GPT-6 Astra Ships: What You Can Actually Use

GPT-6 Astra shipped September 3, and the interesting part isn’t the model, it’s the access list. Enterprise partners in OpenAI’s Daybreak cybersecurity program got the full thing first. Everyone else gets a version rolling out over the following days that flatly declines advanced cyber tasks, no matter what plan you’re paying for. That’s the same threshold OpenAI disclosed in August, now made visible in the product itself instead of in a safety framework document.

What shipped, and to whom

Three weeks ago, OpenAI said Astra had crossed a “critical cybersecurity threshold” during internal review, capable enough at independently finding and weaponizing zero-day exploits that the company slowed parts of its development and added extra containment before shipping. That disclosure was about a safety process. This is the product that came out the other end of it, and it shipped with the restriction baked directly into who gets what.

Daybreak, OpenAI’s vetted enterprise cybersecurity program, gets Astra’s defensive capability: vulnerability discovery, patch verification, the kind of work security teams do to find their own holes before someone else does. Explicitly excluded, even for Daybreak partners, is developing exploits or running actual attacks. Everyone outside that program, meaning Plus, Pro, and standard API access as it rolls out over the following days, gets a version that declines advanced cybersecurity tasks outright, including a request as narrow as “write a proof-of-concept for this CVE.” Whether you’re a security researcher with a legitimate reason to ask or not doesn’t factor in at the general-access tier; the restriction is the tier itself.

The AGI framing, and what’s verifiable underneath it

Greg Brockman said Astra represents the start of the “AGI era,” framed as the product of incremental gains rather than one breakthrough. That’s a claim worth noting and not one worth planning around. It’s marketing language dressed in a technical-sounding threshold, and OpenAI has an obvious incentive to say it about its own flagship release.

What’s checkable: OpenAI reports a jump on ARC-AGI-3 from 66% under standard conditions to 99.9% with enhanced tool use, and a 100% score on ExploitBench, the benchmark that’s presumably doing a lot of the work behind the cybersecurity gating decision in the first place. Those are real, specific numbers you can hold OpenAI to later, the same way you’d hold any vendor benchmark claim to independent reproduction before building a roadmap around it. “Start of the AGI era” is not a number, and it’s the kind of framing we’ve seen attached to model launches before without changing what a team building on the API needs to plan for day to day.

Worth separating, too: ARC-AGI-3 measures a specific kind of novel-puzzle reasoning, not “general intelligence” in any operational sense a product team can build against. A model scoring 99.9% on it with tool use tells you the model is very good at that benchmark’s puzzle format under generous conditions. It doesn’t tell you the model will reliably handle your specific agentic workflow, your data, or your failure modes, and OpenAI’s own 66%-under-standard-conditions number for the same benchmark is the more honest reminder that the gap between “benchmark-optimized” and “production-reliable” hasn’t closed just because a headline number looks impressive.

Computer use is the part that changes your roadmap

If you’re deciding whether Astra matters for a real integration, the cybersecurity gating almost certainly doesn’t apply to you, unless you’re building security tooling directly, in which case it’s the whole story. For most other teams, the capability worth paying attention to is computer use: Astra operating a graphical interface the way a person does, clicking through spreadsheets, filling out web forms, navigating between pages, reportedly at well above human speed for repetitive interactions.

That’s a different capability than calling an exposed API, and it changes the calculus for automating against software that never got a usable integration surface: a legacy internal admin panel, a vendor’s SaaS dashboard with no public API, a form-heavy workflow someone built once and never touched again. Teams that ruled out automating a workflow specifically because “there’s no API for that system” now have a different answer available, one with real reliability and cost tradeoffs against a proper integration, but a genuinely new option rather than a hypothetical one.

What to check before you plan around this

Access tier first. General API access almost certainly means the restricted, cyber-task-declining version, not the Daybreak build, and no amount of enterprise billing tier changes that without the specific program enrollment. Second, confirm whether any workflow you’re planning touches something the restricted model will flag as a cyber task; for most product teams building outside security tooling, it won’t, but it’s worth checking against your actual use case rather than assuming.

Beyond that, the honest read is that this release doesn’t obligate an immediate change for most teams already running production AI workflows. What it’s worth updating is your working list of “capabilities that exist now, not eventually,” specifically computer-use automation against systems without an API. If that unlocks a workflow you’d previously scoped as “not feasible without integration work,” it’s worth a real evaluation rather than a reflexive wait for the next release. Teams weighing that build-vs-integrate call on real infrastructure is exactly the kind of scoping conversation our team has with clients before committing engineering time either direction.