OpenAI released GPT-6 Astra as a limited preview on 3 September, and to paid users the day after. The benchmark chart went round on day one and I have nothing to add to it.
I want to talk about the other document — the pricing table and the model card. That is where the decisions that will show up on your invoice live, and it gets a fraction of the attention. I have not shipped anything on Astra; this is a read of the published specs, not a review.
The headline numbers
$10 per million input tokens, $50 per million output. Cached input drops to $1, and cache writes cost $12.50. The context window is 1,050,000 tokens, with a 922,000 maximum input and 128,000 maximum output. Knowledge cutoff is 30 April 2026. Text and image in, text only out. Reasoning effort is exposed as five levels, low through max.
It supports Chat Completions, the Responses API, and batch. No fine-tuning, no realtime, no embeddings, no audio. If your architecture assumed you could fine-tune the frontier model, that assumption is gone for this generation.
The surcharge nobody put in the headline
Buried in the pricing notes: requests exceeding 272,000 input tokens are charged at 2× the input and cache rates, and 1.5× on output.
That is a cliff, not a curve. A request at 271K input tokens costs $2.71 to send. The same request at 273K costs $5.46. You do not get a warning, you get a bigger number at the end of the month.
The dangerous part is that nothing in a normal codebase knows where that line is. You build a retrieval step that stuffs "the relevant context" into a prompt, it works fine for months on 80K-token payloads, and then one customer with a large corpus quietly pushes every request over the line and doubles the unit economics of that feature. Nobody gets paged for a cost regression.
If you deploy this, put a hard assertion on input token count before the call — not a log line, an actual branch that either trims or takes a different path. Track the distribution, not the mean. The mean will look fine right up until it doesn't.
A million tokens is an option, not an instruction
The 1M-token window is the specification everyone repeats, and it is genuinely useful for a class of problem — whole-repository reasoning, long document sets, agent runs that accumulate state over hours.
It is also the easiest way to build something expensive and slow for no benefit. Filling the window costs money on every single call, and OpenRouter's provider data currently shows peak throughput around 47 tokens per second with a P50 latency near 2.85 seconds. A large prompt is not free in either dimension.
The prompt caching discount is what makes long-context viable — $1 versus $10 per million on cached reads is a 90% saving — but it inverts the usual advice about prompt construction. Caching rewards a large, stable prefix followed by a small variable suffix. If you assemble prompts by interpolating user-specific data throughout, you get no cache hits and pay full freight, plus $12.50 per million to write a cache you never reuse. That is an architectural constraint, and it wants deciding before you write the prompt layer rather than after.
The security classification is the actual story
Astra is the first model OpenAI has placed at the Critical cybersecurity level under its Preparedness Framework. In their own framing, given the right tools and access it can find previously unknown security flaws and develop novel exploits against well-defended systems without a human directing each step.
They shipped it anyway, with the edges sanded off: the public model refuses a range of security prompts, advanced capability sits behind a vetted tester programme, and defensive access is routed through a separate track. Whether that holds is an empirical question nobody can answer yet.
The practical consequence for ordinary work is smaller than it sounds but not zero. If you do anything adjacent to security — dependency auditing, log analysis, writing fuzzers, reviewing auth code — expect refusals on prompts that a previous model answered without comment. Build the fallback path now rather than discovering it in a pipeline at 2 a.m.
The consequence for everyone else is worth sitting with regardless. A capability that can find novel vulnerabilities without supervision is available to whoever qualifies for the tester programme, and the defensive equivalent is not yet evenly distributed. That asymmetry is a real thing to plan around, not a talking point.
The reasoning you cannot read
Astra introduces a technique OpenAI calls recurrent depth, which obscures some or all of the model's reasoning trace. Several safety researchers have publicly flagged this as a monitorability problem, and I think they are right to.
Set aside the alignment argument for a second, because there is a mundane engineering version of the same complaint. Visible chain-of-thought has been a debugging tool. When a model reaches a wrong answer, being able to read where it went sideways is how you fix the prompt. Take that away and you are back to black-box iteration — change something, rerun, see if the output improves, form a folk theory about why.
Vendor benchmarks are vendor benchmarks, too. GPQA Diamond at 94.6% is a real number from a real evaluation, and it tells you approximately nothing about whether the model handles your domain's failure modes. That has always been true, and it matters more when you cannot inspect the reasoning behind a wrong answer.
What I would actually do
Nothing urgent, which is an unfashionable position five days after a launch.
Astra is priced as a specialist instrument — 5× the input cost of the tier most production features should be running on. The right move is not to swap your default model. It is to identify the two or three places where you are currently losing to model capability, put Astra behind an interface you can swap, and measure it against the cheaper option on your own evaluation set rather than on OSWorld.
Then check your token distribution against that 272K line before anything goes near production traffic.
The benchmarks will be beaten by something else within a few months. The pricing cliff and the missing reasoning trace are the parts that will still be shaping your architecture next year.