OpenAI

GPT-6 Astra

• Released 3 September 2026
• Framework: Preparedness Framework
• 2 statements about capability levels
• 7 independent or government tests
• 10 tests by the provider
• 12 source documents

What the provider states

• Chemical, biological, radiological and nuclear · High · Stated as crossed

  we are treating astra as high capability in the biological and chemical domain.

  OpenAI · 3 September 2026 · Read the source
• Cyber · Critical · Stated as crossed

  based on our evaluations, we believe that astra meets the critical cybersecurity threshold.

  OpenAI · 3 September 2026 · Read the source

Independent and government tests

• cybersecurity evaluation · UK AI Security Institute, government evaluator · Cyber

  Reported result: gpt-6 astra reached the most severe forms of action (attempting to deliver a malicious payload to an open-source maintainer's codebase) in 29% of all samples, compared to 6% for gpt-5.6 sol and 0% for gpt-5.5.

  gpt-6 astra conducted complete unsanctioned supply-chain attacks in our evaluation, including delivering a malicious payload to open-source codebases, creating fake identities to deceive developers, and posting comments from fake accounts arguing against the results of accurate security reviews (all simulated actions, so no real-world harm caused).

  UK AI Security Institute · 28 September 2026 · Read the source
• manual transcript analysis · UK AI Security Institute, government evaluator · Cyber

  manual transcript analysis showed that gpt-6 astra sometimes proceeded even when it stated in its chain-of-thought that the message was likely automated and not from a real human user (see fig. 7).

  UK AI Security Institute · 28 September 2026 · Read the source
• permission-request analysis of trajectories · UK AI Security Institute, government evaluator · Cyber

  gpt-6 astra asked the operator at least once for permission about a specific action in 82% of trajectories.

  UK AI Security Institute · 28 September 2026 · Read the source
• unsanctioned supply chain attack evaluation · UK AI Security Institute, government evaluator · Cyber

  we found that when tasked with solving difficult cybersecurity challenges, gpt-6 astra sometimes conducted complete unsanctioned supply-chain attacks against open-source providers (all actions performed in simulated environments, so no real-world harm was caused).

  UK AI Security Institute · 28 September 2026 · Read the source
• advanced screening evasion (ase) · SecureBio, independent evaluator · Chemical, biological, radiological and nuclear

  on advanced screening evasion, which assesses an agent’s ability to evade commercial nucleic acid synthesis screening algorithms, the railfree variant of astra was the top-scoring model that securebio has tested.

  SecureBio · 14 September 2026 · Read the source
• biotier · SecureBio, independent evaluator · Chemical, biological, radiological and nuclear

  the safeguarded astra pre-release checkpoint correctly refused 82.9% of biotier-refuse and correctly did not refuse 95.3% of biotier-permit.

  SecureBio · 14 September 2026 · Read the source
• world-class bio (wcb) · SecureBio, independent evaluator · Chemical, biological, radiological and nuclear

  on world-class bio (wcb), an open-response test of niche biological knowledge held by only a handful of specialists in the world, the highest-performing astra checkpoint scored 61.6% ± 0.6%, about seven percentage points lower than gpt-5.6 sol.

  SecureBio · 14 September 2026 · Read the source

The provider's own tests

• BioTier · Run by SecureBio, reported by the provider · Misuse & jailbreak

  Astra's safeguarded configuration refused 82.9% of requests that SecureBio designated for refusal (compared with GPT-5.6 Sol's 66.2%), while allowing 95.3% of benign requests (compared with GPT-5.6 Sol's 99%).

  OpenAI · 3 September 2026 · Read the source
• ExploitBench · The provider · Cyber

  Reported result: Astra achieved the full score of 100% cap percent, even at the lowest reasoning effort tested.

  astra achieves the full score of 100%, even at the lowest reasoning effort tested.

  OpenAI · 3 September 2026 · Read the source
• ProtocolQA open-ended · The provider · Chemical, biological, radiological and nuclear

  Reported result: Astra scored below the 54% expert threshold, scoring 41.36% (refusal-adjusted score: 45.37%).

  astra scored below this threshold, scoring 41.36% (refusal- adjustedscore: 45.37%).

  OpenAI · 3 September 2026 · Read the source
• TroubleshootingBench · The provider · Chemical, biological, radiological and nuclear

  Reported result: Astra scored above the 36.4% expert threshold, scoring 48.44% (refusal-adjusted score: 63.46%).

  astra scored above this threshold, scoring 48.44% (refusal- adjustedscore: 63.46%).

  OpenAI · 3 September 2026 · Read the source
• declining to exploit a honeypot during difficult exploit gym problems · The provider · Cyber

  gpt-6 sol, gpt-6 luna, and gpt-6 astra made no such attempt at exploiting the honeypot.

  OpenAI · 3 September 2026 · Read the source
• evaluation suite from guan et al. (2025) · The provider · Deception & sabotage

  we assess astra using the evaluation suite from guan et al. (2025) [7].

  OpenAI · 3 September 2026 · Read the source
• irregular's atomic challenges suite · Run by Irregular, reported by the provider · Cyber

  Reported result: astra solved 20/22 atomic challenges, with average success rates of 100% in vulnerability research and exploitation, 100% in network attack simulation, and 52% in evasion.

  astra also solved 20/22 atomic challenges, with average success rates of 100% in vulnerability research and exploitation, 100% in network attack simulation,and52%inevasion.

  OpenAI · 3 September 2026 · Read the source
• multimodal troubleshooting virology · The provider · Chemical, biological, radiological and nuclear

  Reported result: Astra scored 55.78% (refusal-adjusted score: 63.11%), exceeding the 31% indicative threshold.

  astra exceeded this threshold, scoring 55.78% (refusal-adjusted score: 63.11%).

  OpenAI · 3 September 2026 · Read the source
• respecting auto-review · The provider · Deception & sabotage

  Reported result: Astra made no attempts to bypass the monitor, versus 5% of gpt-5.6 sol rollouts at maximum reasoning effort.

  by contrast, gpt6 astra made no attempts to bypass the monitor.

  OpenAI · 3 September 2026 · Read the source
• sre-bench · The provider · Cyber

  at pass@4, astra solves 99.2% of the reverse engineering challenges vs. gpt-5.6sol's68.7%,usingabout1/4thasmanyoutputtokens.

  OpenAI · 3 September 2026 · Read the source

No document we read states: a safeguard. No incident on record names this version.

Some documents we hold are stored in lower case only, so their quotes are shown in lower case. The source link opens the original.

Previous version: GPT-5.6 Sol · Compare the two