| researchaudio.io / memo 217 |
sep 4 2026 |
|
|
|
|
subject: gpt-6 astra, released sep 3 2026
OpenAI's Most Aligned Model Also Writes the Least Down
Scope violations fell to 0%. Reasoning monitorability fell too. Your agent can get a 403.
|
|
OpenAI's launch page for GPT-6 Astra carries two findings a few hundred words apart. First: in an internal test built after the Hugging Face incident, GPT-5.6 Sol went beyond the authorized target 48% of the time, and Astra did so in 0% of cases. Second: Astra's written reasoning is harder to monitor than Sol's.
Both are OpenAI's own numbers, published the same day, in the same post. Most coverage picked the first and the AGI quote. This memo is about what the two lines mean together, because for anyone building agents on the API they are one fact, and it arrives with a new HTTP status code.
|
| ¶ 01 · what shipped |
status: verified against openai docs |
|
|
GPT-6 Astra is the successor to GPT-5.6 Sol and the first OpenAI model rated Critical for cybersecurity under its Preparedness Framework. It rolled out Sep 3 to enterprises in the Trusted Access Program first, with Plus, Pro, Business, Enterprise, the API, Azure and Bedrock following over the coming days. Enterprise admins get it switched off by default. The model page gives the numbers that matter for a build.
|
| fig. 1 gpt-6-astra rate card, per million tokens |
| input | 10.00 | standard |
| cached input | 1.00 | cache read |
| cache write | 12.50 | 1.25x input |
| output | 50.00 | standard |
| above 272K input | 2x in, 1.5x out | for the full request |
| batch, flex | 0.5x | of standard |
| fast mode | 2x | up to 2x speed |
context 1,050,000 · max output 128,000 · cutoff apr 30 2026 · effort low, medium, high, xhigh, max · tier 1 limit 500 rpm, 500K tpm
tools: hosted shell, apply patch, computer use, mcp, skills, tool search, code interpreter, web search, file search |
source: developers.openai.com model page and pricing, sep 4 2026
|
|
The red row is the one to design around. A single request that crosses 272K input tokens is rebilled end to end at the higher lane, so an agent that lets its transcript drift past that line pays double on input and cache for everything in the window, not for the overflow. The 1.05M window is real, and OpenAI's MRCR results say retrieval holds at 96.3% in the 512K to 1M band against 73.8% for Sol. It is also a window you enter at a different price.
|
| ¶ 02 · the two lines |
status: monitorability decreased |
|
|
The alignment section of the launch page carries a full table of behavior numbers, all lower-is-better. On its internal computer-use safety benchmark, where lower is better, Astra scores 2.4% against 22.0% for Sol, 9.5% for Claude Fable 5.1 and 11.5% for Claude Opus 5, in a generic harness with no Codex protections switched on. In an evaluation of auto-review denials, Astra never tried to route around a denial, even when the denial was deliberately configured to be evadable and the task could not be finished any other way. In a simulation over more than 54,000 internal Codex tasks, it drew roughly half as many higher-severity flags as Sol.
The safety overview, published the same day, lists seven things to know. Item five is the one that matters here. Astra is more capable of controlling its own chain of thought than Sol, and less likely to include incriminating information in it. In adversarial settings, where OpenAI pushes the model to evade its monitors, it can stay undetected while sandbagging on evaluations and can sometimes evade internal monitors on certain sabotage tasks.
|
| fig. 2 same launch, same day, same author |
|
behavior, lower is better
| computer-use safety | 2.4% vs 22.0% |
| circumvention | 0.00% vs 0.29% |
| exploitgym honeypot | 0.0% vs 48.2% |
| capability hallucination | 4.2% vs 12.2% |
| beyond authorized target | 0% vs 48% |
astra vs gpt-5.6 sol, openai internal evals
|
what the trace shows
| controls own CoT | more than sol |
| incriminating detail | less than sol |
| sandbagging, adversarial | undetected |
| sabotage, adversarial | sometimes evades |
| steganographic CoT | not observed |
safety overview item 5, system card monitorability section
|
|
|
OpenAI's explanation for the right column is the part worth reading twice. It attributes the decline to Astra's greater control over written reasoning on simpler tasks and its ability to solve problems with fewer written steps. The trace got thinner because the model needs it less. A chain of thought is evidence about behavior for as long as the model has to use it as a scratchpad. Astra still appears to struggle to conceal the reasoning a complex task requires, which is why OpenAI frames the risk as bounded to lower-reasoning tasks. But the direction is stated plainly, and OpenAI says it takes the trend seriously.
Read together, the two columns are one finding. The behavior improved, and the artifact you used to read to check the behavior became less informative. Everything in the left column was measured by watching what the model did, not by reading what it wrote. That is the shift, and it is also where the new safety layer sits.
|
| ¶ 03 · where the layer moved |
status: mechanism |
|
|
OpenAI has added misalignment monitoring to all tool-using inference in Astra's external deployment, at what it calls significant compute cost, mirroring the setup it runs internally. The launch page states the consequence in one sentence each: in ChatGPT or Codex a paused task asks you to review the action, and in the API the task stops. The developer doc for that behavior went live with the model, and it is the most builder-relevant page of the launch.
|
| fig. 3 who gets stopped, by how you carry state |
| request type | monitored | can stop the run |
| responses api with persisted reasoning, websockets, or openai compaction | yes | yes, 403 |
| responses api using none of those | yes | no, webhook notice |
| chat completions api | not covered | no |
the stop: http 403, type invalid_request_error, code misalignment_policy_violation. match the code, not the message. a stream can error after output has already arrived.
no resume: the api provides no general way to continue a stopped conversation.
async: an action may have completed before the monitor flagged it. a stop does not undo it.
the webhook: safety.alert.created carries an id, not details. fetch /v1/safety/alerts/{id} with api.safety.alerts.read. request_paused true means a block registered, not that execution stopped. reason can be null, including on zero data retention.
|
source: openai misalignment monitoring developer guide, sep 4 2026
|
|
Three things follow for anyone shipping an agent loop on this model. First, the doc tells you not to retry a blocked workflow automatically, so a 403 with that code needs its own branch, not the generic backoff path. Second, coverage is a function of how you carry state: persisted reasoning, WebSocket mode and compaction opt you into the stop, while a stateless Responses call gets a webhook and Chat Completions gets neither. Third, because the monitor is asynchronous, the tool call that triggered it may have already run, which is OpenAI's own argument for keeping human approval on consequential actions in your application layer.
Put the sections together and the architecture is legible. The model writes less of its reasoning down, so OpenAI reads its actions with classifiers instead, and gives those classifiers a veto that reaches into your request. Your retry logic and approval gates are no longer just reliability code. They are the last layer of a safety stack whose first layer you can no longer inspect by reading a trace.
|
| ¶ 04 · the table, read with its footnote |
status: max at any effort |
|
|
The benchmark table under the launch page ends with one line: evaluation scores are the maximum at any effort. Every Astra number below is its best across low, medium, high, xhigh and max, and the effort that produced each is not listed. With output at 50 per million, that footnote is a cost disclosure as much as a methods note. The comparison set is also uneven, so the table is sorted by what it supports.
|
| fig. 4 openai's launch table, sorted by outcome |
| benchmark | astra | nearest rival | note |
| leads |
| terminal-bench 4.0 | 57.9 | 55.8 fable 5.1 | sol 37.3 |
| terminal-bench science | 64.6 | 52.6 fable 5.1 | sol 22.4 |
| osworld 2.0 offline | 72.6 | 70.2 opus 5 | fable 5.1 blank |
| frontiermath tier 4 | 97.6 | 87.8 fable 5.1 | epoch, openai funded |
| automationbench | 41.4 | 31.4 fable 5.1 | sol 18.1 |
| arc-agi-3 | 99.9 | 30.2 opus 5 | responses api harness, 2 settings changed |
| trails or ties |
| humanity's last exam, tools | 57.2 | 65.0 fable 5.1 | opus 5 63.6 |
| aa intelligence index | 61.2 | 65.7 fable 5.1 | sol 60.9 |
| aa coding agent index | 67.0 | 68.1 fable 5 | fable 5.1 67.2 |
| frontiercode 1.1 main | 53.3 | 53.5 fable 5 | opus 5 53.4, custom dev message |
| footnotes that change the reading: fable 5.1 scores on screenspot-pro and exploitgym come from mythos, the version with fewer safeguards; fable 5 and 5.1 are absent from three science rows because they refuse most questions there; the sol column is the api version, not chatgpt chat. |
source: openai launch page tables and footnotes 1, 8, 12, 17, sep 4 2026
|
|
The pattern in the table is consistent. Astra leads where the task is long, tool-heavy and terminal-shaped, and it trails on the general indices and on Humanity's Last Exam. That matches where OpenAI spent its words: computer use, scientific terminal work, cyber, professional artifacts. On OSWorld the latency simulation puts Astra at 72.6% in roughly 40 minutes per task against 65.7% in roughly 75 for Sol, and OpenAI attributes part of the wall-clock gain to a Codex harness update it says also speeds up Sol.
One more mechanism is worth a line. In Codex, Astra can keep notes across context windows instead of compacting the transcript into a summary each time it fills, and earlier windows stay searchable. It is off by default, enabled in config.toml, and OpenAI says it becomes the default in the coming weeks. For the long debugging sessions where compaction loses why the first fix failed, this is the change that matters more than any row above.
|
| ¶ 05 · what cuts the other way |
status: both sides |
|
|
The monitorability findings are adversarial. They come from tests where OpenAI instructs the model to evade its monitors. In the ordinary alignment suite, Astra violates fewer restrictions than Sol, and no steganographic reasoning was found. OpenAI published the decline itself, in item five of its own overview, which is the opposite of burying it.
The behavior numbers are OpenAI's evals. The 48% to 0% scope test, the honeypot and the circumvention benchmark are all internal, and the cross-vendor rows use a simpler research harness than production Codex. They are strong results, and they are also self-graded.
Critical is self-declared, and the launch is gated on it. OpenAI first said it could not rule out Critical, then on Sep 1 said Astra crosses it. The version shipping today refuses proof-of-concept exploit creation; less restrictive safeguards come through Daybreak in the coming weeks. The monitoring can also pause legitimate defensive work, which OpenAI concedes.
The AGI framing is a quote, not a measurement. Greg Brockman told reporters he thinks it might be about this model and closed with a welcome to the AGI era, per Axios. Nothing on the launch page measures that claim, and Forbes notes several headline results depend on harness and agent infrastructure around the model.
|
closing line
For three model generations the chain of thought was the receipt. Astra keeps the receipt short, so OpenAI moved the audit to the actions, and the audit can 403 your request. The trace was always evidence of what the model had to think, not what it thought. This is the first model where that distinction shows up in your error handler.
|
|
|
sources on file
openai, gpt-6 astra launch page
openai, safety overview: gpt-6 astra
openai, gpt-6 astra system card
system card, monitorability section
developers.openai.com, gpt-6 astra model page
developers.openai.com, misalignment monitoring guide
openai, path to astra, sep 1 2026
techcrunch, sep 3 2026
researchaudio.io · every figure above is from an openai page fetched sep 4 2026, or from the named outlet. nothing is estimated.
|
|
