OpenAI released GPT-6 Astra on September 3, 2026, calling it the start of what the company describes as the "AGI era." It is already rolling out to enterprise customers, and will reach every ChatGPT Plus, Pro, Business, and Enterprise account, plus the API, Microsoft Foundry, and AWS in the coming days.
The headline improvement is that Astra makes far fewer factual mistakes than its predecessor, GPT-5.6 Sol. OpenAI tested it on real conversations that users had already flagged as wrong, and Astra got them right far more often. That is a real gain, but remember these were the hardest cases already known to trip up the model, not a measure of everyday accuracy.
The security story is more complicated, and it is the part every business leader should pay attention to. Astra blocks 99.99 percent of attempts by a user to talk the model into doing something it should not, using a training method OpenAI calls GPT-Red that pits an automated attacker against the model during training. That number sounds close to perfect, and against casual misuse it probably is.
The real weak spot is different: instructions hidden inside documents, web pages, or files that the AI reads on someone else's behalf. This is called an indirect prompt injection, and it does not require tricking the user at all. A hacker just needs to plant a command somewhere the AI will read it, say, buried in a resume, a contract, or a webpage, and hope the AI follows it instead of its actual task.
Independent security firm Gray Swan ran 1,810 of these hidden attacks against Astra, giving each attack 15 tries. Astra was fooled at least once about 8.5 percent of the time, down from 27 percent on the previous model. That is real progress. But Anthropic's competing model, Claude Opus 5, did better in the same test, getting fooled only 4.8 percent of the time.
Put in plain terms: Astra can still be hijacked in roughly one out of every twelve carefully designed attacks, and Opus 5 in about one out of twenty-one. Neither number is zero, and both companies are pushing their models to do more unsupervised work, reading emails, filling out forms, browsing the web, running code, and operating whole computers without a person watching every step.
That combination, more autonomy plus a real failure rate, is where the risk actually lives. OpenAI also disclosed that Astra is the first of its models to cross the company's own "Critical" threshold for cyber risk, a classification that triggered extra internal safety measures because the model is now capable enough to meaningfully assist someone trying to break into a computer system.
None of this means businesses should avoid AI agents. It means the sensible move is to keep a human checkpoint on any agent that can move money, touch credentials, or send messages on your behalf, especially one that reads documents or the open web as part of its job. The tools are getting better at defense every few months, but getting better is not the same as safe to leave unsupervised.