GPT-6 Astra: Priced Like a Frontier, Gated Like a Weapon

OpenAI shipped GPT-6 Astra on 3 September 2026 under the banner “Welcome to the AGI era”. What actually landed is a 1.05-million-token computer-use model that is very good at operating machines, priced at two and a half times its predecessor, and the first model the company has rated Critical against its own cybersecurity framework. Three separate things, and only one of them is about intelligence.

Before switching models, check the practical constraints separately: access through the intended authentication route, cost for the intended workload and the settings supported by the client. A launch announcement does not establish access for an individual account.

What Actually Shipped

Astra is a computer-use model before it is anything else. The pitch is that it drives software — browsers, terminals, spreadsheets — for long stretches without a human re-steering it every few minutes. OpenAI's own framing leans on autonomy and duration, not on raw reasoning.

One line in that table earns a second look. The cutoff is 30 April 2026 and the model shipped in September. A release date is not a knowledge date. Anything from the last four months — SDK changes, security advisories, framework migrations, the API you are actually integrating against — has to arrive through your prompt, your repository or a retrieval layer. A bigger window does not fix a stale cutoff; it just gives you more room to paste the fix in.

The number that actually describes the change is not a benchmark. On OSWorld, average time per task dropped from roughly 75 minutes to roughly 40 — a bit under half the clock removed, on the same class of work. For anyone running agents on long jobs, that is the headline, and it is a throughput claim rather than an intelligence claim.

The Benchmarks, Minus the Harness

The launch table is genuinely strong. It is also doing some work that deserves to be named.

The ARC-AGI-3 result is the one to be careful with. It measures the model plus the agent system — a stateful harness that retains reasoning between turns. That is a legitimate way to build an agent and a dishonest way to read a model card. If your harness discards reasoning between turns, you are not buying 99.9% of anything, and the number tells you nothing about what you will get.

The reported results vary across evaluations. They do not establish a longitudinal coding-capability trend without comparable predecessor scores under the same harness and conditions. Evaluate the capabilities needed for the actual task, rather than treating unlike benchmark percentages as one scale.

The Bill, And The Cliff Inside It

The surcharge is the part that will surprise people. It is not metered on the overage. Cross 272,000 input tokens and the entire request reprices. There is no gentle slope — there is a step.

Concretely. A 270K-token input with 8K of output costs about $3.10. Push that same call to 280K of input — one more file in the context — and it costs about $6.20. You added 4% more input and doubled the bill. If you are stuffing a large repository into context on every turn, that boundary is the single most expensive line in your architecture, and it is invisible until the invoice arrives.

Elapsed time and price per token measure different things. Faster unattended execution can improve throughput, deadlines and resource utilization even when nobody is watching. Measure whether latency, reliability, accepted output and resource savings justify the premium.

When 2.5x Is Worth It

Compare cost and outcomes for the same model pair, using comparable tasks and acceptance criteria. An unattended run can still benefit from lower latency; measure that benefit instead of assuming it is worthless.

Can You Even Run It? Two Commands

Before configuring anything, check. This takes ten seconds and saves an afternoon.

# 1. Codex CLI
codex exec --model gpt-6-astra "say ok"

# 2. Raw API, if you have a key
curl -s https://api.openai.com/v1/responses \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"gpt-6-astra","input":"say ok","max_output_tokens":16}'

A client can refuse a selected model when the authentication route or entitlement does not support it. One possible class of response is:

The 'gpt-6-astra' model is not supported when using Codex with a ChatGPT account.

The API can likewise return a model-not-found or access error. The following is an illustrative error shape, not an account report:

{
  "message": "The model `gpt-6-astra` does not exist or you do not have access to it.",
  "code": "model_not_found"
}

Availability can differ by client, account and authentication route. Check current documentation and a harmless request through the intended route before changing a shared default.

Verify access before changing global configuration. If the selected model is unavailable, preserve the error and keep any fallback explicit; do not silently substitute a different model.

The Configuration, For The Day It Lands

Two lines in ~/.codex/config.toml. That is the whole change. Everything below was run against codex-cli 0.153.0; check your own version before copying, because launch-week CLIs move.

model = "gpt-6-astra"
model_reasoning_effort = "max"

Per-invocation, without touching the file — useful for exactly the check-then-commit sequence above:

codex --model gpt-6-astra -c model_reasoning_effort="max"

# non-interactive, same flags
codex exec --model gpt-6-astra -c model_reasoning_effort="max" "refactor this module"

Keep a profile for the fallback so switching back is one flag, not an edit:

[profiles.astra]
model = "gpt-6-astra"
model_reasoning_effort = "max"

[profiles.sol]
model = "gpt-5.6-sol"
model_reasoning_effort = "max"

Then codex -p astra or codex -p sol.

On the API, effort lives under reasoning.effort:

{
  "model": "gpt-6-astra",
  "input": "...",
  "reasoning": { "effort": "max" }
}

A validation error may reveal a shared API enumeration. It does not establish which effort values a particular model supports. Establish support from model-specific documentation and a successful request, and verify Codex CLI settings separately from the raw API.

Invalid value: 'bogus'. Supported values are: 'none', 'minimal', 'low', 'medium', 'high', 'xhigh', and 'max'.

The enumeration above is an illustrative validator response, not proof of Astra support. A client effort label and a raw API effort value can have different meanings. Record the chosen model, client and setting, then evaluate the result under the required quality standard.

Headless: What Changed, What Didn't

If you drive Codex from CI or a script, the good news is boring: codex exec is unchanged. Same non-interactive entry point, same --model, same -c key=value overrides, same --json event stream, same --output-schema for structured results. Nothing to migrate.

Context management is a client feature, not a guarantee made by the model name. The Codex CLI 0.153.0 changelog describes a disabled-by-default experimental context mode for eligible ChatGPT subscription sessions. Notes can carry selected task state into a new context; they are not a lossless record of every failed attempt. Check availability and configuration for the actual client and authentication route.

The same changelog documents asynchronous structured questions when enabled by the model catalog. A supporting client can let the agent continue independent, already authorized work while an answer is pending. Whether that behavior is available depends on the client and runner.

A headless runner must distinguish an optional pending question from missing information or approval that blocks an action. Record that state explicitly. Continue only work that is both independent of the answer and already authorized; silence is not approval.

Define what the agent may decide, what needs approval, what happens while an answer is pending and what evidence establishes completion. Notes carry selected task state and should be checked against original evidence. They do not confer authority.

One more thing that belongs in the runner rather than the model: enforce the 272K boundary yourself. A headless agent will accumulate file contents, terminal output and tool observations while doing exactly what you asked, and cross the price step without ever doing anything wrong. Count the tokens where you control the loop.

The Cyber Gate Is The Real Story

Astra is the first OpenAI model to trip the company's own Critical cybersecurity threshold. Standard access refuses advanced cyber work including exploit discovery. Full capability sits behind an application-based programme.

Vetted access is an access-policy decision separate from benchmark performance. Read the vendor’s stated eligibility and safeguards for the particular route; the existence of vetting does not establish an industry first or independently validate a capability claim.

Test refusal behavior on representative, authorized security tasks. Verify the model, route and access conditions rather than assuming continuity with Sol; this article does not establish how a classifier will change after launch.

Choose from task evidence

Choose between available models using representative tasks and a common acceptance standard. Compare token cost, latency, throughput, reliability and correction effort for the same model pair. A price comparison with Sol cannot be combined with a benchmark score from a different competitor to establish value.

The interesting question is not whether Astra is smarter. It is what happens now that OpenAI has priced the frontier at $50 per million output tokens while the rest of the market moves the other way. Either agentic throughput is worth a premium that large — in which case measure your wall-clock, not your benchmark deltas — or this is the release where "frontier" stops meaning "default" and starts meaning "the expensive one you reach for on purpose."

My money is on the second. Which is fine. A model you reach for on purpose is a healthier thing than a model you reach for by habit.