September 4, 2026. OpenAI released GPT-6 Astra on Thursday, and if you run a business on ChatGPT the most consequential sentence in the announcement is not about benchmarks. It sits near the bottom, under Availability: "Enterprise administrators can enable Astra for their workspace; access is off by default at launch." The most capable computer-use model OpenAI has shipped arrives switched off in exactly the accounts paying the most for it. The second most consequential sentence describes what happens when a safety check fires, and it behaves differently depending on whether your automation runs inside ChatGPT or through the API. Neither line is in the headlines.
What OpenAI actually shipped
- GPT-6 Astra, announced September 3, rolling out first to a limited set of organizations, then to all ChatGPT Plus, Pro, Business and Enterprise users, and through the OpenAI API, Microsoft Azure and AWS Bedrock.
- A step change in computer use. On OSWorld 2.0 Astra scores 72.6% against 65.7% for GPT-5.6 Sol, and OpenAI reports it does so in roughly 47% less time per task. Paired with an updated Codex harness, OpenAI claims 1.9x faster task completion on Mind2Web.
- Benchmark saturation. 97.6% on FrontierMath Tier 4, 99.9% on ARC-AGI-3, 92.7% on ScreenSpot-Pro, and 100% on ExploitBench.
- A Critical cybersecurity classification, the first model to meet that threshold under OpenAI's Preparedness Framework. The public version refuses advanced offensive work such as writing proof-of-concept exploits.
- Template-following output. OpenAI positions documents, spreadsheets and slide decks that match your existing templates and house style as the headline professional-work advance.
- API pricing of $10 per million input tokens and $50 per million output tokens, with a Fast mode at twice the speed and twice the price.
- Off by default in Enterprise workspaces. An administrator has to turn it on before anyone on the plan can use it.
The line most coverage skipped
Buried in the deployment section, OpenAI describes what happens when its misalignment monitoring intervenes: "Extra safety checks can sometimes slow, pause, or stop legitimate work, including defensive cybersecurity. If a task is paused in ChatGPT or Codex, you may be asked to review the action before continuing. In the API, the task will stop."
Read the whole sentence rather than the first clause. Inside ChatGPT, a flagged action produces a prompt and a person decides. In the API there is no prompt, because there is nobody sitting there to answer it. The task stops.
That is the entire difference between a supervised session and an unattended automation, and it lands on the exact workloads agencies build: a nightly enrichment run, a lead-routing agent, a reporting job that assembles a client deck before the morning call. None of those has a human available to approve an action at 2am. The ChatGPT version of that workflow waits for you. The API version is simply not finished when you wake up, and unless you instrumented it, the only evidence is an empty output folder.
OpenAI is candid that this catches correct work: "These checks can sometimes interrupt legitimate work, and we are continuing to iterate on this system to reduce unnecessary interruptions." That is a vendor telling you in writing, before you deploy, that a share of your valid jobs will halt. It is a good disclosure. It is also a design constraint, not a footnote, and it is the first thing to build around.
Off by default is not a rounding error
The admin gate produces an outcome worth naming plainly. An individual paying for Plus receives Astra as the rollout reaches them, without doing anything. An organization on Enterprise does not, until an administrator opens the workspace settings and enables it. For a stretch of days or weeks, the cheapest tier in the product line is running the newest model while the most expensive one is not.
This is the same shape as a pattern we keep meeting in agency software: a capability ships opt-in, the release notes say it is available, and the accounts that were sold on it quietly do not have it. HighLevel did the same thing with form scheduling the week before. The lesson generalizes. When a vendor announces something you are paying for, the release note is a claim about the product, not a statement about your account. Check the account.
What the price actually is
Astra usage is included within existing subscription allowances, and OpenAI says users and businesses will also be able to buy credits for additional usage. So the subscription is a floor with a metered tail above it, and any team that shifts real agent workloads onto Astra should expect to meet that tail.
On the API, the ratio matters more than the headline. Output tokens cost five times input tokens, $50 against $10 per million. Agentic computer-use work is output-heavy by nature, because the model is writing actions, not just reading context. That means the size of your bill is decided by how much the model writes to finish a task, not by how much you feed it.
OpenAI leans on exactly this point, reporting that Astra uses about 65% fewer output tokens than Claude Opus 5 on Agents' Last Exam, and estimating roughly 31% lower API cost than Claude Fable 5.1 on Terminal-Bench Science. Those are the vendor's own comparisons against rivals it selected, and they should be read as marketing until you reproduce them. The structural point survives anyway: on a five-to-one output ratio, token efficiency is the variable that decides cost, so benchmark a model on your own tasks by total spend per completed job rather than by price per million.
What it means for operators
Check whether it is switched on before you plan around it. If you run ChatGPT Business or Enterprise, an administrator has to enable Astra. Until someone does, every plan built on it is theoretical, and the people on your team who read the launch coverage will assume otherwise.
Treat a stopped API task as its own outcome. Most automation error handling has two branches, success and failure. A safety stop is neither: it is a job that ran, did not finish, and did not throw the error your retry logic is watching for. Add a completion check on the artifact itself, not on the HTTP response, and alert a human when a scheduled job produces nothing. This is standard practice in the AI automation work we build for clients, and it is the single cheapest change on this list.
Do not migrate a working pipeline in launch week. A higher benchmark score is not a reason to move production. Run your own evaluation on your own tasks, measure cost per completed job, and count how often the safety monitor interrupts you. Then decide.
Build the template before you buy the model. Astra's professional-work advantage is that it follows your templates and matches your style. That advantage is worth nothing to an agency whose client reports are improvised each month. The asset that makes this model pay is a real, versioned template for every recurring deliverable, and that is work you can do this week without waiting for anyone's rollout.
What this does not say
The Critical label is not a defect notice. It describes measured cyber capability against a published threshold, not a flaw, and the shipped model refuses offensive tasks. Sanchit Vir Gogia of Greyhound Research, quoted in CSO's coverage, put the sharper version of it: the capability did not change between August, when OpenAI said Critical could not be ruled out, and the launch, when it said the threshold was met. The testing changed, not the model. Which means the unlabeled models already sitting behind credentials in your stack are not safer than Astra. They are unmeasured. We covered the August disclosure when OpenAI first flagged it.
Nor does any of this mean the monitoring works for you. OpenAI reports that Astra's written reasoning is harder to monitor than its predecessor's, and its own monitoring covers its deployment, not your audit trail. If you need to prove to a client or a regulator what an agent did inside their systems, that logging is still yours to build. If you want help scoping it, that is the sort of thing our AI engineers spend most of their time on.
Frequently Asked Questions
GPT-6 Astra is OpenAI's frontier model, announced on September 3, 2026. OpenAI describes it as state of the art on computer use, browsing, software engineering, cybersecurity and professional work, reporting 72.6% on OSWorld 2.0, 97.6% on FrontierMath Tier 4 and 99.9% on ARC-AGI-3. It is rolling out to ChatGPT Plus, Pro, Business and Enterprise users and through the OpenAI API, Microsoft Azure and AWS Bedrock.
Not automatically. OpenAI's announcement states that enterprise administrators can enable Astra for their workspace and that access is off by default at launch. Somebody with administrator rights has to switch it on. Individual Plus and Pro subscribers receive it as the rollout reaches them without taking any action.
OpenAI lists standard API pricing at $10 per million input tokens and $50 per million output tokens, with separate rates for cache reads and writes. A Fast mode runs at up to twice the speed for twice the standard price. Because output costs five times input, the practical cost driver on agent workloads is how many tokens the model writes to finish a task, not the headline rate.
It depends where the task runs. OpenAI states that if a task is paused in ChatGPT or Codex you may be asked to review the action before continuing, but in the API the task will stop. That distinction matters for unattended automation, because a scheduled API job has no human available to approve the action and will simply end without producing its output.
No. The rating describes measured offensive-security capability against a published threshold in OpenAI's Preparedness Framework, and the publicly available version refuses advanced offensive tasks such as building proof-of-concept exploits. Analysts have pointed out that the classification reflects a change in testing rather than a change in the model, and that other frontier models in common business use have simply never been measured against the same threshold.
Not on the strength of benchmark scores alone. Run your own evaluation on your own tasks first, measure total cost per completed job rather than price per million tokens, and check how often the safety monitor interrupts a run. Then add handling for a stopped task, which is a separate outcome from both success and an error, before you put it in front of clients.