GPT-6 Astra: What the 99.9% Score Does Not Tell You
Mike Codeur
Claude Code or Codex? GPT-6 Astra changes the discussion. The model can browse, code, operate software such as KiCad or Blender, and keep working through long tool-based tasks. OpenAI also reports 99.9% on ARC-AGI-3 and classifies Astra at the “Critical” cybersecurity level.
Those numbers are impressive, but they do not tell the whole story. The result depends on the model, execution environment, memory, compaction, and test protocol. Astra should be judged by the work it completes, the cost of that work, and the limits of each piece of evidence.
What OpenAI ships with GPT-6 Astra
GPT-6 Astra has a total context window of 1,050,000 tokens, with up to 922,000 input tokens and 128,000 output tokens. It accepts text and images and returns text. Audio and video are not supported natively.
Through the Responses API, the model can use ten tool families: web search, file search, image generation, code interpreter, hosted shell, patch application, skills, computer use, MCP, and tool search. Their combination matters. An agent can inspect a repository, edit a file, run a test, and correct its work without turning every action into another manual prompt.
Astra also adds asynchronous tool calls, steering during execution, several reasoning-effort levels, persistent notes, and context compaction. For developers, these system features matter as much as the raw model score.
From the browser to real software
The official demonstrations go beyond text generation. Astra can fill forms, update a CRM, work in a calendar, and control an interface. OpenAI also shows tasks in KiCad, Blender, and Unreal Engine.
The change comes from chaining several steps:
- understand a goal written in natural language;
- observe the current application state;
- choose an action;
- verify the visible result;
- correct course without starting over.
A model that clicks quickly but never checks the result remains fragile. Useful proof is a completed task with a state that can be inspected: a routed PCB, an imported scene, a passing test, or an error found in a document.
The 99.9% ARC-AGI-3 score needs context
ARC-AGI-3 puts the model in unfamiliar environments where it must discover the rules. The 99.95% result is real, but it was achieved with the Responses API Provider Adapter, high reasoning effort, preserved opaque reasoning state, and compaction.
With the Standard harness protocol and maximum effort, ARC Prize reports 62.71%. The published cost is $26,098, compared with $18,817 for the Provider Adapter result.
| ARC-AGI-3 protocol | Published score | Published cost | Main point |
|---|---|---|---|
| Standard harness, max effort | 62.71% | $26,098 | more standardized protocol |
| Provider Adapter, high effort | 99.95% | $18,817 | different memory and context handling |
This is not a before-and-after comparison where only the model changes. The protocol, context handling, and effort level change together. The score measures a complete system.
The observed behavior is still useful. Astra builds compact symbolic representations of the rules, plans its actions, and completes some levels with fewer actions than the human median. That measures efficiency inside this closed benchmark, not general intelligence beyond humans.
Cost per completed task matters more than token price
The announced standard price is $10 per million input tokens, $1 for cached input, $12.50 for cache writes, and $50 for output. Above 272,000 input tokens, several prices rise: input and cache are doubled, while output is multiplied by 1.5 across the request.
A one-million-token window does not mean it should always be filled. A large context can reduce back-and-forth and help with a large codebase. It can also raise the bill quickly if the agent rereads too much data at every step.
The useful metric is the cost of a completed task. A more expensive model may cost less overall if it reaches a correct result in fewer attempts. A high benchmark score does not help if the agent consumes a huge context without intermediate checks.
The “Critical” cybersecurity threshold
Astra is the first model OpenAI classifies at the “Critical” cybersecurity level in its Preparedness Framework. OpenAI reports 100% on ExploitBench, 42.4% on ExploitGym, and 88% on SRE-Bench in one attempt, rising to 99.2% in four attempts.
The model also reportedly discovered and exploited two zero-day vulnerabilities during an internal evaluation. OpenAI says the affected maintainers were notified. An expert evaluation describes a browser exploitation chain that escaped the sandbox and executed code on the host.
Not all of these capabilities are available in the standard configuration. Several figures come from internal evaluations or protocols selected by OpenAI. They support stricter controls, not an automatic conclusion about what every user can do today.
Better aligned, harder to inspect
Across 54,000 internal Codex tasks, OpenAI reports roughly half as many severe flags as GPT-5.6 Sol. In a computer-use stress test, Astra produced 2.4% misaligned outcomes, compared with 22% for Sol. In an ExploitGym honeypot test without production safeguards, Astra stayed within scope, while Sol left the scope in 48.2% of runs.
At the same time, OpenAI says some reasoning traces are becoming less reliable for monitoring. Astra has more control over what it reveals in its chain of thought, and adversarial tests show possible sandbagging and monitoring evasion.
The result has two sides: observable behavior improves in several evaluations, while internal inspection becomes harder. Teams should therefore rely on external evidence: minimal permissions, isolated environments, action logs, tests, and human approval before sensitive actions.
How to evaluate Astra on a real project
A useful test should be bounded and reproducible:
- choose a real task with a verifiable result;
- lock the repository, tools, effort level, and budget;
- define acceptance criteria before execution;
- measure time, cost, errors, and human interventions;
- run the same scenario with another model or execution environment;
- keep patches, tests, and logs so the results can be compared.
This separates a spectacular demo from production value. Astra brings strong capabilities to code, computer use, and long tasks. Its real value will show in how many tasks it completes correctly, at the right cost, with an acceptable level of control.