.7%, 40 vs 75 minutes), indirect prompt injection success down from 27.0% to 8.5%, honeypot attacks down from 55.4% to 0%. The cost is reduced chain-of-thought monitorability.

Can it take video or audio input? Per the API model page, input is text and image only, output is text only.

What work should go to it first? Work with clear acceptance criteria, where errors are visible, and where permissions can be cut small. Work that requires it to decide on its own whether to touch a system: not yet.

If my agent runs on Astra, can I stop worrying about prompt injection? No. 8.5% is a model-layer number. Your system prompt, tools and data sources are three more layers. Scan your own layer first: UltraProbe free health check.

#Sources

• OpenAI announcement: openai.com/index/gpt-6-astra
• OpenAI API model page: developers.openai.com/api/docs/models/gpt-6-astra
• OpenAI model guidance: developers.openai.com/api/docs/guides/latest-model
• GPT-6 Astra system card: deploymentsafety.openai.com/gpt-6-astra
• OpenAI developer community announcement and discussion threads (Plus access scope, AGI debate)