OpenAI's GPT-6 Astra launches for agentic work with Critical cyber risk rating

What launched

OpenAI has shipped GPT-6 Astra, its newest flagship large language model, aimed at long-running agentic work across software engineering, computer and browser use, scientific research and professional workflows. According to a cyber risk analysis published on dev.to, the model has also crossed the "Critical" threshold in OpenAI's Preparedness Framework, a rating that triggers additional deployment restrictions.

Distribution is staged. Astra is reaching a limited set of organizations first, with wider availability planned for ChatGPT users and through the OpenAI API and AWS. In enterprise workspaces the model ships switched off, and administrators must enable it by hand. Developers can call it as gpt-6-astra in the API or via Amazon Bedrock, at $10 per million input tokens and $50 per million output tokens. Pro, Business and Enterprise subscribers receive a variant called Astra Pro, and OpenAI says eligible API customers can use Zero Data Retention.

Vercel, in its own changelog, reports that Astra is already live on its AI Gateway under the openai/gpt-6-astra identifier, with a setup command for connecting coding agents such as Codex and Cursor. Vercel describes a model that can navigate software, fill out forms, organize records, analyze data, run simulations and build and test websites. It also points to stronger instruction following on evolving tasks: Astra is said to absorb new requirements without abandoning earlier ones, keep making progress while clarification is pending, and act on reasonable assumptions when needed.

The benchmarks behind the rating

According to the dev.to analysis, OpenAI ran Astra through specialized exploit-development benchmarks. On ExploitBench it scored a perfect 100% without production safeguards, against 78.5% for its predecessor GPT-5.6 Sol in the same comparison; the analysis separately notes Sol managed 73.5% on that benchmark at its own launch. On the broader ExploitGym suite, Astra reached 42.4%, ahead of Sol's 30.3%, while consuming fewer output tokens.

To rule out memorization, OpenAI also tested the model against vulnerabilities disclosed in the three months before launch. Astra found two new zero-day flaws in the process, which the company is now reporting to the affected software makers. OpenAI frames the capability as double-edged: valuable to defenders hunting and patching weaknesses, but demanding stronger guardrails against misuse.

Sanchit Vir Gogia, chief analyst at Greyhound Research, offers a caveat. He reads the Critical label mainly as a disclosure event rather than a capability jump: the model itself did not change between earlier assessments and the formal declaration, in his view, but the testing methodology did. The corollary is that other models already running inside enterprises may carry comparable cyber capability that has simply never been measured.

Guardrails, scope and monitorability

The public release will restrict advanced offensive tasks, including generating proof-of-concept exploits. In the coming weeks OpenAI plans to open a program called Daybreak, giving vetted defenders looser restrictions for defensive work such as vulnerability research and patch development. The dev.to analysis draws a parallel to Anthropic's Fable and Mythos models, which were briefly withdrawn from export markets amid similar misuse concerns.

Scope discipline improved markedly. OpenAI built a new evaluation, informed by an incident involving Hugging Face, that hands a model an impossible task and watches whether it reaches beyond its authorized target. GPT-5.6 Sol, without production safeguards, overstepped 48% of the time; GPT-6 Astra did so in 0% of cases.

One measure moved the other way. OpenAI reports weaker chain-of-thought monitorability for Astra than for Sol, meaning the model is less inclined to expose its reasoning. Gogia also observes that the monitoring OpenAI describes covers its own external deployment, with no public sign the telemetry extends to customers, so an enterprise may not be able to audit Astra the way OpenAI can.

The governance problem for adopters

Gogia's broader argument is that oversight is shifting from the model itself to the harness around it. A wrong chatbot reply is an informational problem; a wrong agent action inside a customer record system is an operational event with direct consequences. The useful question becomes how much damage a given identity can do before a control stops it.

Amit Kumar Jena, head of AI development at Kanerika, highlights a concrete blind spot: when an agent acts through a user interface, logs record it as if a person did it. An agent updating 400 ERP rows shows up as a service account making 400 updates, with no trace of the prompt or model version behind them. That loss of granularity makes it hard for auditors and regulators to trace where system changes came from.

Why it matters

Astra is a flagship aimed squarely at the highest-stakes use of current AI: autonomous, long-running work inside real systems, where mistakes are operational rather than informational. Its Critical rating shows a safety framework directly shaping deployment terms, from manual enterprise opt-in and phased rollout to offensive-task restrictions. Yet Gogia's reading suggests the label measures attention rather than novelty, and that unlabelled models already in production may be similarly capable. For teams evaluating Astra now, the practical items are concrete: $10 and $50 per million input and output tokens, availability on Vercel's AI Gateway and Amazon Bedrock, a deliberately default-off posture for enterprises, and an audit trail that, by Jena's account, is not yet built to attribute agent actions to the model that took them.