OpenAI Releases GPT-6 Astra, Its First Model Rated 'Critical' Under Its Own Cyber Risk Policy

Two Companies, Two Days Apart, Both Racing an IPO Clock

On September 1, 2026, Anthropic released two new models, Claude Fable 5.1 and Mythos 5.1^[17]. Two days later, OpenAI answered with GPT-6 Astra, released September 3 first to a small group of trusted partners, then opened to paying ChatGPT users the next day^[1][2]. Both launches landed in the same narrow window, and that timing is not a coincidence — it is the story.

Astra arrived with a label no OpenAI model has carried before. The company says it is the first of its models to cross OpenAI's own "Critical" cybersecurity risk threshold, the top tier in a scale OpenAI wrote and grades itself against^[8][13]. In practice, that means OpenAI's own testers found Astra could locate software bugs nobody had disclosed yet, and figure out how to exploit them, without a person walking it through each step^[8]. Because of that finding, OpenAI restricted the model's most offensive capabilities and shipped a public version that refuses some cybersecurity prompts^[2].

Access comes at a price: $10 per million input tokens and $50 per million output tokens, through the API, Amazon Web Services, and ChatGPT's Plus, Pro, Business and Enterprise tiers^[2][11]. A token is roughly three-quarters of an English word, so a million tokens works out to about 750,000 words — close to a long novel. Feed Astra a novel-length document and it costs about $10; get a novel-length answer back and it costs about $50. The model also carries a 1-million-token context window and a knowledge cutoff of April 30, 2026^[11].

The Same Table, Two Different Winners

OpenAI President Greg Brockman said at the launch that "it's not unreasonable to feel that we are now in the AGI era"^[9]. Nvidia CEO Jensen Huang, whose chips trained the model, went further three days later, posting simply "AGI has arrived"^[9]. AGI — artificial general intelligence — usually means a system that can match or beat humans across essentially any cognitive task, but there is no agreed technical definition or test for it. That is exactly what critic Gary Marcus pointed to in his rebuttal: without a fixed definition, the claim can't be checked against anything, which makes it hard to call it a measurement rather than a marketing line^[9].

There is also a narrower, checkable dispute buried in OpenAI's own numbers. On several individual benchmarks, Astra leads outright. It scored 100% on ExploitBench, a test of finding and using software vulnerabilities, against 78.5% for OpenAI's prior model GPT-5.6 Sol and 70% for Anthropic's Claude Opus 5^[8]. It also topped Terminal-Bench, OSWorld and FrontierMath, tests of operating a computer, using software tools, and solving advanced math^[11].

But on the Artificial Analysis Intelligence Index, a broad average that blends performance across many kinds of tasks rather than just one, OpenAI's own comparison table shows Astra scoring 61.2 — behind both Claude Opus 5 and Claude Fable 5.1^[16]. So the "who's ahead" question depends entirely on which chart you're looking at. Astra wins the tasks OpenAI's marketing leads with; Anthropic's models win the wider average. Both statements are true using the same underlying data.

The cybersecurity comparison has its own wrinkle. The Claude scores OpenAI used for its ExploitBench comparison came from Mythos, a restricted Anthropic build with fewer safety filters active, limited to a government-vetted cyber-verification program — not the public Fable 5.1 model most users would actually compare it to^[16][17]. That distinction is disclosed, but only in a footnote, not in the headline chart^[16].

A Model Built to Justify Its Own Price Tag

Astra was pretrained using more than 100,000 GPUs at OpenAI's Stargate site in Texas, with hundreds of thousands more Nvidia systems already planned^[2]. Spending at that scale needs a continuous story of progress to justify it. A launch that looked routine would invite the question of whether the next round of that buildout is worth funding — so this one couldn't look routine.

Anthropic is under its own kind of pressure. The company confidentially filed paperwork for a stock market listing with the U.S. Securities and Exchange Commission on June 1, 2026, after a May funding round valued it at roughly $965 billion^[14]. Reporting points to a listing as soon as October 2026, at a target valuation discussed as high as $2 trillion^[14]. Anthropic's revenue run rate — sales projected out over a full year — climbed from about $9 billion at the end of 2025 to more than $65 billion by the end of July 2026^[14]. In the weeks before that listing prices, every benchmark claim either company publishes is also a pitch to the bankers and investors who will set that number.

That helps explain why Anthropic shipped two days before OpenAI, and why OpenAI's launch leaned so heavily on the tasks where Astra wins. Both companies are self-grading against risk categories and benchmark suites that they, not any outside regulator, chose to publish. Sam Altman said Astra went through the White House's review process for advanced AI systems, but that process is voluntary — there is currently no U.S. agency that certifies a frontier model's capability or danger level before it ships^[5].

What the "Critical" Label Actually Concedes

Security researchers and AI-risk critics read the Critical designation less as reassurance and more as an admission on the record. Their core point: OpenAI itself says Astra can find flaws nobody has published yet and build working exploits without step-by-step human guidance — and OpenAI shipped it anyway, restrictions or not^[8]. A capability like that cuts both ways. It can help a company patch its own unknown vulnerabilities before someone else finds them, but it can just as easily help an attacker locate a target's weak point first^[8].

Astra's own published system card adds a more technical concern: the model's reasoning has gotten harder to monitor for misalignment, meaning it is harder for OpenAI's own reviewers to check whether what the model says it's doing actually matches what it's doing^[16]. Sanchit Vir Gogia of Greyhound Research offered a sharper framing of the Critical label itself: he argued it reflects a change in how OpenAI tested the model, not a jump in how dangerous the underlying model actually is between one assessment and the next^[8].

Enterprise buyers, meanwhile, are watching a more practical number: cost per finished task, not leaderboard position. Astra reportedly matched Claude Fable 5 on a comparable coding benchmark while taking fewer steps to get there, and used fewer steps than both GPT-5.6 Sol and Claude Opus 5 on the same measure^[16]. Fewer steps can mean a lower total bill even at a higher per-token price. Early users, though, report code that still needs cleanup, and a gap between the launch demo and daily use^[9]. At $10 per million input tokens and $50 per million output tokens, a heavy workday of automated tasks adds up fast^[11]. No independent study has yet measured what a model built for "computer use" — meaning it can browse, code, and operate software on its own — does to the jobs built around those same tasks^[2].

How Each Newsroom Told the Same Story

Coverage split largely along the fault lines you'd expect, though not always in the way the labels predict. Fox Business led with performance gains and American industrial scale, treating the Critical classification as evidence of a careful company rather than a warning^[6]. Breitbart put "AGI Era" in scare quotes and framed the whole story around Sam Altman's personal credibility, offering little of the benchmark detail a reader would need to judge the claim^[10].

On the left, Gizmodo led with the AGI claim as a claim to be tested, giving Gary Marcus's rebuttal prominent space^[9]. NBC News took a flatter approach, leading with the security trigger over the capability boast and correctly attributing the Critical label to OpenAI's own classification rather than stating it as settled fact^[5]. Al Jazeera's headline paired the launch with "rising scrutiny and safety concerns," framing the release inside a governance problem rather than a product story^[7]. CNBC and trade outlet CSO Online scored as the most measured of the coverage — CSO Online, in fact, is where the sharpest technical skepticism showed up, in the analyst's point that the Critical label may reflect changed testing rather than a changed model^[4][8].

What's Still Unmeasured

A week after launch, the two companies' benchmark claims remain unverified by anyone outside the companies that produced them. No outside body checked Astra's exploit scores, and none is required to before a model like this reaches paying customers^[8]. Anthropic's IPO filing is still confidential, and its October listing target is not locked in^[14]. Whether Astra's agentic gains translate into real job displacement, and whether its harder-to-monitor reasoning becomes a practical problem rather than a footnote in a system card, are both questions with no data yet — just two companies, mid-fundraise, telling their strongest version of the same numbers.