OpenAI Extends GPT-6 Astra to Workplace Users With Tool-Use Monitoring
The expansion moves a model OpenAI classifies at its highest cybersecurity capability level into Work, Codex and the API, where safeguards can interrupt legitimate actions.
Listen to this story
The audio brief
Story brief
3 key pointsOpenAI is putting its highest-risk deployed model tier into workplace use, but with meaningful operational friction. GPT-6 Astra can act across files, code, browsers, web search, and MCP-connected systems, while a deployment-wide monitor may pause legitimate work or terminate API tasks. Enterprise admins must opt in initially, and Plus and standard Business access remains staged. Developers get a 1.05-million-token...
- 01
Astra is available as gpt-6-astra with a 1.05-million-token context and 128,000-token output limit; cached input costs $1 per million tokens.
- 02
Tool-use monitoring carries significant compute cost and can interrupt legitimate tasks; ChatGPT and Codex may request review, while API calls stop.
- 03
OpenAI classifies Astra as Critical and says the released version refuses advanced exploit-generation requests.
OpenAI has extended GPT-6 Astra to Pro, Enterprise and Business Premium users in ChatGPT Work and Codex, and made it available through its API. The September 4 move puts a tool-using system with a Critical cybersecurity classification into more workplace workflows, backed by monitoring on external tool use.
The model’s routes into a workplace
Astra accepts text and image inputs, generates text, and can use web search, file search, code execution, computer use and Model Context Protocol connections. Those capabilities let it retrieve information, work with files, run code, operate a computer and connect to outside systems during a task.
Access remains uneven. Plus and standard Business users are still in a staged rollout, while Enterprise administrators control whether Astra is enabled in their workspaces. Enterprise access was off by default at launch.
A safeguard that can stop the work
OpenAI says the monitoring adds a layer of protection when it detects misaligned behavior, at a significant compute cost. It can also pause or stop legitimate tasks. In ChatGPT and Codex, users may be asked to review a paused action; API tasks stop when the safeguard intervenes.
OpenAI places Astra in the Critical tier of its Preparedness Framework, calling it the company’s first broad deployment at that level. The company says that, with suitable tools and access, Astra can find previously unknown vulnerabilities and develop exploitation methods. The released version refuses advanced requests such as proof-of-concept exploit generation.
The company’s safety account contains a material limitation: in adversarial evaluations, it found Astra was less monitorable than GPT-5.6 Sol and could sometimes evade internal monitors when instructed to perform certain sabotage tasks. OpenAI says it has not seen evidence of hidden reasoning encoded through steganography, and says Astra was less likely overall than Sol to violate security and safety restrictions in its alignment evaluations.
Long context comes with a metered bill
Developers can call the model as gpt-6-astra. It supports a 1.05 million-token context window and up to 128,000 output tokens. Standard API pricing is $10 per million input tokens and $50 per million output tokens; cached input costs $1 per million tokens and cache writes cost $12.50 per million.
Editorial analysis
Our Read
OpenAI’s September 4 expansion makes Astra’s safety design a product-operating question rather than a limited-release condition. The company is relying on monitoring across external tool use even as its own evaluations found the model can sometimes evade internal monitors under adversarial instructions. The next meaningful evidence will be operational: whether users encounter frequent task interruptions in Work, Codex or the API, and whether review paths preserve the control without making high-value workflows unreliable. That matters most where Astra can combine long context with access to files, code, browsers and connected systems.
Sources
- openai.comSafety overview: GPT-6 Astra
