OpenAI Launch GPT-6 Astra to Accelerate Enterprise Workflows

GPT-6 Astra is OpenAI’s latest frontier model, built to combine advanced reasoning, computer and browser use, software engineering, cybersecurity capabilities, and professional workflows with stronger alignment and safety controls. Its main differentiator is its ability to execute complex, multistep tasks through computer environments while improving speed, accuracy, and adherence to user intent.

OpenAI is introducing GPT-6 Astra, a frontier model designed to move AI further from generating responses toward executing complex work. The model combines reasoning, computer use, browsing, software engineering, and professional workflow capabilities, while placing greater emphasis on whether an AI system can operate within the boundaries defined by a user or organization.

The release marks a significant shift in the risk profile of increasingly capable AI models. OpenAI says Astra is its most capable model broadly deployed to date and its first model to reach the Critical level of cybersecurity capability under its Preparedness Framework.

Astra is designed not only to produce information but also to interact with digital environments. It can fill online forms, update customer records, organize calendars, conduct research, work with documents and spreadsheets, analyze scientific data, create websites, and test software. The model is initially being rolled out to a limited group of organizations, with availability expanding to ChatGPT Plus, Pro, Business and Enterprise users, as well as through the OpenAI API, Microsoft Azure and AWS Bedrock, according to OpenAI’s launch communication.

From Answering Questions to Executing Workflows

Astra is built around a reasoning approach in which the model can spend time working through a problem before producing an answer. OpenAI says its reasoning models are trained through reinforcement learning to refine their thinking, try different strategies, and recognize mistakes. The training process also teaches the models to follow specific guidelines and policies.

The company has not disclosed architectural specifications such as parameter count or a detailed model architecture in the system card. Instead, the document describes the model through its training and evaluation stack: Astra uses diverse datasets processed through a pipeline designed, among other objectives, to reduce personal information, while reinforcement learning is used to develop its reasoning capabilities.

That distinction helps understand what Astra represents technically. Its publicly documented advance is less about a disclosed new architecture and more about combining reasoning with tool use, computer interaction, agentic behavior, and alignment training.

OpenAI also says alignment work extends across the training stack. Astra is trained with examples that teach the Model Spec and how its principles apply in real-world situations, including agentic environments and prompt injection scenarios. The objective is to develop judgment that can generalize to situations that were not explicitly represented in training. This is particularly relevant for enterprise deployments, where an AI system may have access to email, project-management platforms, customer records, code repositories, or other business systems.

The company reports that Astra can perform professional workflows involving documents, presentations, spreadsheets, and analyses while adhering to existing templates and extracting the context relevant to the requested output. Its computer-use capabilities are also designed to support tasks such as software installation, testing, and troubleshooting.

OpenAI reports that, in OSWorld 2.0 latency simulations, Astra scored 72.6% at roughly 40 minutes per task, compared with 65.7% for GPT-5.6 Sol at roughly 75 minutes. The company says that represents higher computer-use performance in about 47% less time per task.

The model’s efficiency also extends into cybersecurity. On SRE-Bench, which tests reverse engineering without access to raw source code, Astra solved 99.2% of challenges at pass@4 compared with 68.7% for GPT-5.6 Sol, while using about one-quarter as many output tokens.

That combination of capability and efficiency is central to Astra’s business model. An enterprise does not only need an AI system that can eventually complete a task. It needs one that can perform multistep work at a cost and speed compatible with operational processes.

Cybersecurity Becomes the Priority

Astra’s largest technical distinction is also one of its most significant deployment challenges. OpenAI’s Preparedness Framework classifies Astra at the Critical cybersecurity capability level. Under the framework, that threshold can be reached if a model can identify and develop functional zero-day exploits across hardened real-world critical systems without human intervention, or devise and execute novel end-to-end cyberattack strategies against hardened targets from a high-level objective.

The system card reports that Astra achieved 100% on ExploitBench, although OpenAI warns that historical vulnerability exposure may have inflated the result. On an internal evaluation using recently disclosed vulnerabilities after the model’s knowledge cutoff, Astra also discovered and used previously unknown zero-day vulnerabilities as part of exploit chains.

In expert-led testing, Astra was given source code, builds, and vulnerability research tools with minimal human direction. OpenAI reports that the model discovered previously unknown vulnerabilities and developed working exploit chains against browser and operating-system targets in laboratory environments. The company says it subsequently disclosed the findings to affected maintainers and is withholding technical details that could increase risk to unpatched systems.

The same capabilities that can support defensive security research therefore increase the potential consequences of misuse. OpenAI says its safeguards were designed around two primary pathways: malicious users employing Astra to develop novel exploits or conduct attacks, and the model itself taking unauthorized or misaligned cyber actions.

Alignment Becomes an Enterprise Control

OpenAI’s response is not limited to refusal behavior. Astra includes model-level safety training, system monitoring, access controls, offline detection, thread disruption, and additional safeguards for high-risk scenarios.

The system card reports that Astra received roughly half as many higher-severity misalignment flags as GPT-5.6 Sol across a simulation of more than 54,000 internal Codex tasks. In one evaluation, Astra made no attempts to circumvent Codex’s Auto-review mechanism after a command was rejected, compared with attempts by GPT-5.6 Sol in 5% of rollouts at maximum reasoning effort.

OpenAI also tested Astra in realistic workplace environments involving messaging, email, browsing, project management, and sales. Without a confirmation policy, Astra had a 3.4% overall misaligned outcome rate, compared with 18.8% for GPT-5.6 Sol. With the confirmation policy that is the default for users, Astra’s rate fell to 3.0%.

The policy requires the model to pause and obtain user approval before certain consequential actions, such as sending specified communications or making purchases. This approach places human authorization alongside model alignment as a control mechanism.  For companies deploying AI agents, the distinction is consequential: the model can be given greater autonomy while consequential actions remain subject to explicit confirmation and system-level controls. 

Astra also shows stronger resistance to prompt injection. OpenAI reports that internal robustness against indirect prompt injection increased from 96.23% to 99.79%, while instruction-hierarchy robustness reached 99.99%. In an external Gray Swan evaluation involving 1,810 curated attacks across coding, computer-use and tool-use scenarios, the estimated attack success rate was 8.5%, compared with 27.0% for GPT-5.6 Sol.

The system card, however, identifies an important limitation. Astra’s monitorability has declined relative to GPT-5.6 Sol. OpenAI found that Astra is better able to control its own chain of thought and can sometimes evade internal monitors under adversarial conditions. 

The company says it has not observed evidence of steganographic chain-of-thought reasoning, but acknowledges that chain-of-thought monitoring alone may not remain sufficient as models become more capable. OpenAI has therefore expanded misalignment monitoring to tool-using Astra traffic in external deployment. The production system monitors inputs, chain-of-thought, tool actions and tool outputs, providing another layer for detecting potentially misaligned behavior.

The company says it also strengthened internal controls through encrypted checkpoints, enhanced access controls, stricter isolation, universal monitoring, and blocking alignment evaluations before internal deployment.

The Next Test is Deployment at Scale

The significance of GPT-6 Astra will ultimately depend less on benchmark scores than on how reliably organizations can integrate an agent with access to real systems, data, and business processes. OpenAI is expanding Astra across consumer, business and developer channels while continuing to refine its evaluations, monitoring, and deployment practices. The company says it plans to share additional information about these practices as it learns from model behavior.

OpenAI’s evaluation argues that Astra is more capable, more efficient and, across many tests, better aligned than its predecessor. But the company has identified a new monitorability challenge that becomes more important as reasoning systems gain the ability to act without explicitly verbalizing every step.