GPT-6 Astra Shows Strong Tool Use and Math Results but Trails in Text Quality Tests
OpenAI introduced GPT-6 Astra on 3 September 2026 as a model designed for extended tasks that require maintaining goals, using tools and correcting intermediate errors across code, documents and computer interfaces.
In early demonstrations the model controlled a pixel display on a Divoom Bluetooth speaker, configured a CRM system through a browser and built an editable three-dimensional house scene in Blender before transferring it to Unreal Engine 5.
Independent evaluations released by 7 September present a more nuanced view. Artificial Analysis Intelligence Index 4.2 placed Astra second behind Claude Fable 5.1, while Epoch AI Epoch Capabilities Index ranked it first at 169 points with a 165–174 confidence interval.
On coding benchmarks Astra led Kilo Terminal-Bench 2.0 with 79.3 percent tasks completed yet used roughly three times fewer tokens than GPT-5.6 Sol in Codex evaluations. In Real Python checks it correctly identified a non-existent function and performed an 11-line edit for $0.31 across five tasks.
Text quality remains a weaker area. On ToneBench Astra scored 1995 Elo in max mode, placing 30th and behind both Sol and Fable configurations. The model performed better at avoiding boilerplate language than at crafting strong openings.
Document and fact-handling tests showed progress. Astra achieved 33.2 percent fully completed tasks on GDP.pdf compared with 28.2 percent for Sol, and reduced hallucination rates on AA-Omniscience from 92 percent to 51 percent.
In mathematics FrontierMath Erdős saw Astra solve two previously open problems on a single attempt each, requiring 15–16 hours and roughly $230 per solution. Additional experiments solved five tasks under modified conditions at a total compute cost exceeding $220 000.
On ARC-AGI-3 the model reached 99.9 percent when using an OpenAI adapter that preserves reasoning state between calls, versus 62.7 percent in the standard configuration.
OpenAI classified Astra as Critical under its Preparedness Framework after the model scored 100 percent on ExploitBench and identified two previously unknown vulnerabilities during testing. The company also noted reduced ability to detect undesirable behaviour from reasoning traces and that asynchronous monitoring may allow actions to complete before intervention.
API pricing lists $10 per million input tokens and $50 per million output tokens for short context, with cache reads at $1 per million. Costs for completed work remain highly variable depending on environment, retries and human oversight required.
Related articles
Stop Asking If AI Agent Skills Are Safe — Focus on Capability Disclosure Instead
A new approach called capability disclosure is proposed for evaluating skills used by AI agents, replacing unreliable safety badges. The shift comes after documented cases where malicious SKILL.md files survived system reinstalls through backups and executed data theft via prompt injection. Snyk's ToxicSkills analysis of 3984 public skills found 36.8% with security issues and 13.4% critical, including 76 confirmed malicious payloads. The skill-xray tool provides structural scanning and tiered reporting from T0 (inert text) to T4 (opaque runtime code loading) without issuing safety verdicts. Real-world examples include CVE-2025-6514 affecting mcp-remote with over 437,000 installations. The method emphasizes revealing what a skill can access rather than promising it is harmless.
OpenAI GPT-6 Astra Deploys Multi-Agent Parallel Processing, Increasing Local CPU Load and Security Risks
Early users of GPT-6 Astra have observed the model distributing complex tasks across multiple specialized agents that plan, solve, test code, verify results, and iterate after failures. This multi-agent approach enables faster handling of multi-step workflows compared to sequential chatbots. OpenAI states that Astra can control computers, operate browsers and applications, and install or test software, though it has not officially confirmed a native multi-agent architecture. Main computations run in the cloud, but agent tools can execute on user devices or corporate servers, leading to noticeable processor load when multiple agents compile code, launch browsers, run tests, and operate containers simultaneously. Corporate environments face added complexity as each agent requires virtual machines, sandboxes, internal data access, and careful environment cleanup. The increased autonomy has prompted OpenAI to strengthen monitoring of Astra actions and permission boundaries for subscribers of ChatGPT and enterprise clients.
Microsoft Copilot Can Surface Overshared Data Despite Permission Boundaries
Microsoft documentation states that Copilot only accesses data authorized for the signed-in user, yet default SharePoint and OneDrive sharing settings often grant broad access that the AI then respects literally. This creates accidental oversharing risks where Copilot retrieves documents shared too widely years earlier. Administrators can use Content Management Assessment and Data access governance reports, including the EEEU report covering the top 100 sites shared in the past 28 days, to identify problematic content. Two distinct controls exist: Restricted Access Control removes access entirely while Restricted Content Discovery hides items from Copilot and search without altering permissions. Sensitivity labels combined with encryption can exclude programmatic access for agents, though Microsoft does not guarantee outright blocking. Interaction logs stored in Microsoft Purview retain user prompts, Copilot responses, and citations to accessed documents, providing an audit trail for oversharing incidents.
Adaptive LLM Worm Uses Local Models to Craft Per-Target Exploits in Heterogeneous Networks
Researchers from the University of Toronto have published a preprint describing an adaptive computer worm driven by LLM agents that spreads across corporate networks by generating individualized attack strategies for each compromised system. Unlike traditional worms such as WannaCry that rely on fixed exploits, this worm maintains its own infrastructure by running local LLMs on infected GPU-equipped machines to analyze vulnerabilities and synthesize new attack vectors in real time. The system was tested in an isolated FakeCorp environment containing Linux, Windows, and IoT devices, successfully leveraging known real-world vulnerabilities to propagate over 48 hours and seven-day autonomous runs. Two core components power the worm: a GPU-hosted LLM component and a hierarchical agent framework with memory, reasoning graph, and tool modules that manage reconnaissance, exploitation, and payload deployment. The authors note that the approach creates an economic asymmetry favoring attackers because the worm parasitizes victim compute resources, eliminating the need for external C2 or commercial LLM services. They warn that adding adaptive reasoning to historical worms such as SQL Slammer, Conficker, or Stuxnet would significantly increase their resilience while remaining slower and noisier than classic self-propagating malware.