OpenAI ships GPT-6 Astra at $10 per million input tokens, with enterprise access off by default

OpenAI published GPT-6 Astra on September 3, 2026, two days after saying the model had reached the Critical cybersecurity threshold in its own Preparedness Framework. The launch post fills in what that announcement left out: the price, the plans, and the conditions under which the model will refuse to work or stop mid-task.

What it costs and where it runs

API pricing is $10 per million input tokens and $50 per million output tokens, with separate rates for cache reads and writes. A fast mode is offered at up to twice the speed of standard processing for twice the standard price, which is the whole trade: you buy latency with money, not with quality.

Access arrives in stages. A limited set of organizations gets it first, and the ChatGPT Plus, Pro, Business, and Enterprise tiers follow over the coming days. Astra usage counts against the subscription allowance you already have, and both individuals and companies can buy credits beyond it. Pro, Business, and Enterprise plans additionally get GPT-6 Astra Pro.

• In the API the model name is gpt-6-astra, and the same model is served through Microsoft Azure and Amazon Bedrock.
• Enterprise administrators have to enable Astra for their workspace, because access is off by default at launch.
• Zero Data Retention is supported for eligible API customers.

The numbers are OpenAI's own

Terminal-Bench 4.0 puts an agent in a terminal and scores software engineering, system configuration, and data analysis tasks. OpenAI reports 57.9% there for Astra, against 37.3% for GPT-5.6 Sol and 55.8% for Claude Fable 5.1, at roughly 9% and 63% lower estimated API cost per task. On Agents' Last Exam it reports 59.3% against 55.5% for Claude Opus 5 and 53.6% for Sol, while using about 65% fewer output tokens than Opus 5.

Two caveats travel with all of these. The cost figures are OpenAI's own estimates from its own runs, not a billed invoice, and the scores are the maximum at any effort setting, which is not the setting a default deployment uses. Read them as the vendor's best case rather than as an independent measurement.

• FrontierMath Tier 4 (v2): the results table gives 97.6%, while the opening paragraph of the same post rounds it to 98%.
• ARC-AGI-3: 99.9%, with Greg Kamradt of the ARC Prize Foundation quoted as calling it effectively human parity on that benchmark.
• ExploitBench: 100%, against 78.5% for GPT-5.6 Sol, measured without production safeguards.

The safeguards will interrupt you

This is the part that matters if you plan to build on Astra. The shipping version refuses advanced cybersecurity requests, including writing proof-of-concept exploits for vulnerabilities, and OpenAI says less restrictive safeguards will roll out through its Daybreak program in the coming weeks. Secure code review and patching are allowed today.

Beyond refusals there is a monitoring layer that acts mid-task. In OpenAI's own words, extra safety checks can slow, pause, or stop legitimate work. In ChatGPT and Codex you may be asked to review an action before it continues; in the API the task simply stops. Anything you build on top of the API therefore needs to treat a halted task as a normal outcome, not an exception, and to surface it to whoever is waiting for the result.

The capability behind the caution is not hypothetical. OpenAI says that during an internal evaluation on recent V8 vulnerabilities the model found and used two previously unknown ones, and that both were disclosed to their maintainers.