OpenAI releases GPT-6 Astra, its most capable model yet

On 3 September 2026, OpenAI released GPT-6 Astra, a model it describes as the most capable it has built. The launch was a staged one. The model went first to business customers in OpenAI’s Trusted Access Program, with access through the API and for subscribers to ChatGPT Plus, Pro, Business and Enterprise expected to follow in the coming days.

The headline numbers give a sense of the jump. GPT-6 Astra has a context window of 1.05 million tokens and can produce up to 128,000 tokens in a single response. It takes text and images as input and returns text, and it is built to use tools: web search, file search, code writing and execution. OpenAI says it is markedly better at programming, research, operating a computer and handling long, multi-step tasks, and that it can turn a user’s template into a finished document, spreadsheet or presentation. On the API, pricing is $10 per million input tokens and $50 per million output tokens.

The part of the announcement that drew the most attention was security. OpenAI says GPT-6 Astra is its first model to reach its “key” level of cybersecurity capability, meaning that, given the right tools and access, it can find previously unknown vulnerabilities in well-protected systems and develop ways to exploit them without step-by-step human guidance. That is a powerful claim and, on its face, a dangerous one. The company acknowledges the risk and says it strengthened safeguards and monitoring against misuse before release, and that some of the model’s most advanced security capabilities will be subject to stricter access limits.

There is a lot to say about a model like this, and most of it is not about benchmarks. The steady pattern in AI over the past few years has been more capability followed by more caution, and GPT-6 Astra fits it. What is new is that the capability now includes the tools to attack computer systems, and that a company is selling it, within limits, to whoever pays. Whether the guardrails hold will depend on how well OpenAI can restrict access to the dangerous parts of the model while letting the useful parts reach everyone.

The larger question is the same one that has followed every release since ChatGPT: what happens when a model this capable stops being a novelty and becomes the default way people write code, run research and do their jobs. GPT-6 Astra is a step in that direction, and the rollout, careful and staged, shows that even the company building it is not sure how fast that step should be, and neither am I. What would worry me is less that the model exists and more that its most dangerous capabilities are being sold, within limits, to whoever can pay. Guardrails that rely on the seller’s own discretion are only as strong as that discretion.