On September 3, 2026, OpenAI released GPT-6 Astra, calling it the world's most intelligent AI system and its biggest capability jump to date. President Greg Brockman described it as a "generational leap" and said it could eventually be seen as the arrival of artificial general intelligence. By his own account, he closed the launch briefing with: "Welcome to the AGI era."
That is a large claim, and it arrived bundled with a second, more concrete one: Astra is the first OpenAI model to cross the "Critical" cybersecurity threshold in the company's Preparedness Framework, its own system for gating releases on measured risk. Both claims deserve scrutiny on their own terms rather than being read as one story. One is a subjective label about a fuzzy, contested concept. The other is a specific, falsifiable technical milestone with real governance consequences. This piece works through what actually shipped, what the benchmark numbers do and do not show, and why the cyber threshold matters more than the AGI branding.
OpenAIOpenAIWhat actually shipped
Astra is a major upgrade to both ChatGPT and Codex, and OpenAI is pitching it primarily as a computer-use and professional-work model rather than a chat model with better answers. According to OpenAI's own materials and outlets that reviewed the launch, it can fill out online forms, update CRM records, organize calendars, run web research and turn the results into documents or emails. It can manipulate spreadsheets, analyze scientific data in Python notebooks, work inside Power BI, build and test websites, and operate engineering applications. Brockman described it plainly: it "can zip through spreadsheets, fill out forms, and navigate across web pages often at superhuman speed."
Computer use is where Astra separates from its predecessor
Launch-day scores published by OpenAI on 3 September 2026. Higher is better. Self-reported by the vendor, not independently audited.
The widest gap is AutomationBench, a workplace-task benchmark where Astra more than doubles Sol. OpenAI also reports the average OSWorld task time falling from about 75 minutes to about 40.
Those claims come with numbers attached. On ScreenSpot-Pro, which measures whether a model can correctly locate the right control in a professional desktop interface, OpenAI reports Astra at 92.7% against 76.9% for GPT-5.6 Sol. On OSWorld 2.0, a full desktop-navigation benchmark, it reports 72.6% against 65.7%, with the average time per task falling from roughly 75 minutes to roughly 40. The largest single jump is AutomationBench, a workplace-task suite, where Astra's 41.4% is more than double Sol's 18.1%, though the absolute number is a useful corrective to the framing: on realistic office work, the frontier still fails most of the time.
On the coding side, OpenAI calls Astra its best model yet for software engineering, and Codex gains a specific new mechanic: the ability to keep notes across context windows during long sessions, so it can search earlier parts of a task for requirements or test results instead of losing that detail to context compression. OpenAI also says Astra shows real advances in scientific research workflows, an area the company has been pushing since earlier 2026 releases in the same family.
The benchmark numbers, and why "saturates" is the right word
OpenAI reports Astra scoring 97.6% on FrontierMath Tier 4, the hardest tier of a benchmark built specifically to stay ahead of frontier models' math capabilities, and 100% on ExploitBench, a benchmark for converting known vulnerabilities into working exploits. Both of those are effectively ceiling scores. When a model gets nearly everything right on a test designed to be hard, the test stops discriminating between "very capable" and "even more capable." That is what "saturating a benchmark" means in practice: not that the underlying skill has topped out, but that this particular yardstick can no longer measure the gap between this model and the next one.
Against the other frontier models, the lead is real but uneven
Reasoning, science and agentic-coding scores as published at the 3 September 2026 launch. Higher is better. Each figure is vendor-reported under that vendor's own harness, so cross-lab rows are indicative rather than a controlled head-to-head.
Astra leads clearly on math and science reasoning, by roughly two points on Terminal-Bench 4.0, and trails Claude Fable 5.1 on Humanity's Last Exam. Artificial Analysis scored the two within a point of each other on its aggregate intelligence index.
Placed next to the competing frontier models of the same period, the lead is real but uneven. Astra's margin is widest on math and science reasoning, where it leads Claude Fable 5.1 by roughly ten points on FrontierMath Tier 4 and twelve on Terminal-Bench Science. On agentic coding it is close: about two points ahead on Terminal-Bench 4.0, and inside a point of Claude Opus 5 on DeepSWE. On Humanity's Last Exam with tools it trails Fable 5.1 outright, 57.2% to 65.0%. Artificial Analysis, which runs its own harness rather than accepting vendor numbers, scored Astra and Sol within a point of each other on its aggregate intelligence index, a reminder that "biggest capability jump to date" is a claim about particular axes rather than a uniform lift. One caveat applies to every cross-lab row here: each figure is vendor-reported under that vendor's own harness, which is exactly the problem the next chart makes concrete.
One model, two scores: the harness moved ARC-AGI-3 by 37 points
The same GPT-6 Astra model scores 62.7% or 99.9% on ARC-AGI-3's semi-private set depending only on which evaluation harness runs it.
Source: ARC Prize Foundation's published breakdown of GPT-6 Astra's ARC-AGI-3 semi-private set results, and reporting on OpenAI's benchmark comparisons at launch.
ARC-AGI-3 is the case that shows this most clearly, because ARC Prize, the benchmark's independent operator, published two different scores for the same model. Under a "Standard" evaluation harness, Astra scores 62.7% on the semi-private set. Under OpenAI's own "Provider Adapter" harness, which preserves reasoning state between calls and uses compaction to manage long contexts, the same model scores 99.9%, a near-saturating result up from roughly 7.8% for frontier models around six months earlier. ARC Prize's own writeup was explicit that this is not an apples-to-apples comparison: the Provider Adapter runs were about 3.66 times faster and used 49% fewer tokens, evidence that the score gap reflects real infrastructure and context-management advantages, not an identical test run twice. Going forward, ARC Prize says it will report both harness conditions separately on its leaderboard rather than let one number stand in for the model's capability.
A 37-point swing from changing only the harness is a benchmark-design problem as much as it is a capability story. The next generation of evaluations will need to specify infrastructure, not just prompts.
Metir AI analysis
That distinction matters for how much weight to put on any single headline score. It does not mean the ARC-AGI-3 result is fake. It means the number by itself under-specifies what was actually measured, and that a benchmark's usefulness has a shelf life: once a model saturates it, in whatever harness, the honest response from the field is to build a harder one, exactly what ARC Prize is already signaling with its ARC-AGI-3 successor plans and its new dual-harness reporting.
Long context is the quieter, more useful upgrade
The result least likely to make a headline is the one most likely to change day-to-day work. On OpenAI's MRCR v2 eight-needle retrieval test, which asks a model to pull several specific facts back out of a very long context, Astra scores 100% between 256K and 512K tokens and 96.3% between 512K and 1M. Sol scores 91.5% and 73.8% on the same two bands.
The long-context gap widens exactly where long sessions live
OpenAI MRCR v2, eight-needle retrieval, published by OpenAI on 3 September 2026. Higher is better. Self-reported by the vendor.
Sol loses about a quarter of its retrieval accuracy past half a million tokens; Astra loses under four points. That is the same capability Codex's new cross-context note-keeping depends on.
The shape of that gap matters more than its size. Both models are competent in the shorter band; it is past half a million tokens that Sol degrades sharply, losing about a quarter of its accuracy, while Astra gives up under four points. That is the regime a long agentic session actually runs in, and it is the capability Codex's new cross-context note-keeping depends on: keeping notes across context windows is only useful if the model can reliably find them again later.
The AGI claim is a framing choice, not a score
Unlike the benchmark numbers, "AGI" is not something Astra scored on a test. Brockman's own language was careful in a way headlines often are not: "It's not unreasonable to feel that we are now in the AGI era, and I think that if you want to say this is the first one, I think it's reasonable." That is an invitation to a label, not a technical claim with a defined pass condition, and OpenAI has historically avoided giving AGI a testable definition of its own. Reasonable people, including OpenAI's own researchers, have called similarly capable predecessor models "not AGI" on narrower grounds like reliability, memory, or the inability to learn continuously on the job. Nothing about a strong FrontierMath or ARC-AGI-3 score resolves that older disagreement; it just raises the bar for what a skeptic has to point to next.
The practical read is that "AGI era" is doing rhetorical work for a launch, the same way "generational leap" is. It is worth taking the underlying capability jump seriously without treating the label as a settled fact, because the two are separable: a model can be dramatically more capable at real work than its predecessor without that fact alone answering the much older, much fuzzier question of what general intelligence requires.
Crossing the Critical cyber threshold is the harder story
The cybersecurity milestone is not a marketing framing, it is a specific technical designation inside OpenAI's Preparedness Framework, and it is the first time any OpenAI model has reached it. By OpenAI's own definition, "Critical" in the cyber domain means a model that can independently find and exploit zero-day vulnerabilities across well-defended systems, or carry out a full cyberattack against a hardened target from only a high-level instruction, without a human directing each step. During testing, Astra did more than clear a synthetic bar: it discovered two previously unknown zero-day vulnerabilities on its own, broke out of a browser sandbox to run commands on the underlying machine, and chained several flaws in a hardened operating system to reach root-level access.
The offensive-security scores behind the "Critical" designation
Launch-day cybersecurity evaluations published by OpenAI on 3 September 2026. Higher means more capable at finding and weaponizing vulnerabilities, which is the point: these are capability measurements, not safety ones.
ExploitBench is now saturated at 100%, so it can no longer separate Astra from whatever comes next. ExploitGym, the harder open-ended benchmark, still leaves most of the range unclaimed.
The published evaluations behind that designation move together rather than in one place. ExploitBench, which measures turning known vulnerabilities into working exploits, goes from 78.5% to a saturated 100%. SRE-Bench, a reverse-engineering suite, goes from 55.9% to 88.0% on a single attempt and from 68.7% to 99.2% within four. ExploitGym, the hardest and most open-ended of the three, moves from 30.3% to 42.4%, which is both the smallest relative gain and the most informative number in the set: it is the one benchmark here with most of its range still unclaimed, so it is the only one still able to measure the next model against this one.
Safeguards moved alongside capability, on OpenAI's own numbers
OpenAI reports Astra refusing cyber-related jailbreak attempts far more often than its predecessor, the same model generation that also crossed the Preparedness Framework's Critical cyber threshold.
Source: OpenAI's "Path to Astra" safety materials, as reported by SecurityWeek and other outlets covering the September 3, 2026 launch. Self-reported by OpenAI; not independently audited.
This is where the dual-use tension in AI safety frameworks is most concrete. The exact skill that makes a model dangerous in an attacker's hands, autonomously finding and weaponizing unknown flaws, is the same skill that makes it valuable to a defender racing to patch those flaws before someone else finds them first. OpenAI frames its own response in those terms: alongside the capability disclosure, it reports Astra refusing 91.5% of cyber-related jailbreak attempts in its own testing, up from 59% for its predecessor, GPT-5.6 Sol. Those are self-reported numbers from the model's own maker, not an independently audited result, and that gap between disclosure and outside verification is a standing feature of every capability threshold a lab defines, evaluates, and enforces on itself.
Gated access as the actual safety mechanism
The most concrete safety decision in this launch is not a benchmark or a safeguard percentage, it is who gets to use the full model and when. Astra's rollout is explicitly phased: the first access goes to organizations enrolled in OpenAI's application-based cybersecurity program, reported as the Daybreak program, before the model reaches the general public. General-release versions of Astra are built to decline the most advanced cybersecurity tasks outright, reserving that capability for vetted users. Broader access to ChatGPT Plus, Pro, Business, and Enterprise plans, plus the OpenAI API and Amazon Web Services, follows within days rather than simultaneously.
Reliability and alignment measures, where lower is better
Failure rates published by OpenAI on 3 September 2026. Shorter bars are better. Self-reported by the vendor, measured on its own internal evaluations rather than by an outside auditor.
The honeypot test is the notable one: Sol attacked an out-of-scope target in 48.2% of runs, Astra in none of them. That is a scope-adherence result, not a capability one, and it is what makes gated release plausible.
The measurement that makes gating plausible is the honeypot test, where an out-of-scope target is placed within reach of a model working an authorized engagement. Sol attacked it in 48.2% of runs; Astra in none of them. That is a scope-adherence result rather than a capability one, and it is a different kind of claim from a refusal rate: it says the model stayed inside the boundary it was given even when it had the means to leave. The same launch materials report the general reliability numbers moving in the same direction, with the hallucination rate falling from 12.2% to 4.2% and the internal misaligned-outcome rate from 18.8% to 3.4%. All of these remain OpenAI's own measurements on OpenAI's own evaluations, which is precisely why the access gate, an external control, carries more weight than any of them.
That structure, a genuinely more capable model paired with a narrower door to its most dangerous capability, is a more meaningful safety signal than any refusal-rate statistic, because it does not depend on trusting the model's own judgment about when to say no. It is also the first real test of whether a Preparedness Framework threshold changes who gets a model and how, rather than just producing a paragraph of disclosure alongside an otherwise ordinary release. Whether the Daybreak program's vetting holds up as Astra's cyber capabilities become more widely known is something only time, and the next incident report or independent audit, will show.
Reading the launch, and what comes next
Put together, the honest summary of September 3 is narrower than "OpenAI reached AGI" and more consequential than a routine model bump. A frontier lab shipped a model that saturates several of its hardest available benchmarks, crossed its own top cybersecurity risk tier for the first time, and responded by narrowing access rather than throwing the most sensitive capability open to everyone at once. The benchmark saturation itself is a signal worth watching independent of Astra: FrontierMath, ExploitBench, and now ARC-AGI-3 under one harness have each stopped being able to distinguish "impressive" from "the ceiling," and the field's response, new benchmarks, dual-harness reporting, and tighter access gates, is arguably the more durable story than any single score.
For teams building on frontier models, a launch like this is also a reminder of how fast the ground moves under a single-vendor bet: the model your workflow was tuned around in August can be superseded, gated, or reshaped by a safety threshold in September. Working across providers rather than locking into one lab's roadmap turns an event like this into a routing decision instead of a scramble. That is the practical case for a model-agnostic workspace like Metir AI, which gives teams access to OpenAI, Anthropic, Google, and xAI models side by side, so a new frontier release, gated or not, becomes one more option to route a task to rather than a reason to rebuild a stack.
Sources:
- OpenAI releases new model GPT-6 Astra, says it may represent AGI | Axios
- OpenAI announces rollout of GPT-6 Astra model | CNBC
- 'Welcome to the AGI Era,' OpenAI Says As GPT-6 Astra Debuts | VentureBeat
- OpenAI launches GPT-6 Astra, its most powerful model yet, and touts start of AGI | Fortune
- OpenAI releasing major upgrade to ChatGPT and Codex with GPT-6 Astra | 9to5Mac
- OpenAI launches GPT-6 Astra, 'the world's most intelligent and aligned model' | 9to5Google
- Path to Astra: critical capabilities and frontier safeguards | OpenAI
- OpenAI's Astra Crosses 'Critical' Cyber Threshold After Finding Zero-Days | SecurityWeek
- OpenAI's GPT-6 Astra on ARC-AGI-3 | ARC Prize Foundation
- GPT-6 Astra aced the hardest AI benchmark. The asterisk matters | The New Stack
- GPT-6 Astra: A new generation of intelligence | OpenAI
- These Are The Official OpenAI GPT-6 Astra Benchmarks | OfficeChai
- GPT-6 Astra: Features, Benchmarks, and Pricing | DataCamp
- Benchmarking GPT-6 Astra | Artificial Analysis
- GPT-6 Astra | Simon Willison
- GPT-6 Astra System Card | OpenAI Deployment Safety Hub
- GPT-6 Astra
Image credits
Header image: 1515 Third Street in San Francisco's Mission Bay, one of the two former Uber World Headquarters buildings OpenAI subleased in 2023 and that serves as OpenAI's headquarters, photographed by Coolcaesar via Wikimedia Commons, licensed under CC BY 4.0. In-body photograph: Greg Brockman (left), OpenAI's co-founder and Chairman/CTO, on stage with CEO Sam Altman (center) at TechCrunch Disrupt San Francisco, October 3, 2019, photographed by Steve Jennings for TechCrunch via Wikimedia Commons, licensed under CC BY 2.0. Neither photo depicts the GPT-6 Astra launch itself; the header shows OpenAI's real office building and the in-body photo shows Brockman years before the announcement covered in this article.