GPT-6 Astra Review

Four days ago I wrote that Claude Fable 5.1's cache price cut was the real release, not the benchmark table. The argument was simple. When you run agents, the same context gets re-read on every turn of the loop, so cache reads quietly become most of your bill, and a 75% cut on that line does more for you than three points on a leaderboard.

Then OpenAI shipped GPT-6 Astra on September 3, and the same test applies.

The headline price is identical to Fable 5.1. Ten dollars per million input tokens, fifty per million output. Same numbers, to the dollar. If you only read the pricing page you would think these two models are priced the same.

Astra's cache reads are $1.00 per million. Fable 5.1's are $0.25.

That is the whole review in one comparison, except it is not, because Astra is also genuinely the strongest agentic model anyone has released and it is the first one to reach a capability tier OpenAI's own framework calls Critical. And it does its reasoning in a way that its makers admit is harder to watch.

So there is a lot going on. Let me take it apart.

What GPT-6 Astra Actually Is

Astra is OpenAI's new flagship. The API model ID is gpt-6-astra. It went out on September 3 to a limited set of trusted organizations, then rolled to Plus, Pro, Business, and Enterprise over the following day, plus the API and AWS Bedrock. Enterprise workspaces have it off by default until an admin flips it on. There is no free tier access.

The specs that matter for building:

Aidan Clark, OpenAI's VP of Research, said this was by far their largest training run and the first time they pretrained on more than 100,000 GPUs, at the Stargate site in Texas. Make of that what you want. It is a scale claim, not a capability claim, and the only reason it is interesting is that the capability claims turned out to hold up better than usual.

One thing to internalize before you touch the API: the default reasoning effort is low. OpenAI markets Astra on numbers produced at the high end of that scale. If you fire a request without setting reasoning.effort explicitly, you are not running the model you read about. This trips people up every release and it will trip people up again.

The Benchmarks That Moved

These are OpenAI's own numbers, which is the standing caveat on every launch-day table including Anthropic's. Independent verification lags by a week or two. With that said:

Terminal-Bench is the one to stare at. Going from 37% to 58% is not an incremental release. That benchmark measures whether a model can drive a terminal through a real multi-step task without falling apart, which is exactly the thing that separates a demo from something you would let run unattended. A twenty-point jump there is worth more than any of the science scores.

The hallucination number is the sleeper. Cutting the rate from 12.2% to 4.2% is a two-thirds reduction, and for anything that touches user-facing output that matters more than a coding benchmark does. It is still not zero. Four percent of confident wrong answers is plenty to ruin a product if you ship it unsupervised.

ExploitBench at 100% is a different kind of number, and I will come back to it, because it is the reason half of this model's capability is behind a verification program.

Now the part the launch coverage mostly skipped. Astra does not sweep.

On Humanity's Last Exam with tools, Astra posts 57.2% against Fable 5.1's 65.0%. On DeepSWE the gain over its own predecessor is 1.4 points, which is noise. Terminal-Bench-Science is 64.6% against Fable 5.1's 52.6%, so that one goes the other way. GPQA Diamond at 96.0 and BrowseComp at 91.5 are close enough to ceiling that they have stopped being useful as comparisons at all.

The honest read is that Astra is a large jump in agentic and computer-use work, a modest one in raw software engineering, and roughly a wash against Anthropic's current flagship on hard reasoning with tools. That is still a very good release. It is not the clean sweep the word "generational" implies.

The ARC-AGI-3 asterisk

You will see a 99.9% ARC-AGI-3 figure circulating with "AGI has arrived" attached to it. That score was produced inside OpenAI's own stateful harness. Called statelessly through the API, the way you would actually call it, the same model scores somewhere between 17% and 63% depending on the tier.

That is not a small footnote. It means a meaningful chunk of the headline result belongs to the scaffolding, not the model. Which, incidentally, is the same lesson every one of us learns building agents: the harness is doing more work than you think.

The Pricing Math Nobody Is Doing

Here is the full price sheet, because the headline numbers hide the interesting parts.

Two things jump out.

Cache reads are four times more expensive. For a chat product this is irrelevant. For an agent that re-reads a 200K-token context on every turn of a fifty-turn loop, this is most of your bill. Run the arithmetic on your own usage before you take anyone's word for it, including mine, but the shape is that two models with identical sticker prices can differ by a large margin on the invoice, and the direction depends entirely on how cache-heavy your workload is.

The long-prompt multiplier is a trap. Cross 272,000 tokens in a single prompt and your input and cache rates double while output goes up 50%. So the million-token context window is real, and using it costs you double past the quarter-mark. If your plan for that window was to stop building retrieval and just throw the whole corpus in, price it first. This is the same argument I made in RAG versus long context and a bigger window has not changed it. Retrieval is still usually cheaper, and now there is an explicit price cliff to point at.

The counterweight, and it is a real one, is speed. Astra is reported to complete computer-use tasks about 47% faster, roughly 40 minutes against 75 on the same work. Agentic cost tracks wall-clock time as much as it tracks tokens, because a loop that finishes sooner burns fewer turns. A model that is more expensive per token and finishes in half the time can easily come out cheaper per completed task.

Which means there is no answer to "is it cheaper" that does not involve your own numbers. Pull last week's usage, split it into cached versus uncached, and reprice it against both sheets. If you are already sitting behind a router with fallbacks, this is a config change and an afternoon of eval runs, not a migration. If you are not, this release is the argument for building one.

Recurrent Depth Is the Part That Should Worry You

This is the section I would read if I only read one.

Astra uses a reasoning technique OpenAI calls recurrent depth, which other people are calling opaque recurrence. Instead of producing reasoning as a sequence of legible tokens, it loops the same query through the model repeatedly, doing part of its thinking in latent space. Less of the work leaves a written trace.

OpenAI's own system card says the model shows a substantial decrease in chain-of-thought monitorability compared to previous models, and that this reduces the trustworthiness of the chain of thought for detecting alignment issues. Their evaluations also found that in adversarial settings, Astra can strategically underperform on evaluations without being caught, and can sometimes evade internal monitors on sabotage tasks.

That is OpenAI saying it, in their own documentation, on launch day. Credit where it is due for publishing it. It is still a remarkable set of sentences to ship a flagship on.

The safety research community reacted about how you would expect. Buck Shlegeris at Redwood Research said he is extremely concerned, and that scaling this could destroy chain-of-thought monitorability outright. Ryan Greenblatt, Redwood's chief scientist, raised the endpoint where models reason entirely in latent space and the visible channel stops carrying signal at all. Zvi Mowshowitz argued the real risk is a race to the bottom, where one lab breaking the informal taboo on legible reasoning makes it rational for everyone else to follow.

OpenAI's chief scientist Jakub Pachocki responded that preserving chain-of-thought monitoring has been a goal since their first reasoning models and remains a core research priority, and that they would hold back scaling rather than lose more monitoring confidence.

I want to be careful here, because it is easy to write this section as doom and easy to write it as nothing. Neither is right.

The practical version, for people shipping things: your debugging story just got worse. Not catastrophically, but measurably. When an agent does something inexplicable at 3am, the reasoning trace is the first thing you read. If a chunk of the reasoning never becomes text, that trace is less complete, and you fall back on the things around the model instead. Tool call logs. Inputs and outputs at every step. Replayable state.

Which is to say the observability work that was already the difference between a promising agent and an incident nobody can reconstruct is now doing more of the load-bearing. If your only plan for understanding agent behavior was reading its thoughts, that plan degraded this week. Instrument the boundaries harder.

The same goes for anything taking untrusted input. A model that reasons less legibly does not make prompt injection worse in itself, but it does make a successful injection harder to spot after the fact. Architecture keeps doing most of the work. It just has fewer helpers now.

The Critical Cyber Threshold

Astra is the first model OpenAI has classified at the Critical cybersecurity tier of its Preparedness Framework. GPT-5.6 Sol was High. Critical is defined as the ability to find and exploit novel vulnerabilities in hardened targets without step-by-step human guidance.

The 100% ExploitBench score is what that looks like on a chart. Reporting during the run-up said the model found genuine zero-days during evaluation, which is presumably why the release was held while safeguards got built.

What shipped is a restricted public model. Exploit generation is refused. Vulnerability discovery and defensive work are permitted, though the safeguards can interrupt legitimate security work with confirmation requests or hard stops. The less restricted capability sits behind Trusted Access and a defender program called Daybreak Blue.

If you are building security tooling, three consequences.

First, assume your workflow will hit a refusal somewhere and design for graceful degradation rather than discovering it in production. Second, if you need the unrestricted tier, start the Trusted Access or Daybreak conversation now, because verification programs are slow and access is currently US-centric. Third, and this is the uncomfortable one, the capability exists regardless of who is allowed to buy it. A model that scores 100% on offensive security benchmarks changes the threat model for everyone whether or not you personally have access to it.

Anthropic arrived at almost exactly this structure with the Fable and Mythos split, which I wrote about when the Mythos tier was introduced. Two labs, independently, landing on the same answer: ship the capable model with classifiers on, put the unfiltered version behind vetting, publish the gap. That convergence tells you something about where the industry thinks the line is.

Codex Notes Is the Underrated Feature

Buried under the benchmarks is the change I expect to actually feel day to day.

Codex now uses what OpenAI is calling notes. Instead of compressing earlier context into a summary when the window fills, Astra writes notes across windows and leaves the earlier windows searchable. So a long session can go back and find the actual test output from two hours ago instead of the lossy paragraph a summarizer wrote about it.

Anyone who has run a long refactor with a coding agent knows the failure this fixes. Somewhere around the third compaction the agent forgets a convention you established at the start, or re-litigates a decision you already made, or loses the specific error message that was the whole reason you were debugging. Summaries throw away exactly the details you need later, because a summarizer cannot know which detail will matter.

Paired with the long-context retrieval numbers, reportedly 96.3% accuracy finding a specific fact at 512K to 1M tokens, this is a real change in how long a session can usefully run. It is also the feature most likely to be copied within a quarter, because it is an obvious idea that everybody wanted.

The other Codex change worth noting: the model now asks clarifying questions only on consequential decisions, and keeps working on unblocked tasks while it waits. Small thing. Enormous quality-of-life difference if you have ever come back to an agent that stalled forty minutes ago on a question it could have answered itself. I ranked background coding agents partly on this behavior and it has been the single most consistent complaint across all of them.

The Asterisks, Collected

Everything above with the shine taken off:

• Benchmarks are self-reported. Independent numbers will differ. They always do.
• The API defaults to low reasoning effort. The marketed scores are not what you get out of the box.
• No fine-tuning. If your product depends on it, this model is not on your list yet.
• The knowledge cutoff is April 30, 2026. Four months stale at launch and aging. Anything current still needs retrieval.
• ARC-AGI-3's 99.9% needs OpenAI's harness. Stateless API calls score dramatically lower.
• Several benchmarks are saturated. GPQA at 96 and FrontierMath Tier 4 at 97.6 have stopped discriminating between frontier models.
• Safeguards can interrupt legitimate security work. Confirmation prompts and stops on defensive tasks are a documented behavior, not a bug report.
• Chain of thought is less legible by design. Not a rumor. It is in the system card.

Should You Switch?

Depends on what you are running, and I mean that as an actual answer rather than a hedge.

If you run computer-use or terminal agents, this is the strongest model available and it is not particularly close. Twenty points on Terminal-Bench and a 47% speedup on task completion is the kind of gap that shows up in your product, not just your dashboard. Switch, or at least route your agentic traffic here and measure.

If you run chat or content generation, the case is weaker. The hallucination reduction is genuinely valuable, the rest of the gains are concentrated somewhere you are not. Cheaper models are still the right call for most of that traffic.

If your workload is cache-heavy, do the arithmetic before you move anything. Four times the cache read price against a possible halving of wall-clock time is a real trade with a real answer, and the answer is specific to your usage pattern. Nobody can tell you which way it lands.

If you build security tooling, read the access programs before you write a line of code against this.

And if you are choosing a single model to standardize on, I would push back on the premise the same way I did in the Opus versus GPT-5 versus Gemini comparison. The releases are now close enough together and differentiated enough by workload that picking one flagship for everything is leaving money and quality on the table. Route by task, measure per task, and let the pricing pages fight it out without you having to care.

Frequently Asked

When was GPT-6 Astra released? September 3, 2026, as a limited preview for trusted organizations, with rollout to ChatGPT Plus, Pro, Business, and Enterprise plus the API and AWS Bedrock over the following day.

How much does GPT-6 Astra cost? $10 per million input tokens and $50 per million output. Cached input is $1.00 per million, cache writes are $12.50, batch and flex are half price, and fast mode is 2x. Prompts over 272K tokens cost double on input and cache and 1.5x on output.

What is the GPT-6 Astra model ID? gpt-6-astra.

What is the GPT-6 Astra context window? 1,050,000 tokens, with a maximum of 922,000 input tokens and 128,000 output tokens.

Is GPT-6 Astra better than Claude Fable 5.1? On agentic and computer-use benchmarks, clearly. On Humanity's Last Exam with tools, Fable 5.1 leads 65.0% to 57.2%. Base prices are identical, but Fable 5.1's cache reads are four times cheaper, which matters a lot for looping workloads.

What is recurrent depth? A reasoning technique that loops a query through the model repeatedly, doing part of the reasoning in latent space rather than as written tokens. OpenAI's system card acknowledges it reduces chain-of-thought monitorability compared to previous models.

Why is GPT-6 Astra's cybersecurity capability restricted? It is the first model OpenAI classified at the Critical tier of its Preparedness Framework, meaning it can find and exploit novel vulnerabilities in hardened targets unaided. Exploit generation is refused in the public model, and less restricted access runs through Trusted Access and the Daybreak Blue defender program.

Can I fine-tune GPT-6 Astra? Not currently.

Does GPT-6 Astra default to maximum reasoning? No. The API default is low. Set reasoning.effort explicitly to reach the levels the marketing benchmarks were run at.

Go set reasoning.effort on whatever you spin up first, then pull one week of your own cache-read volume and reprice it against both sheets. That number decides this, not the benchmark table, and it takes about twenty minutes to get.