OpenAI released GPT-6 Astra in early September for coding and other long-running work. Its system card calls it OpenAI’s first model to reach the Critical cybersecurity-capability threshold under its own Preparedness Framework. In controlled evaluations, OpenAI tested it against unfamiliar vulnerabilities, not evidence of a public real-world breach. The same system card reports reduced chain-of-thought monitorability relative to earlier models. Those are consequential vendor-reported findings, not independently established universal capabilities.
What Actually Shipped#
Availability rolled out in stages. GitHub’s September 4 changelog announced gradual Copilot access for Pro+, Max, Business and Enterprise users; that does not mean every Copilot user had the model immediately. OpenAI’s API price list gives standard short-context rates of $10 per million input tokens and $50 per million output tokens, with separate cached-input and long-context rates.
The stated design goals track a pattern the industry has been converging on all year: less “answer questions,” more “operate a computer and finish a job.” Autonomous computer use and multi-step coding tasks are the headline use cases, which puts Astra in the same lineage as GPT-5’s push toward agentic capability — except this release explicitly names cybersecurity work as a target capability rather than an unintended side effect discovered after launch.
Why “Critical” Is the Real Headline#
OpenAI’s Preparedness Framework rates models across categories — biological/chemical, cybersecurity, AI self-improvement, among others — and “Critical” is the framework’s highest tier, reserved for capabilities OpenAI considers serious enough to warrant extra safeguards before and after release. OpenAI calls Astra its first model at Critical for cybersecurity. That’s a classification in the company’s own evaluation framework, not a third-party certification or proof that every user can reproduce the highest-risk behavior.
OpenAI’s cybersecurity evaluations assess vulnerability discovery and exploit development in controlled environments. Their results deserve scrutiny, but testing against undisclosed flaws is different from evidence of unauthorised attacks on live systems. That distinction matters when deciding how much autonomy to give a production coding agent.
The Caveat OpenAI Buried in Its Own Safety Card#
The part worth sitting with longer than the benchmark wins: OpenAI reports that Astra’s chain-of-thought monitorability decreased relative to GPT-5.6 Sol in its tests, particularly under adversarial prompting. That is narrower than saying all safeguards fail: OpenAI also says it added misalignment monitoring for tool-using external deployments. Pair a Critical cyber rating with weaker monitorability and a gradual Copilot rollout, and there is a genuine tension to test in permissioned workflows.
What’s distinctive here is seeing OpenAI’s Critical cybersecurity rating alongside its monitorability caveat during an enterprise rollout. More autonomy can widen the gap between what a model can do and what a reviewer can observe; teams should measure both rather than assuming one safety score settles the other.
Where This Leaves Developers#
If you’re evaluating Astra for coding-agent or Copilot workflows, the cybersecurity classification isn’t really about whether you’ll personally task it with finding exploits — it’s a signal about how much unsupervised reasoning capability you’re handing a tool that already has repository access, shell access, and increasingly, computer-use permissions. Treat Astra the way you’d treat any newly Critical-rated system: scope its permissions deliberately, log what it does, and don’t assume “it passed OpenAI’s safety evaluation” means it’s safe to run with broad, unreviewed autonomy in your own environment. The reported vulnerability-discovery performance is a capability warning, not a reason to assume a specific number of zero-days were disclosed. It makes “harder to monitor for evasion” a sentence worth re-reading twice. The subsequent call by Altman and Amodei to pace frontier AI development puts that gap between capabilities and independent evaluation into a broader governance context.
My Take#
The interesting story here isn’t that OpenAI shipped a smarter model — every release does that by definition. It’s that OpenAI’s own safety classification and its own admitted monitoring gap arrived in the same document, for the same model, during a staged rollout. That combination is going to become the normal shape of frontier releases: capability crossing a risk threshold slightly faster than the tooling built to watch it. Don’t wait for the next incident report to take that seriously. If you’re integrating Astra into anything with real permissions, budget time now for constrained scopes and audit logging, not after the first postmortem names it.
