OpenAI’s New Model Is Built to Use Your Computer

OpenAI began a staged rollout of GPT-6 Astra on September 3, 2026. The capability it led with is not a better answer to a question. Per OpenAI, Astra fills in forms, updates records in a CRM, manages a calendar, researches information, drafts emails and documents, analyses data, and checks that websites work, and it is designed for long multi-step workflows rather than single replies. Access starts with enterprises in OpenAI's Trusted Access Program, with the API and the Plus, Pro, Business and Enterprise plans to follow. No free tier was announced.

What OpenAI published, and how firm it is

The specifications are unusually large. Astra has a 1,050,000-token context window and supports up to 128,000 output tokens, which leaves roughly 922,000 tokens for input when the full output allowance is reserved. It exposes reasoning effort levels from low through medium, high and xhigh to max, so compute can be dialled up or down per call. API pricing is $10 USD per million input tokens, $50 per million output tokens and $1 per million cached input tokens, with Fast mode at double the applicable rates.

The headline performance figure is roughly 47 percent faster on computer-use tasks, with average time per task falling from about 75 minutes to about 40. That is OpenAI measuring its new model against its previous one on its own evaluations. It says nothing about how the model performs on your invoicing workflow with your data and your permissions, and a vendor benchmark has never predicted that well. Useful as a direction, not as a plan.

The security classification is the unusual part

In its safety overview, OpenAI states that Astra is its first model to reach the Critical level of cybersecurity capability under the company's Preparedness Framework. In OpenAI's own words, that means that with the right tools and access, Astra can find previously unknown security flaws and develop new ways to exploit them across many well-protected systems without a person guiding each step.

Reporting describes the capability being split across two tracks, with general reasoning and software engineering going to public ChatGPT and API users while advanced zero-day discovery and cyber-offence capabilities stay restricted to vetted security partners through a separate channel. That split comes from reporting rather than from a published product page, so treat it as the current understanding rather than a guarantee.

Two further points from OpenAI's own safety overview cut in opposite directions, and both belong in the same paragraph. OpenAI says Astra is significantly more resistant to prompt injection than its predecessor, and that in realistic browsing and professional computer environments it is significantly less likely to take misaligned or destructive actions such as unauthorised transactions, data loss, excessive access, or circumvention of controls. That is the direction you want for a model meant to click things in your systems, and it addresses the risk we wrote about in prompt injection as a business risk.

At the same time, OpenAI reports that Astra's monitorability has decreased relative to the previous model: it is more capable of controlling its own chain of thought and less likely to include incriminating information in it. OpenAI adds that these findings come largely from adversarial evaluations, where researchers instructed the model to evade monitoring, and that its overall alignment evaluations show Astra less likely to violate security and safety restrictions than its predecessor. The practical reading is that watching what an agent says about its plan is a weaker control than it used to be, which pushes the weight onto logging what it actually did.

What actually changes for a Canadian business

Models that could drive a computer have existed for a while, and we covered an early version in our note on Claude computer use back in March. What has changed is positioning. When the flagship model from the largest provider is marketed on updating your CRM rather than on writing your emails, the feature stops being a demo and starts arriving in tools your staff already pay for.

That makes it an access question. An agent that clicks things in your systems needs an account, and an account needs permissions, a scope, and a log. Those are decisions your IT policy already knows how to make for a new contractor. Most businesses simply have not applied them to software that behaves like one.

The likely failure mode is a well-behaved agent doing exactly what it was asked using a login that could reach far more than the task required, which is how the incident we covered in agents escaping their sandbox became interesting in the first place.

Four decisions to make before production

1. Give it its own account. A named service account, not a shared human login and not the owner's credentials. If the agent's activity is indistinguishable from a person's in your audit log, you cannot investigate anything later.

2. Scope what it can reach. The task needs two systems, so grant two systems. Read-only wherever writing is not required. Broad access granted for convenience during a pilot is rarely revoked afterwards.

3. Decide what it never finishes alone. Payments, contracts, anything sent to a customer, and any deletion. The agent prepares, a person approves. This is the control that survives a bad day, and it is cheap while the volume is low.

4. Log the actions, not the reasoning. Given what OpenAI reports about monitorability, a record of the model's stated plan is worth less than a record of the API calls and clicks it made. Keep that log somewhere the agent cannot write to. Our framework in three boxes for an AI agent lays out how to divide the work.

Budget for a workflow, not for a question

Per-token pricing makes agents look cheap until you multiply. A forty-minute run over a large context is not one API call, and a model with a million-token window will happily use a good portion of it. Before scaling an agent across a team, run one realistic task end to end and read the actual token cost off the bill rather than estimating from a single question.

The reasoning effort setting is the lever most teams forget. Not every step in a workflow needs the highest setting, and dialling it down on the routine steps is a straightforward cost control. Our AI cost estimator and our guide to AI automation costs in Canada cover the arithmetic.

What not to conclude from this

The rollout is staged, so what a Canadian business can actually buy this week may be narrower than the announcement suggests. The performance claims are OpenAI's own and cover OpenAI's evaluations. Capability on a benchmark task in a controlled environment is a different thing from reliability on your task with your data, your edge cases, and a customer waiting.

The reasonable move is to pick one internal, reversible, low-stakes workflow and run it with the four controls above. Something where a mistake costs an apology rather than money. If it works there over a month, the argument for widening scope is made with your own evidence instead of a vendor's.

Frequently Asked Questions