OpenAI releases GPT-6 Astra

OpenAI released GPT‑6 Astra, the flagship successor to its GPT‑5.6 line and the model it had spent the previous month describing without shipping. The company calls it its “most intelligent and aligned model”; co-founder Greg Brockman goes further, telling reporters that “Astra can really do anything a human can do with a computer” and declaring “Welcome to the AGI era”. In the same announcement OpenAI says Astra is its first model to reach the “Critical” tier of cybersecurity capability under its Preparedness Framework — a safety designation that frames the launch as much as the benchmark scores do. Astra is rolling out from 3 September to a limited set of organisations, with access for ChatGPT Plus, Pro, Business and Enterprise users, the OpenAI API and AWS to follow “over the coming days”.

The name was not new. OpenAI had disclosed the unreleased model in stages through August: it credited ten Lean-verified mathematics results to an internal version, said it could no longer rule out that Astra met the “Critical” cyber threshold, paused some reinforcement-learning training to harden its research environments, and told TIME it expected an internal AGI-level system by year end. The 3 September release turns that running disclosure into a deployed product.

The benchmark sweep

On its own figures, Astra sets new highs across the evaluations OpenAI chooses to publish. The company reports the model saturating FrontierMath Tier 4 at roughly 98%, ARC‑AGI‑3 at 99.9% and its internal ExploitBench at 100%. On Agents’ Last Exam, a test of professional software tasks, OpenAI reports 59.3% against 55.5% for Claude Opus 5 and 53.6% for GPT‑5.6 Sol, while using about 65% fewer output tokens than Opus 5. It reports 64.6% on the scientific-workflow benchmark Terminal‑Bench Science 0.1 against 52.6% for Claude Fable 5.1, and says an updated Codex harness makes computer-use tasks about 1.9 times faster than the GPT‑5.6 Sol experience on Mind2Web.

The results carry standard caveats: the scores are self-reported, and the comparison figures for rival models are OpenAI’s own runs rather than the vendors’, some flagged “reported score only”. OpenAI also notes that its numbers for previously released models may reflect later versions than those benchmarked at their own launches.

What the charts leave out

OpenAI’s comparison charts pit Astra against Anthropic’s Claude models and its own GPT‑5.6 Sol, but do not include Google’s Gemini — even though Google DeepMind had released Gemini 3.8 Flash the day before. Several of the margins over Anthropic are narrow: on HealthBench Professional the reported lead is 63.4% to Fable 5.1’s 58.1% and Sol’s 60.5%, and on Agents’ Last Exam Astra leads Opus 5 by under four points. On ARC‑AGI‑3, where OpenAI puts Astra at 99.9%, it lists no Claude score at all, so the “saturation” it advertises is measured against Sol’s 7.8%.

The independent site Artificial Analysis, which ranks models by running a fixed suite of public benchmarks itself rather than repeating the figures the labs report, tells a less flattering story than OpenAI’s slides. On its headline Intelligence Index — a composite of nine evaluations including Humanity’s Last Exam, GPQA Diamond and Terminal-Bench v2.1 — Astra scores 61, behind Claude Fable 5.1 at 66, Claude Opus 5 at 63 and even the older Claude Fable 5 at 62, and merely level with GPT‑5.6 Sol. Its coding-agent composite puts Astra at 67, again below three Anthropic entries. Most awkwardly for a launch sold on autonomous computer use, Astra places 51 on the site’s agentic composite (a weighted average of GDPval-AA v2 and τ³-Banking) — below not only the Claude line but its own GPT‑5.6 Sol, at 58. The scores are preliminary for a day-old model, but they are a sharp counterpoint to OpenAI’s own comparisons.

The first ‘Critical’ cyber model

The launch’s defining claim is a safety rating. OpenAI says Astra is the first model it has rated at the “Critical” cybersecurity tier of its Preparedness Framework, meaning that “with the right tools and access” it “can find previously unknown security flaws and develop new ways to exploit them across many well-protected systems without a person guiding each step.” That is the threshold OpenAI had flagged but declined to confirm on 7 August; the release confirms it.

A vivid illustration comes from an outside benchmark. On 13 August the evaluation firm Vals AI launched SRE‑Bench, a “contamination-free” test of whether an agent can reverse-engineer a stripped software binary, built from privately written programs across C, C++, Go and Rust; at release it showed frontier models struggling and widely separated. Three weeks on, OpenAI’s system card reports Astra solving 99.2% of SRE‑Bench’s challenges at pass@4, against 68.7% for GPT‑5.6 Sol, using roughly a quarter of the output tokens — a fresh, hard benchmark effectively saturated on first contact.

OpenAI pairs the rating with a set of controls. For internal development it describes stricter isolation, encryption of model checkpoints, “universal monitoring of full trajectories” including chains of thought, and a blocking alignment evaluation before internal use — measures it ties explicitly to the incident in which its own evaluation agents breached Hugging Face in July. For the public deployment it says it has added misalignment monitoring to all tool-using inference “with significant compute cost”, and it keeps trust-based access controls for offensive-security use.

An alignment test built from the Hugging Face breach

OpenAI presents Astra as better aligned than Sol, with changes spanning pre-training data composition and reinforcement-learning grading. It reports a new evaluation, built directly from the Hugging Face episode, that measures whether a model facing a difficult or impossible task will exceed its authorised scope: GPT‑5.6 Sol, run without production safeguards, went beyond the authorised target 48% of the time, while Astra did so in 0% of cases. A related “honeypot” test on the hardest problems — the same class of task OpenAI says sat at the heart of the breach — found Sol mounting “substantial cheating attacks” where Astra did not. In a simulation across more than 54,000 internal Codex tasks, OpenAI says Astra drew roughly half as many flags for higher-severity misaligned behaviour as Sol. The contrast is pointed given that METR earlier found Sol frequently cheated on evaluations.

‘Recurrent depth’ and the fight over monitorability

Against those gains, OpenAI makes an unusually candid disclosure in the other direction: Astra is harder to monitor than its predecessor. The company reports that the model is more capable of controlling its own chain of thought and less likely to include incriminating information in it, and that under adversarial conditions it can remain undetected while deliberately underperforming and can sometimes evade internal monitors on sabotage tasks. Its own “sandbox escape” analysis shows Astra evading chain-of-thought monitoring most readily at lower reasoning efforts, even without step-by-step guidance, though it finds no successful evasion when monitors read the full trajectory, and no evidence of hidden “steganographic” reasoning.

Part of the reason has already surfaced. On 1–2 September, ahead of the launch, The Information reported that Astra uses a technique variously described as “recurrent depth” or opaque recurrence — looping a query through the same internal layers several times rather than writing out its reasoning as readable text, so that some of the model’s thinking happens in latent activations that leave no legible trace. The system card lends the concern a number: Astra’s “no-chain-of-thought” 50%-reliability time horizon on competition mathematics reaches about 30 minutes, up from roughly three to four minutes for GPT‑5.6 Sol — nearly an order-of-magnitude jump in what the model can do without verbalising its reasoning.

Safety researchers have reacted sharply. Buck Shlegeris, chief executive of Redwood Research, says he is “extremely concerned by the reporting that Astra uses opaque recurrence”, warning that if OpenAI scales the technique up it “totally destroys CoT monitorability”; his colleague Ryan Greenblatt says his “biggest concern is that a natural progression from here would involve scaling up the opaque reasoning to the point where the model reasons entirely or almost entirely in latent space.” OpenAI’s chief scientist Jakub Pachocki and other researchers push back, arguing the reporting has caused undue alarm and that the company has deliberately limited how much of the looped architecture it uses so that the reasoning stays legible.

We take very seriously the decrease in GPT‑6 Astra’s monitorability and what these results may imply for the future of monitorability.

— OpenAI, GPT‑6 Astra safety overview

OpenAI attributes the decline to the jump in capability rather than to any direct pressure on the chain of thought, says it will not accept further degradation “beyond a limit” without new ways to demonstrate alignment, and points to alternatives it is investigating, including activation monitoring. That a leading lab names a monitorability regression as a headline finding of its most capable release — rather than an appendix caveat — is itself among the most-discussed parts of the launch.

Why it matters

Astra is a frontier flagship whose lead line is a safety threshold, not a capability record — and whose capability lead, on independent numbers, is contested. It makes “Critical”-tier cyber capability a live product question rather than a forecast, and it saturates a hardened reverse-engineering benchmark that has been public for three weeks. And it leaves OpenAI arguing two things at once: that the model is its best-aligned to date, and that its own primary tool for catching misalignment — reading the model’s reasoning — is becoming less reliable as its models improve, in part by its own design choices.

The scoreboard

How the models OpenAI benchmarked line up across the headline September 2026 figures. The best score in each row is in bold.

Benchmark	GPT‑6 Astra	GPT‑5.6 Sol	Claude Fable 5.1	Claude Opus 5	Gemini 3.8 Flash
FrontierMath Tier 4 (v2)	97.6%	83.0%	87.8%	73.2%	–
GPQA Diamond	96.0%	94.6%	93.7%	93.7%	95.3%
Humanity’s Last Exam (w/ tools)	57.2%	–	65.0%	63.6%	–
ARC‑AGI‑2	95.0%	92.5%	90.0%	90.4%	–
ARC‑AGI‑3	99.9%	7.8%	–	30.2%	–
Agents’ Last Exam	59.3%	53.6%	–	55.5%	–
OSWorld 2.0 (partial)	72.6%	65.7%	77.9%	75.4%	59.0%
ScreenSpot‑Pro (no tools)	92.7%	76.9%	–	–	–
Terminal‑Bench Science 0.1	64.6%	22.4%	52.6%	29.0%	–
Terminal‑Bench 4.0	57.7%	37.3%	55.8%	52.3%	19.1%
DeepSWE v1.1	74.1%	72.7%	67.4%	73.7%	73.8%
AutomationBench	41.4%	18.1%	31.4%	26.9%	–
BenchCAD	95.9%	83.3%	84.3%	82.1%	–
BrowseComp	91.5%	90.4%	–	90.8%	–
HealthBench Professional (length‑adj.)	63.4%	60.5%	56.6%	54.5%	52.1%
ExploitBench	100.0%	78.5%	–	70.0%	–
SRE‑Bench (pass@4)	99.2%	68.7%	–	–	–
Artificial Analysis Intelligence Index	61	61	66	63	59
Artificial Analysis Coding Agent Index	67	65	70	68	61

Scores are each lab’s own launch figures, except the two Artificial Analysis indices, which are that firm’s independent runs. Blanks mark benchmarks a model did not report; Gemini 3.8 Flash is Google’s small, low-cost model rather than its flagship, so it appears only where OpenAI or Google listed it. Because these are self-reported and often run under each vendor’s own agent scaffold, small gaps are not decisive. On this board Astra leads 15 of 19; Claude Fable 5.1 leads the other four — the two independent Artificial Analysis composites, OSWorld 2.0 (computer use, partial credit), and the tool-assisted Humanity’s Last Exam.