GPT-6 Astra Reaches Human-Level Computer Use — and OpenAI Locks the Cyber Door Behind It

OpenAI shipped GPT-6 Astra on Thursday, and the launch is really two announcements wearing one name. The first: an agent model that, by OpenAI's own numbers, crosses the human baseline on the benchmark that measures whether an AI can actually operate a computer. The second, quieter one: the most capable hacking model ever released is not actually being released — not to everyone, not yet. Astra is the first model OpenAI has designated a "Critical" cybersecurity capability under its Preparedness Framework, and the rollout is shaped entirely by that designation.

Both halves matter more than the benchmark table.

What OpenAI actually shipped

Astra is a computer-use flagship: text and image in, text out, a 1,050,000-token context window, 128,000-token maximum output, and an April 30, 2026 knowledge cutoff, per the launch-table breakdown compiled by LLM-Stats. It exposes five reasoning-effort levels from the API default "low" up to "max," and it is aimed squarely at long-session agentic work: driving desktop software, professional document and slide generation, extended coding runs in Codex, and — with heavy caveats below — defensive security work.

Pricing lands at $10 per million input tokens and $50 per million output tokens, with cached input at $1, cache writes at $12.50, batch and flex processing at half rate, and a fast mode at double rate. Long prompts past 272K tokens pay a 2× input surcharge. Availability is staged: Trusted Access Program enterprises first, then Plus, Pro, Business, Enterprise, and the broader API "in the coming days".

Every score below is self-reported by OpenAI and not yet independently verified — worth saying plainly, because launch-day numbers from frontier labs have a history of shrinking under third-party measurement.

The number that matters: 72.6 on OSWorld

OSWorld 2.0 measures the thing every "agent" pitch deck promises: given a real operating system, real applications, and a task, can the model actually do it? Human testers score roughly 72% on this benchmark. Astra self-reports 72.6%.

That's the headline, and it deserves both the excitement and the asterisk. The excitement: computer use has been the gap between agent demos and agent deployments for two years, and a model at human baseline on OSWorld is the strongest claim yet that the gap is closing. The asterisk: the same launch table shows AutomationBench at 41.4 — meaning that on longer-horizon, messier automation work, the model still fails most of the time. Astra also posts 91.5 on BrowseComp, 92.7 on ScreenSpot-Pro without tools, and near-saturation scores on the ARC-AGI suite (third-party trackers list ARC-AGI-3 between 98.6 and 99.9 depending on effort tier, with ARC-AGI-2 at 95.0). The pattern is consistent: superhuman at locating, reading, and reasoning about what's on a screen; human-level at short operating tasks; still unreliable at long chains of them.

For the agent economy, human-baseline OSWorld is the moment enterprise buyers have been told to wait for. The honest read of the full table is that "AI employee" remains a horizon claim — but "AI that completes the computer tasks you'd hand a temp" just became a benchmark reality, at $10 per million tokens.

The cyber lock is the bigger precedent

Astra self-reports 100% on ExploitBench and 85.4 on SEC-Bench Pro — and OpenAI's response to its own numbers is the story. By designating the model a Critical cybersecurity capability, the company triggered the strictest tier of its Preparedness Framework: advanced cyber workflows route through the Trusted Access and Daybreak programs, defender access is restricted at launch, and the general rollout ships with the offensive-security surface gated.

This is the first time a frontier lab has shipped a flagship while formally invoking its own catastrophic-capability threshold to constrain it. Whatever you think of self-regulation, a precedent now exists: capability tiers with teeth, applied at launch, by the vendor. Expect it to be cited — by regulators drafting rules, by rivals marketing "less restrictive" alternatives, and by enterprise security teams asking why their tooling vendor has weaker gating than their model vendor.

The near-term commercial effect runs through the security industry. A model that maxes an exploit benchmark but is only distributed for defense is, functionally, a defensive-security product — patching, secure code review, exposure analysis — arriving with built-in scarcity. That lands directly in the market where every major security vendor is racing to bolt agents onto their platforms; a gated frontier model raises the value of whoever holds distribution rights inside the gate. It is also worth noting what ExploitGym's 42.4 concedes: sustained, end-to-end offensive campaigns remain hard even for Astra. The lock is precautionary, not proof of an autonomous attacker.

The economics: identical sticker, very different cache

Astra's $10/$50 base rate matches Anthropic's Claude Fable 5.1 to the dollar — released two days earlier, and clearly priced against it. The divergence is in caching: Fable reads cached input at $0.25 per million tokens; Astra charges $1, plus $12.50 for cache writes.

For chat, that's a footnote. For agents, it's the whole bill. Long-running agent sessions re-read enormous cached contexts on every step — the working memory of the task — so cached-input pricing compounds across thousands of steps in a way base rates never touch. A four-times cache premium means that for sustained agent workloads, the identical sticker prices conceal a materially higher effective rate on Astra, partially offset by its 47%-faster per-task completion claim (fewer steps, fewer reads). Teams budgeting agent deployments should model their own read/write mix rather than trusting either vendor's headline number; the honest answer is that Astra costs more per unit of remembering and possibly less per unit of finishing.

The 272K long-prompt surcharge points the same direction: OpenAI is pricing the model to discourage lazy million-token stuffing and reward disciplined context management — a tax on exactly the workloads the giant context window advertises.

Three frontier launches in one week

Zoom out and the calendar is its own story. Anthropic shipped Claude Fable 5.1 on Monday, Google pushed out Gemini 3.8 Flash and its Cyber variant on Wednesday, and OpenAI answered with Astra on Thursday — three frontier releases in four days, each priced or positioned against the one before it. The cadence that used to be annual is now weekly, and that changes how buyers should behave: model choices made on launch-day benchmarks have a shelf life measured in days, while contracts and integration work last quarters.

The interesting divergence is in restriction philosophy. Google shipped a dedicated Cyber variant as a separate product; Anthropic is positioning Fable as the cheaper, less-restricted option; OpenAI gated its most capable surface behind an access program. Three labs, three different answers to the same question about who gets dangerous capability — and for the first time, that answer is a bigger differentiator than the benchmark deltas between them.

For teams building on these models, the practical guidance is unglamorous: pin versions, benchmark on your own workload rather than leaderboards, and price the cache behavior, not the sticker. The frontier is moving too fast for anything else to hold.

Where this lands for the AI trade

Astra arrives while OpenAI sits in its strangest financial moment: a confidential S-1 on file, a reported $852 billion final private round, and a listing timeline that has reportedly slid toward 2027 — meaning this launch is effectively a pre-IPO product milestone for the most anticipated offering in market history. A credible claim to human-level computer use strengthens the exact story the eventual roadshow has to sell: that the spend on compute converts into capability nobody else can match. The same dynamic is playing out at Anthropic, which filed within days of its rival.

For public-market investors the readable effects are second-order: defensive-security vendors gain a new class of gated tooling to integrate, hyperscalers gain another workload wave as agent deployments scale, and every enterprise-software company gets asked on its next earnings call what human-level computer use does to seat-based pricing. None of that resolves this week. All of it got more concrete on Thursday.

What to watch next

Independent evals. OSWorld and the cyber suite will be re-run by third parties within weeks; if 72.6 survives external measurement, the agent-economy timeline genuinely moved.

Who gets through the gate. The list of Trusted Access security partners will say whether the Critical tier is a safety program or a distribution deal — and which security vendors just gained a moat.

Anthropic's counter. With Fable 5.1 holding the cache-price advantage and marketing itself as the less-restricted option, the next move in the frontier duel is Anthropic's — and enterprises running both will publish the cost comparisons the vendors won't.

The regulatory echo. The first formally self-gated frontier launch hands policymakers a template. Whether the next AI bill references the Preparedness Framework by name is now worth watching.

Sam Altman's company has spent a year being judged on products and valuations. Astra is a reminder that the capability curve underneath is still moving — and that the most interesting decisions at the frontier are no longer about what the models can do, but about who is allowed to find out.