GPT-6 Astra brings cross-window notes and safety interrupts to Codex

OpenAI began rolling out GPT-6 Astra on September 3, first to a limited set of organizations, with availability expanding to ChatGPT Plus, Pro, Business, and Enterprise plans and to the API, Microsoft Azure, and AWS Bedrock "in the coming days." Standard API pricing is $10 per million input tokens and $50 per million output tokens, with a Fast mode at twice the speed for twice the price. Cognition says it integrated Astra into Devin's harness on launch day; Silas Alberti, the company's SVP of research, said it delivered "state-of-the-art performance on our internal testing benchmark" there.

Inside Codex, OpenAI paired the model with harness changes aimed at computer-use speed, reporting 1.9x faster task completion than GPT-5.6 Sol on the Mind2Web benchmark. A new context feature changes how Codex handles long sessions: instead of compacting a full context window into a single summary, Astra can keep notes across windows while leaving earlier context searchable. It can retrieve a requirement or test result from earlier in a run even if that detail never made it into a summary. The feature is opt-in today through Codex's config.toml and becomes Astra's default "in the coming weeks."

OpenAI says Astra meets the Critical threshold for cybersecurity capability under its Preparedness Framework. It scored 100% on ExploitBench versus 78.5% for GPT-5.6 Sol and found two previously unknown zero-day vulnerabilities during internal testing, which OpenAI says it is disclosing to the affected maintainers. At this launch configuration, Astra will refuse tasks like building proof-of-concept exploits, and OpenAI is running expanded misalignment monitoring in production for Astra-class models. The company acknowledges the cost: "Extra safety checks can sometimes slow, pause, or stop legitimate work, including defensive cybersecurity."

Why it matters: Astra changes two assumptions for harness builders. A long session can preserve searchable notes instead of relying on one compressed summary, while an OpenAI safety classifier can pause legitimate work outside the operator's control. Verification loops and long-running jobs need to account for both behaviors.