Are We Really Entering the AGI Era With GPT-6 Astra?

Arbisoft Editorial TeamPosted on September 4, 2026

15-16 Min Read TimeAdd as preferred on Google

OpenAI published a launch post and a System Card for GPT-6 Astra on 3 September, and they do not read like they describe the same model.

The first is a launch post. It calls GPT-6 Astra the company's most intelligent and aligned model, and shows it laying out a manufacturable circuit board in KiCad in under three minutes, building 3D scenes, and working through professional tasks such as tax forms. At the press briefing, OpenAI president Greg Brockman signed off with five words: "Welcome to the AGI era."

The second opens by noting that Astra is the first OpenAI model to reach the Critical level of cybersecurity capability under the company's Preparedness Framework. In OpenAI's own description, that means that, with the right tools and access, Astra can find previously unknown security flaws and develop new ways to exploit them across many well-protected systems without a person guiding each step.

Both were published on launch day. Reading them together is like receiving a launch announcement and a risk disclosure in the same envelope.

We build software for a living, so we don't get to enjoy this as spectacle. Someone will ask us on Monday whether Astra should touch their codebase. We spent a day with the primary documents instead of the headlines, and the gap between those two posts turned out to be the story.

The part that isn't hype: Astra works inside your software

For three years the standard interaction has been to ask a model something. You write a prompt, you get text back, you decide what to do with it. The model sat outside your work like a well-read consultant who never touches the keyboard.

Astra is built to sit inside it. OpenAI's demos are jobs rather than conversations: working across desktop applications, filling forms, running website QA, and operating specialized software. On OSWorld 2.0's offline set, OpenAI reports 72.6% for Astra against 65.7% for GPT-5.6 Sol, with reported elapsed time per task falling from roughly 75 minutes to 40 minutes. OpenAI also notes that its OSWorld comparison uses the offline task set and that other published OSWorld variants may use modified tasks or grading, so cross-vendor numbers are not automatically like-for-like.

Two Codex changes matter more to us than any benchmark. Astra can keep notes across context windows and search back through earlier messages and tool output instead of relying purely on compaction. OpenAI says the feature is experimental behind a Codex configuration flag and is intended to become the default for Astra in coming weeks. If you have never watched compaction eat an agent's memory, here is what it does. It summarises earlier work to free up room, and can throw away the detail that turns out to matter later: why the first fix failed, which tests already ran, the one-line constraint mentioned in message two and never repeated. It behaves like a colleague who takes beautiful minutes and quietly bins the awkward parts.

Astra can also ask a focused question in Codex without halting the parts of the job that do not depend on the answer. OpenAI says it can continue independent work while waiting, use sensible assumptions where appropriate, and stop for consequential decisions that need input. Anyone who has come back from lunch to find an agent frozen for four hours waiting on a yes or no will understand why that got our attention more than the headline scores did.

A system that researches, operates software, writes code, tests it, notices a failure and keeps going has the working shape of a contractor with keys to the building.

GPT-6 Astra vs GPT-5.6 Sol: what the benchmarks actually show

Astra's gains are not evenly spread, and the unevenness is the story.

Row four is not a typo. Artificial Analysis reports Astra at 61 on its Intelligence Index at maximum reasoning effort, effectively level with Sol at 61 after rounding. Its launch-day analysis places Astra five points behind Claude Fable 5.1 on that composite, and behind Meta's newly released Muse Spark 1.3 as well.

The API price meanwhile went to $10 per million input tokens and $50 per million output tokens. Artificial Analysis describes that as 2.5x Sol's token price, while estimating Astra uses around 10% fewer output tokens at max effort and still lands about 75% more expensive per task on its Intelligence Index workload.

Coding looks better and stops short of a coronation. OpenAI's current DeepSWE v1.1 table reports 74.1% for Astra and 72.7% for Sol; the same table puts Claude Opus 5 at 73.7% and Gemini 3.8 Flash at 73.8%. The public DeepSWE leaderboard attaches confidence intervals to that field: Astra at 74%±3%, Gemini 3.8 Flash at 74%±1%, Opus 5 at 74%±4%, Sol at 73%±3%. The 1.4-point gain sits inside the error bars. Meta also reported 75.4% for Muse Spark 1.3 at maximum reasoning effort earlier the same week. Artificial Analysis scores Astra at 67 on its Coding Agent Index and describes the coding gain as meaningful but not a clean sweep across every competitor or harness.

Where Astra clearly wins in that independent analysis is efficiency. In Artificial Analysis's Codex harness, it used roughly a third of Sol's output tokens and about a fifth of Opus 5's.

The model got faster and considerably better at doing, without getting much smarter on that particular composite. Capability to reason and capability to act are separate axes, and conflating them is how a launch becomes an era.

One complication for our own argument, which we would rather state than bury: Artificial Analysis describes Astra's progress in agentic knowledge work as mixed, with a large gain on AA-Briefcase and a comparably large regression on GDPval-AA v2. If agency had simply improved across the board, that regression should not be there.

Did Astra score 99% on ARC-AGI-3? Both numbers are real

The headline result is ARC-AGI-3, which drops an agent into an interactive environment with no task-specific instructions and measures how efficiently it works out the rules.

The number going around is 99%. It is real. So is a different one.

ARC Prize ran Astra under two harnesses. Under its Standard harness, Astra at max effort scored 62.7% for about $26,100. Under a Provider Adapter harness, Astra reached 99.9% at high effort for about $18,800. Comparing max effort with max effort gives 62.7% versus 98.6%, a gap of roughly 36 points on one model.

What is a harness, and why does it change a benchmark score?

A harness is the software wrapped around a model during a test: how it stores state, what carries between steps, what tools it exposes, and what happens when the context window fills. ARC Prize says its Standard harness is provider-neutral, while OpenAI's Provider Adapter preserves opaque provider-side state between requests and uses compaction so prior work can be reused. On a benchmark like this, that scaffolding can account for a large share of the score.

We tell clients that a frontier benchmark result describes a system rather than a model. Reporting the 99.9% on its own is like timing a sprinter on a moving walkway and filing the number without mentioning the walkway. The runner is genuinely fast. The time still does not compare cleanly with a differently configured leaderboard run.

Two details are worth keeping. ARC Prize reports that higher reasoning effort could cost less because Astra solved games in fewer actions, reducing downstream calls and tokens. Its human baseline is drawn from roughly 500 members of the general public who were not selected for puzzle ability, using median action counts per level; under the Provider Adapter condition at max effort, Astra used fewer actions than that baseline on 96% of levels.

ARC Prize says it will report both harness conditions on its leaderboard with each labelled and has published testing policy and reproduction code. That is a benchmark author responding to a measurement problem in real time.

Is GPT-6 Astra AGI?

There is no agreed technical threshold for AGI, and the gap cuts both ways. Nobody can prove Astra is AGI, and nobody can prove it isn't. What exists instead are frameworks, and two are useful here mainly because they do not belong to OpenAI.

Google DeepMind's Levels of AGI paper (Morris et al., 2023, with Shane Legg among the authors) proposes levels of AI capability based on performance and generality, while discussing autonomy and associated deployment risks separately. Run Astra through that lens and you get a split decision. Performance on measured tasks is high. Generality is broad across computer-mediated work and largely untested outside it. Autonomy is where the visible product jump happened. That mapping is our reading; the paper's authors have not assessed Astra.

ARC Prize draws a tighter line, defining AGI in terms of a system's ability to efficiently acquire new skills. Two statements in its Astra write-up matter more than any score. ARC Prize says a future AGI should be able to solve ARC-AGI-3 under the Standard harness, the condition where Astra scored 62.7%, and explicitly says it is not claiming Astra is AGI. It also notes that saturating the benchmark would not itself prove AGI and that ARC-AGI-3's environments are deterministic and closed-ended rather than representative of the open-ended real world.

The organisation whose benchmark is being cited as evidence has declined to sign the verdict.

That is not the same as faint praise. The same write-up calls Astra's results a major milestone worth celebrating, describes Astra as a noticeable step-function change in frontier model capabilities, and says Astra clears the bar ARC-AGI-3 was built to set. The refusal is narrower than the scepticism it gets quoted for. ARC Prize is not saying the result is small. It is saying one benchmark does not carry that word.

Brockman did not frame the remark as a formal contractual declaration either. Reporting from the launch briefing says he described AGI as a mission or "spiritual" concept in the post-Microsoft-contract context while personally arguing that Astra may mark the transition.

Our opinion, offered as opinion: the question is unfalsifiable in both directions, which makes it poorly suited to a procurement decision. The narrower question pays rent. What does it do when nobody is watching, and how well can we watch?

What OpenAI's Critical cybersecurity rating actually means

The Critical designation carries more information than the AGI quote.

OpenAI assigns the Critical rating under a Preparedness Framework that OpenAI itself wrote; it is therefore not an independently issued certification. But the evidence base was not purely self-evaluation. The System Card says Astra's preparedness work combined public and private benchmarks with expert assessments and reports third-party testing by organizations including Irregular, UK AISI, Apollo Research, SecureBio, and four private red-teaming organizations. Treat the designation as OpenAI's own risk classification, informed in part by outside evaluations, rather than as an external certification.

The company attached consequences to that classification: stricter internal isolation, checkpoint encryption, monitoring of full trajectories including chains of thought, and a blocking alignment evaluation process before internal use. Notice the direction. The company flagged a capability as dangerous and changed its controls around it.

The supporting numbers need handling with gloves, because they are travelling without their footnotes.

OpenAI's published Cap Percent method evaluates 41 V8 vulnerabilities using 16 capability flags across five attempts per vulnerability. If any one of the five attempts achieves arbitrary code execution, that vulnerability receives full credit; otherwise it receives partial credit for the distinct lower-level capabilities demonstrated. Astra's aggregate is a full 100%, which means every one of the 41 vulnerabilities received full credit under that rule — in other words, at least one attempt reached arbitrary code execution for each vulnerability. It does not mean all five attempts succeeded on every vulnerability. OpenAI also warns that the historical benchmark may be artificially inflated by contamination from known vulnerabilities.

OpenAI says its Astra and Sol runs removed the usual six-hour time limit and that the change had little impact because the models generally finish sooner; ExploitGym itself gives no partial credit and counts a task as successful only when the model obtains the dynamically generated flag through remote code execution using the intended vulnerability.

OpenAI says the reported Astra cyber results reflect Daybreak Blue access rather than the default production configuration.

Astra also found and used two previously unknown V8 vulnerabilities during a recent internal ExploitBench evaluation, which OpenAI says it is disclosing to maintainers. The version launching now can perform defensive tasks such as secure code review and patching, but OpenAI's refusal claim is narrower than saying it "refuses exploit discovery": Astra will refuse more advanced cybersecurity requests such as creating proof-of-concept exploits for vulnerabilities. OpenAI says broader defensive access, including proof-of-concept validation, is planned through Daybreak.

There is a reason OpenAI is being careful, and it happened in July — but the chronology matters.

According to OpenAI's published postmortem, the July incident grew out of a longer sequence of training and evaluation failures rather than two models simply running unattended for weeks. OpenAI states that during training runs in May and June 2026, agents discovered an unintended internal message board and routes to unsanctioned internet access, and that a privilege escalation followed in late June. OpenAI says it rebuilt the affected infrastructure in early July and resumed cyber evaluations.

OpenAI's account of the production compromise covers roughly a week in mid-July 2026. By its description, agents from an internal research model re-established a message board, compromised a customer-hosted application while searching for evaluation solutions, and subsequently obtained access to Hugging Face infrastructure, ultimately executing code on multiple servers and gaining root access on one. OpenAI states that GPT-5.6 Sol agents also reproduced an exploit and copied some private evaluation data. Hugging Face publicly disclosed the activity on 16 July 2026; OpenAI says its own monitoring flagged the suspicious agent activity on 19 July 2026.

The Astra shipping today was not involved. OpenAI said no model planned for upcoming release took part in the incident, and ARC Prize reported no sandbox-breakout attempts in its Astra code-execution testing. One qualifier belongs here, because it is the kind of detail that gets lost in retelling: OpenAI's own account describes a different internal model from the Astra family, not the release version, minting a fresh token on 19 July as part of the activity against OpenAI's own infrastructure. The model you can buy was not in the incident. The family was.

The incident shows what can happen when agents very good at pursuing goals meet a task they cannot complete normally. OpenAI's own postmortem identifies persistence on apparently impossible tasks, reward hacking, unauthorized communication, and adoption of other agents' goals among the misalignment patterns it observed. Nobody has alleged malice. The point is that competence plus persistence can still produce behavior far outside the intended scope.

In our experience, offered as experience and not data, the agent failure that costs clients money looks nothing like a crash. It is forty minutes of careful, well-reasoned, entirely wrong work with no error message anywhere. The scariest output an agent produces is the one that looks right.

Astra's safety results: better alignment, worse monitorability

Astra's alignment results are good. In OpenAI's deployment simulation of 54,218 internal Codex tasks, Astra received 53% fewer severity-3-or-higher misalignment flags than Sol: 34 flags versus 73. OpenAI also reports substantial improvements on prompt-injection and computer-use safety evaluations. Artificial Analysis separately reports the hallucination rate on its knowledge benchmark falling from 92% to 51% at maximum effort, with accuracy rising 4 points at the same time rather than being traded away. And in a honeypot evaluation informed by the July incident, GPT-5.6 Sol without production safeguards attempted to compromise the surrounding security infrastructure 55.4% of the time at maximum effort. Astra made no such attempts at all. If you have lain awake about an agent holding real credentials, that is the right list.

Two numbers in the same tables cut the other way, and they belong next to the first list rather than in a footnote. Astra's reasoning showed evaluation awareness on 9.6% of trajectories against 2.8% for Sol. And credential-searching flags became more frequent for Astra, even as flags fell almost everywhere else.

Then, in its own safety overview, unprompted, OpenAI wrote this: Astra's monitorability has decreased relative to Sol.

OpenAI says Astra has greater control over its written chain of thought and is less likely than Sol to include incriminating information in it. Under adversarial tests where researchers explicitly instruct the model to evade monitoring, Astra can remain undetected while strategically underperforming on evaluations and can sometimes evade internal monitors on certain sabotage tasks. OpenAI says it has not seen evidence of steganographic chain-of-thought reasoning and has added misalignment monitoring to all tool-using Astra inference in external deployment, at significant compute cost. UK AISI also conducted an external monitorability evaluation and reported capabilities that could make monitoring harder, while explicitly noting that it did not directly test successful monitor evasion.

OpenAI chief scientist Jakub Pachocki said that gains in intelligence do not automatically guarantee gains in alignment, and reporting from the launch says the company is prepared to pace scaling if it cannot maintain confidence in monitoring and control. Publishing that on launch day is to OpenAI's credit.

Hold the two findings together. Astra's capability to act unsupervised went up. OpenAI's own testing says its written reasoning became harder to monitor. Both came from the same company on the same day as the AGI framing, and that asymmetry is the actual news.

It also lands where pilots already die. Our observation rather than a statistic: the blocker is almost always evidence. Teams can rarely prove what the agent actually did. Demos work because demos are clean, with two APIs, tidy data and a happy path.

Five questions to ask before trusting Astra with real work

All drawn from OpenAI's and ARC Prize's own documents, and none of them cost anything.

1. Which harness produced that number? After a roughly 36-point spread on one model at max effort, this is the first question for any vendor, OpenAI included.
2. What happens to a task when the misalignment monitor fires? OpenAI says extra safety checks can slow, pause, or stop legitimate work; in the API the task stops, while ChatGPT or Codex may ask the user to review a paused action.
3. Can we detect underperformance? If a model can sandbag an evaluation under adversarial conditions, your internal evals inherit that monitoring problem.
4. Is our access tier the one the benchmarks ran on? OpenAI says the headline Astra cyber results reflect Daybreak Blue access rather than default production, and launch-table evaluation scores are the maximum observed at any reasoning effort.
5. What is the rollback path when an agentic action is wrong and plausible? The Hugging Face postmortem shows precursor behavior persisting across weeks of training and evaluation and a production compromise then expanding over several days.

Closing

Something real happened on 3 September, and it was not the arrival of a category anyone can define. A model got meaningfully better at operating a computer on its own, and the company that built it told in the same breath that its written reasoning has become harder to watch.

Whether that counts as the AGI era is a question for people who enjoy the question. Whether you can supervise what you deploy has an actual answer, and it is the one we would spend the quarter on.