OpenAI shipped GPT-6 Astra on September 3, calling it the company’s “most intelligent and aligned” model yet. Buried in the same announcement is a much bigger story: Astra is the first OpenAI model to cross the Critical threshold for cybersecurity capability under the company’s own Preparedness Framework. According to OpenAI’s own safety overview, that means Astra — given the right tools and access — can “find previously unknown security flaws and develop new ways to exploit them across many well-protected systems” without a person guiding it step by step.
That is, by any reasonable reading, the scariest capability claim a lab has made about one of its own broadly-shipped models. And “broadly shipped” is the operative phrase: Astra is rolling out to ChatGPT Plus, Pro, Business, and Enterprise plans, plus the API, Azure, and AWS Bedrock, over the days following launch. The gate between a Critical-risk model and hundreds of millions of ChatGPT users is, per OpenAI’s own account, an admin toggle (access is off by default until a workspace admin turns it on) and a refusal behavior for proof-of-concept exploit requests.
What “Critical” actually means here#
This isn’t marketing language dressed up as a safety claim — it’s a specific, defined rung on OpenAI’s Preparedness Framework, and crossing it triggers OpenAI’s own stated internal-deployment safeguards: encrypted model checkpoints with tightened access controls, “universal monitoring” of tool-using inference including chain-of-thought reasoning, and a blocking alignment evaluation before internal teams could even use the checkpoint. Those are serious controls — for OpenAI’s own engineers.
For external users, the safeguard story is thinner. The released model reportedly refuses to generate proof-of-concept exploits and advanced offensive-cyber workflows, while still supporting defensive tasks like secure code review and patching. Full access to Astra’s advanced cybersecurity capability is starting with a small group of alpha testers through a program called Daybreak Blue, expanding afterward for defensive use. But the base model — the one that scored a perfect 100% on ExploitBench, an evaluation built specifically to measure the ability to develop exploits from known vulnerabilities — ships to every paying ChatGPT tier on the same schedule as everything else. Expert-led assessments cited in OpenAI’s own materials found that, run without production safeguards, Astra could achieve arbitrary code execution in hardened browsers and build privilege-escalation exploits for hardened operating systems.
Compare that to how Anthropic handled a materially similar problem three days earlier. When Anthropic shipped Fable 5.1 alongside Mythos 5.1 on September 1, the higher-capability Mythos variant wasn’t given a broad-release refusal prompt and an admin checkbox — it was withheld from general release entirely, restricted to enrolled life-sciences participants and Anthropic’s own Claude Security service. Two labs, two models that both needed some form of gating, two very different definitions of what “gated” means in practice.
The benchmarks are close enough to be noise#
Setting the safety question aside for a moment, Astra’s coding numbers are genuinely competitive, not a blowout. On Terminal-Bench 4.0, OpenAI self-reports 57.7% against Fable 5.1’s 55.8% and Opus 5’s 52.3% — a real gap, but a self-reported one. This blog has made a habit of not crowning a benchmark winner until it shows up on an independent leaderboard, and that standard cuts both ways: Fable 5.1’s self-reported Terminal-Bench 4.0 number still isn’t confirmed on snorkel.ai’s live board as of this week, and neither is Astra’s. Treat both as marketing until a third party reruns them.
On DeepSWE v1.1, a 113-task agentic coding benchmark, the top four models land within seven points of each other: Astra 74.1%, Gemini 3.8 Flash 73.8%, Opus 5 73.7%, Fable 5.1 67.4%. That’s not a story about one model lapping the field — it’s a story about frontier coding capability plateauing across every serious lab at once, which is itself the more durable trend worth watching.
Where the gap is real and OpenAI’s own numbers show it clearly: cybersecurity offense. ExploitBench has Astra at 100% against GPT-5.6 Sol’s 78.5% and Opus 5’s 70%. SRE-Bench — reasoning about live production incidents — has Astra at 88.0% against Opus 5’s 12.5%, a wider gap than anything else in the benchmark suite. Whatever else is true about Astra, the model genuinely is a step change in offensive and operational cyber reasoning. That’s exactly the capability class the Preparedness Framework’s Critical tier exists to flag, and it’s exactly the capability class where the deployment gate matters most.
The part that actually affects your API bill#
For teams building agentic coding pipelines, the more immediately practical difference is pricing architecture, not benchmark scores. Astra’s list price is $10/$50 per million input/output tokens — identical to Claude Opus 5’s. But cached input tokens on Astra cost $1 per million, with cache writes at $12.50 per million. Anthropic, in the same week, cut Fable 5.1’s cache-read price by 75% to $0.25 per million tokens, explicitly because cache reads can account for half or more of the tokens burned on long, complex agentic tasks. For a coding agent that’s re-reading the same repository context across dozens of tool calls in a single session — which is exactly what Claude Code and its competitors do all day — that’s a 4x difference in the cost of the token category that dominates real agentic workloads. Astra’s headline numbers look competitive; Astra’s actual cost-per-agentic-session, for anyone running long, cache-heavy loops, does not.
What this means if you’re choosing a model for production agents#
Astra is a legitimately capable model, and the FrontierMath, GPQA, and long-context numbers back up OpenAI’s “most intelligent” framing. But “most aligned” is doing a lot of work in that tagline for a model whose own system card describes it as capable of finding zero-days and building exploits for hardened systems without human guidance — and whose actual deployment plan is “ship broadly, add a refusal prompt, gate the advanced version behind an alpha program that most customers will never see.” Anthropic’s Mythos gating isn’t merely a marketing choice; it’s the more defensible reading of what a Critical-risk classification is supposed to require. For a coding-tools blog, the bottom line is simple: the benchmark race between Astra and Fable 5.1/Opus 5 is a near-tie, decided by whoever gets independently verified first. The governance race isn’t close.
Sources: GPT-6 Astra: A new generation of intelligence — OpenAI; Safety overview: GPT-6 Astra — OpenAI; GPT-6 Astra System Card — OpenAI Deployment Safety Hub; GPT-6 Astra Scores 100% on ExploitBench as OpenAI Blocks PoC Exploit Requests — The Hacker News; OpenAI launches GPT-6 Astra, its first model to cross a critical cybersecurity threshold — CSO Online; GPT-6 Astra Benchmarks Explained — officechai; this blog’s own prior coverage of Claude Fable 5.1 and Mythos 5.1’s launch.
