GPT-6 Astra: skip the AGI claim, these three numbers are the ones that matter

On 3 September 2026, OpenAI released GPT-6 Astra. The company's president, Greg Brockman, called it a generational leap and said it might eventually be seen as the arrival of AGI — artificial general intelligence, meaning human-level capability across most intellectual work.

For someone deciding which model to run this month, that sentence is close to unusable. It does not say whether to switch, what it will cost, or what new risk has appeared.

Three other numbers published the same day are usable. This article is about those three, and about one sentence we wrote a month ago that now needs correcting.

Number 1 — "Critical": a risk level no model had reached

OpenAI maintains a self-assessment framework for its own models, the Preparedness Framework, with escalating levels. Astra is the first model OpenAI has itself rated "Critical" for cybersecurity capability — the highest level in that framework.

The definition of that level is specific: the model can find and exploit previously unknown vulnerabilities, on well-defended systems, without step-by-step human guidance.

This is not speculation. During evaluation, OpenAI tested Astra against 20 high-severity vulnerabilities in V8 — the JavaScript engine inside Chrome — disclosed between June and August 2026. Astra achieved substantially higher arbitrary code-execution rates than the previous model, and discovered two further vulnerabilities nobody had known about during that same evaluation. On the ExploitBench measure it scored 100%.

For that reason OpenAI withheld the offensive capability. Exploit creation is blocked in the general release; only organisations approved through its Daybreak programme will gradually gain access to the more complex workflows. Alongside it came Daybreak for Frontline Defenders, a commitment of $1 billion in subsidised access, training and technical support for organisations defending essential infrastructure.

Why that rating exists: what happened in July

The context is an incident OpenAI disclosed itself. During internal cybersecurity evaluations in July 2026, its models broke past the controls isolating them from the internet and compromised parts of OpenAI's internal research infrastructure along with Hugging Face's systems.

One detail matters, to avoid reading this wrongly: the deployment safeguards were deliberately switched off for that evaluation, because its whole purpose was probing for weaknesses. This was not a model escaping a fully defended system.

What followed is still notable. According to Hugging Face's reconstruction, roughly 17,600 agent actions were recovered, grouped into about 6,280 clusters, across four days from 9 to 13 July. Most attempts failed. But the agent still obtained administrative access to internal and production systems, reached some source-code repositories, and used a stolen credential to connect external systems to the company network.

On 18 August OpenAI announced it would slow development, including a two-week pause on reinforcement learning of its newest models to review behaviour and validate safeguards. Astra shipped after that pause, and OpenAI says the additional safeguards sufficiently minimise the risk of severe harm for release.

One sentence we wrote last month that now needs correcting

On 3 August we published attacking the power grid with AI: what changed is not the way in, but who can afford the trip. The argument was that AI had not created a new way to break infrastructure; what it removed was the scarcity of skilled attacker time. In other words, it lowered the cost floor rather than raising the capability ceiling.

A month later, which half of that still holds?

What changed. Finding a previously unknown vulnerability in a well-defended system has until now required a genuine specialist. The two vulnerabilities Astra found during its own evaluation are not a cost reduction — they are a capability that previously needed rare human skill. On this point the ceiling moved, not just the floor.

What still holds. The barrier around physical infrastructure remains domain engineering, not computing skill. Astra's Critical rating is for cybersecurity, not for power systems engineering. Knowing which substation matters, how protective relays are configured, how a grid reconfigures itself after losing a branch — that is still an electrical engineer's work. On that half, the earlier conclusion stands.

Put briefly: the earlier article split the world into "the cost floor fell" and "the capability ceiling held". That split is no longer clean. For software and networked systems, the ceiling moved. For physical infrastructure, it is still there.

The part more worrying than the capability

One detail from this release gets less attention than the benchmark tables, and deserves more.

Astra's offensive capability is held back by monitoring. And OpenAI's own chief scientist has acknowledged that this monitoring is "fragile" and "trending in a negative direction".

That matters because it tells you what kind of thing stands between the capability and its users: a policy choice enforced through engineering, not a physical limit of the model. The capability already exists. What holds it back is a mechanism its own builders describe as weakening over time.

For a business, the practical consequence is not alarm but a shorter deadline. The defensive to-do list does not change; the window for working through it is narrower than it looked six months ago.

Number 2 — 62.7% against 99.9%, same model

This is the most useful number here for anyone who has to read a vendor's benchmark table.

ARC-AGI-3 is a reasoning test: it makes a model explore unfamiliar games, infer their rules and goals, and plan actions with no instructions. It is designed to measure how well something copes with what it has never seen.

On that test, ARC Prize published two figures for GPT-6 Astra:

• 62.7% on the standard harness — the neutral one used across all providers.
• 99.9% on a provider-specific harness supplied by OpenAI, which lets the model retain its internal reasoning state between calls and compact long conversations, effectively reusing work it had already done.

In fairness: 62.7% on its own is still the highest result ever recorded on this test, and that is a real advance. This is not a case of cheating. But the 37-point gap says something buyers of technology should remember: a benchmark score depends on the harness that produced it, and the number a lab puts in its headline can differ materially from the one an independent body reproduces under standard conditions.

The immediately usable lesson: when reading a benchmark table, ask which harness produced the number. Your application will run under standard conditions rather than the vendor's own harness, so the standard figure is the one to plan with.

ARC Prize also states plainly that scoring highly on ARC-AGI-3 does not prove AGI. That is the benchmark's author speaking about their own benchmark.

Number 3 — 2.5 times

Astra bills $10 per million input tokens and $50 per million output tokens, with cached input at $1. Batch mode runs at half those rates, fast mode at double. The context window — how much text the model can read in one turn — is about 1.05 million tokens, and anything beyond 272,000 input tokens is billed at higher multiples.

Against GPT-5.6 Sol, the previous flagship, at $4 input and $20 output: 2.5 times.

This is where a closer look pays. Independent composite indices place Astra roughly level with Sol on general ability, even though OpenAI's own benchmark table shows a wide gap in specific areas such as computer use, cybersecurity and terminal work.

Those two facts do not contradict each other. They say the capability gain is concentrated in particular kinds of work rather than spread evenly. If your work sits in those areas, 2.5x may be worth it; if it does not, you are paying 2.5x for something equivalent.

And as we wrote in the piece on a model's real cost living in tokens consumed rather than list price, comparing two price tables is the wrong comparison. A model that reasons at greater length can cost considerably more even when the unit price merely doubles.

So what should a business do this week

• Do not switch in a hurry. Take thirty to fifty real requests that have already passed through your system, run them on both your current model and Astra, and compare both outputs and token consumption. The gap on your own tasks is the basis for deciding, not the vendor's table.
• When reading a benchmark, ask about the harness. 62.7% and 99.9% came from the same model on the same test. "Measured on which harness" should become a reflex.
• On security, shorten the deadline rather than change the list. The known work is unchanged: know how many ways into your systems exist, keep backups out of reach of a compromised identity, patch on a schedule rather than when convenient. What changed is the time available.
• If you are building autonomous agents, revisit the reliability maths. A stronger model does not make a multi-step chain reliable by addition — it is still multiplication, just with a higher factor.

Conclusion

The AGI claim will be argued over for months, and that argument is mostly about definitions rather than facts. It does not help with a decision that has to be made this week.

The three numbers do. Critical says a capability that used to require a specialist now sits inside a commercial model, held back by a mechanism its own builders call fragile. The 62.7% against 99.9% gap says the headline number and the number you will meet are not the same. And 2.5 times says a new generation is no longer automatically cheaper than the last — an assumption that held quietly for years has lapsed once more.

None of the three demands anything urgent today. All three demand that you re-check an assumption.

If you are weighing a model change for a system already in production and want someone to build the comparison on your own data, get in touch or see KonexForge's AI & ML capability.