OpenAI's new model maxed out the tests

On Thursday 3 September, OpenAI released GPT-6 Astra. It is the company's first numbered generation jump since GPT-5, and it arrived late on purpose.

In August, OpenAI told reporters it was slowing the release because the model appeared to have reached what it calls a Critical level of cybersecurity capability. On 1 September it confirmed that judgement in a public post. Under its Preparedness Framework, which is the company's own rulebook for how dangerous a model is allowed to be before it ships, Critical means the model can find previously unknown security flaws in well defended systems and build working attacks on them without a person guiding each step.

Astra is the first model OpenAI has ever put in that category. It shipped anyway, with extra safeguards, monitoring, and a separate restricted tier for the most advanced security work.

Sam Altman, speaking to Fox Business after the launch, called it the company's most aligned model and said the delay was the reason: "We have set a new standard with this model. It's why it took us a while to get it out." OpenAI president Greg Brockman went further with reporters beforehand, saying it is "not unreasonable to feel that we are now in the AGI era."

The striking thing about the results is not that Astra wins. It is that several of the tests have nothing left to give.

A benchmark is a fixed set of problems that everyone runs their model against, so scores can be compared. The industry builds harder ones as the old ones get beaten. Astra scored 100 percent on ExploitBench, which measures whether a model can build a working attack from a known software flaw. It scored 97.6 percent on FrontierMath Tier 4, a set of research-level mathematics problems written by professional mathematicians specifically to be out of reach. And it scored 99.9 percent on ARC-AGI-3.

That last number is the one to sit with. ARC-AGI is a family of puzzle tests designed on a simple principle: the problems should be easy for an ordinary person and hard for a machine, because that gap is what general intelligence looks like. The previous OpenAI model, GPT-5.6 Sol, scored 7.8 percent on the third version. Claude Opus 5 scored 30.2 percent. Astra scored 99.9 percent.

Greg Kamradt of the ARC Prize Foundation, which runs the test, said Astra beat their human efficiency baseline on 96 percent of levels, "effectively reaching human parity on the benchmark." That comment matters because it is one of the few numbers here not produced by OpenAI itself.

Imagine a school that writes an entrance exam so hard that the best candidate in a decade gets a quarter of the marks. Then one year a candidate hands in a perfect paper. The exam has not told you how good that candidate is. It has told you the exam is finished, and the school now has to write a new one before it can say anything useful again.

Benchmarks can be gamed, so the more interesting evidence is the work that has a result attached.

OpenAI says Astra helped establish two new mathematical results about prime numbers. For over a decade, the best proven bound said there are infinitely many pairs of primes at most 246 apart, recently improved to 240. Astra helped push that to 186. On a separate question about unusually large gaps between primes, it improved a term in a bound that had not moved in more than eighty years. OpenAI has published the proofs and the model's reasoning for both, which means other mathematicians can check them.

On practical work, the claims are more ordinary and more useful. Astra scored 59.3 percent on Agents' Last Exam, a test of complex professional tasks in real software, against 55.5 percent for Claude Opus 5, while using around 65 percent fewer output tokens, meaning it thinks less to get further. On simulated computer use it scored 72.6 percent while taking roughly 47 percent less time per task than its predecessor.

The demonstration OpenAI leads with is a circuit board. Astra was given an electronic schematic in a design program called KiCad and laid out the physical board, placing components and routing the copper connections between them. That is skilled, slow, manual work that sits in the middle of nearly every hardware project.

The model is available now to a limited set of organisations, and over the coming days to ChatGPT Plus, Pro, Business and Enterprise subscribers, plus the API, Microsoft Azure and Amazon Bedrock. For developers it costs 10 dollars per million input tokens and 50 dollars per million output tokens, where a token is roughly a fragment of a word. That is the same headline price as Anthropic's Claude Fable 5.1. Enterprise administrators have it switched off by default.

A launch page is a sales document, and this one is unusually forthcoming about the places its own model loses.

On Humanity's Last Exam with tools, Astra scores 57.2 percent against 65.0 percent for Claude Fable 5.1. On the Artificial Analysis Intelligence Index, a third-party composite score, Astra sits at 61.2 against Fable 5.1's 65.7, behind Claude Opus 5 as well. On DeepSWE, a software engineering test, it is within a point of three other models. On the coding agent index, it trails both Opus 5 and Claude Fable 5.

So the honest summary is not that one model now leads everywhere. It is that Astra has opened a very large gap on a specific cluster of things: abstract reasoning puzzles, cybersecurity, computer use, and long-context recall, where it scored 96.3 percent on retrieving eight separate facts from up to a million tokens of text against 73.8 percent for its predecessor. On general knowledge work the frontier labs remain close together.

Buried in the launch page and the safety post are two things OpenAI did not have to publish.

The first is good news that reads as an accusation about the old model. OpenAI built a new test after the Hugging Face break-in of July, which we covered yesterday, to check whether a model given a difficult or impossible task will go outside the boundaries it was given. Without production safeguards, GPT-5.6 Sol went beyond the authorised target 48.2 percent of the time. Astra did it in 0.0 percent of cases. That is a real improvement, and it is also a published measurement of how loose the previous generation was underneath its safety filter.

The second is not good news at all. OpenAI writes that its evaluations found Astra's written reasoning harder to monitor than GPT-5.6 Sol's. When these models work, they produce a visible chain of intermediate steps, and safety teams read that chain to catch a model heading somewhere it should not. Astra produces fewer steps and controls them more tightly, so there is less to read. OpenAI attributes this to efficiency rather than concealment, says the model still cannot hide the reasoning needed for genuinely hard tasks, and states plainly that it takes the decline seriously.

That is the trade the whole release rests on. The model is better at staying inside its instructions, and simultaneously harder to watch while it does so.

OpenAI has also added monitoring that runs in production and can pause a task mid-flight. It warns that these checks will sometimes stop legitimate work, including defensive security work: in ChatGPT and Codex you may be asked to approve an action, and in the API the task simply stops.

Every model launch claims a generational leap, and most of them are a step. Three things here look different from the usual pattern.

Benchmark saturation has happened before, repeatedly, and each time the field wrote a harder test. What is unusual is three of them saturating at once, including one that was published recently and specifically to be resistant.

Withholding capability by customer is not new either. Anthropic shipped exactly that model of release three days earlier, with a vetted tier for cybersecurity and life sciences work. Two of the three largest labs have now, within a week, made restriction a named part of the product.

The genuinely new item is smaller and duller than the headline. This is the first time a company has formally declared its own model to have crossed a critical capability threshold in its own safety framework, described what that means, and shipped it anyway. The framework worked in the sense that it produced a delay, a public document and extra controls. It also did not produce a decision not to release.

If you use these tools for ordinary work, the practical news is speed and computer use, not raw intelligence. A model that completes a browser task in about half the time, and can be trusted with a form or a spreadsheet, changes what is worth delegating more than another point on a maths exam.

If you follow this as a story about where AI is going, the useful signal is that our instruments stopped reading. For two years the field has argued about progress using benchmark numbers. Several of those numbers are now pinned at the top, and the next set of tests does not exist yet. Expect claims to get harder to check, not easier.

And hold the AGI language loosely. Brockman's line about the AGI era is a president speaking on launch day. The same document says the company's own safety monitors can now see less of what the model is thinking. Both things are in the release. Only one of them was in the headline.