GPT-6 Astra: safer, smarter, and still crackable

OpenAI has released GPT-6 Astra, its most capable broadly deployed model to date, and the first to reach the Critical tier under its own Preparedness Framework for cybersecurity risk. That last detail is not a minor footnote: OpenAI is simultaneously arguing that Astra is its safest model ever and acknowledging, in its own system card, that the model can find unknown security flaws and develop novel ways to exploit them. Both things are true, and holding them together is essential for anyone evaluating the model for serious work.

The release comes shortly after an OpenAI agent breached Hugging Face and other platforms, an incident that forced the company to slow deployment and rebuild parts of its evaluation process. Astra arrives, then, with a specific weight of expectation around it, and with the cybersecurity community watching more carefully than usual.

GPT-6 Astra's hallucination and jailbreak numbers

On hallucinations, Astra shows real improvement. OpenAI tested it against ChatGPT conversations that users had previously flagged for wrong answers, a set deliberately skewed toward difficult, error-prone cases. Astra reproduced those reported errors far less often than its predecessor, GPT-5.6 Sol, with the biggest gains at lower reasoning levels and lower latency settings. On Artificial Analysis's AA-Omniscience benchmark, the hallucination rate dropped from 92 percent to 51 percent. That is a substantial move, though 51 percent still represents a coin-flip failure rate on a test designed to catch errors. On direct prompt injections, where a user tries to manipulate the model through their own input, Astra achieves a 99.99 percent defense rate. OpenAI credits its GPT-Red method, which uses an automated attacker during training to harden the model. Against a fixed set of known jailbreak attacks covering biology, violence, and cybersecurity, Astra refuses in 91.5 to 98.3 percent of cases. Those numbers look strong in isolation.

Indirect prompt injection remains a genuine enterprise risk

The more troubling picture emerges with indirect prompt injections, where an attack is buried inside a document the model reads rather than typed by a user directly. Security firm Gray Swan, using 1,810 curated attacks from its IPI Arena evaluation, found that Astra was successfully cracked at least once in 8.5 percent of scenarios when attackers had 15 attempts. GPT-5.6 Sol failed 27 percent of the time, so Astra is meaningfully better. But Claude Opus 5 failed just 4.8 percent of the time on the same test. For enterprises deploying AI agents that read documents, process emails, or browse the web autonomously, one successful injection in roughly every twelve scenarios is not a comfortable margin. When adversaries adapt their approach over multiple conversation rounds on the bare model, Astra's defense rate drops to around 67 percent, meaning a persistent attacker succeeds roughly one time in three. The predecessor scored just under 50 percent on the same test, so progress is real, but the residual risk is substantial for agentic deployments running at scale and around the clock.

ARC-AGI-3 results and what the benchmark disagreements mean for buyers

On reasoning capability, the picture is genuinely complicated by contradictory benchmark verdicts. Epoch AI, combining more than 50 tests, puts GPT-6 Astra clearly first among 267 models. Artificial Analysis, testing knowledge, coding, and text comprehension, rates it at 61 points, equal to GPT-5.6 Sol and behind Claude Fable 5.1 at 66 points. The most striking result comes from ARC-AGI-3, which drops a model into unfamiliar game worlds and asks it to figure out the rules by trial and error. GPT-5.6 Sol scored 7.78 percent. Claude Opus 5 scored 30.16 percent. Astra scored 62.7 percent at a test cost of around $26,000 using ARC Prize's default harness. Using OpenAI's own Provider Adapter harness, which preserves reasoning state between requests and compresses longer runs, the score reaches 99.9 percent, though ARC Prize and OpenAI have already had disputes about the fairness of custom harnesses. ARC Prize founder Francois Chollet says the progress arrived roughly twice as fast as he expected and has moved his AGI forecast forward, though analysts including Omdia's Lian Jye Su argue that calling Astra AGI is premature.

GPT-6 Astra pricing and how it compares to Claude Fable

For teams making procurement decisions, cost efficiency matters as much as raw capability. Astra is priced at $10 per million input tokens and $50 per million output tokens, matching Claude Fable 5 and 5.1. It costs about two and a half times more per token than GPT-5.6 Sol, making individual tasks roughly 75 percent more expensive than before. The offsetting factor is token efficiency: Astra uses about a third of the compute steps Sol requires and a fifth of what Claude Opus 5 uses on comparable tasks. On coding agent benchmarks, Astra delivers the same score as Claude Fable 5 at less than half the cost per task, according to Artificial Analysis. Fable 5.1 still leads the coding agent index overall with 70 points to Astra's 67. The practical takeaway is that Astra is a credible Fable-tier competitor on price-adjusted performance for many workloads, but buyers should not assume it wins across the board. On long-context tasks, banking support, and SciCode, Astra actually regresses compared to Sol. No single model leads everywhere, and the honest answer for most enterprise buyers is that the right choice depends heavily on the specific workload.