Contents
On September 3, OpenAI shipped GPT-6 Astra, and for the first time attached a label to a model that changes how it can be deployed rather than just how well it scores. Astra is the first OpenAI model to cross the Critical threshold for cybersecurity capability under the company’s Preparedness Framework, meaning it can identify and develop functional exploits against hardened, well-protected systems without a person guiding each step. That is a different kind of announcement than a benchmark leaderboard update. It is OpenAI telling you the model itself is now the thing that needs containing, not just the thing that needs evaluating.
This matters beyond the security beat. Astra is also OpenAI’s new flagship for general use, going into ChatGPT Plus, Pro, Business, and Enterprise, plus the API and AWS. So the same weights that saturate ExploitBench are the ones that will be writing your code, filling your spreadsheets, and browsing on your behalf. Anyone building on the API is inheriting both the capability jump and the safeguard layer that comes with it.
What actually changed
The benchmarks are close to saturated. Astra scores 98% on FrontierMath Tier 4, 99.9% on ARC-AGI-3, and a perfect 100% on ExploitBench, the benchmark that measures a model’s ability to develop working exploits from known vulnerabilities. OpenAI president Greg Brockman called it a “generational leap” and floated that it may eventually be seen as an early arrival of AGI. Take the AGI framing with whatever skepticism you like, but the exploit score is not framing, it is a measured capability that crossed a line OpenAI had defined in advance.
Access to the sharpest edge is gated, not general. Companies in OpenAI’s application-based cybersecurity program get first access, and the safeguards behind that gate are substantial: stricter isolation for internal development, checkpoint encryption, monitoring of full model trajectories including chain of thought, and a blocking alignment evaluation that has to pass before deployment. OpenAI has said this incorporates lessons from an earlier Hugging Face incident, layering post-trained refusals, system-level classifiers, and offline threat detection on top of each other rather than relying on any single defense.
Pricing has a real cliff, not a smooth curve. The API lists $10 per million input tokens and $50 per million output, with reused prompt prefixes cached at $1 per million. But cross 272,000 input tokens in a single request and the whole call reprices: 2x on input and cache, 1.5x on output, for the full request, not just the overage. The context window tops out at 1,050,000 tokens (922,000 max input, 128,000 max output), so a genuinely long-context call is common, and the cliff is easy to hit by accident if you are not watching your token count.
Try it: where your call lands on the pricing cliff
About the calculator
Uses OpenAI’s published list pricing for GPT-6 Astra. The 2x input/cache and 1.5x output multiplier applies to the entire request once input tokens cross 272,000, not just the tokens past the line.Move the slider to see where this call lands.
Slide past 272,000 and the total does not creep, it jumps, because the multiplier applies retroactively to the entire call. A long document analysis or a codebase-wide review can cross that line without anyone deciding to pay double for it.
What this means for you
If you are integrating Astra through the API, the pricing cliff is worth building a guard around before you build anything else: chunk requests to stay under 272K input tokens where the task allows it, and treat any call that must go over as a deliberate, budgeted decision rather than a default. On the safety side, the more interesting question for the next few months is not whether Astra’s exploit-development capability leaks, OpenAI has clearly spent real effort on the gating, but whether the Critical threshold becomes a recurring category rather than a one-off label. My own next step is reading through OpenAI’s safety overview in full before deciding whether any of our tooling should route through Astra’s gated tier at all, versus staying on models that sit below that line.