OpenAI released GPT-6 Astra to trusted partners on 3 September 2026 and to Pro, Plus, Business and Enterprise accounts from 4 September. Coverage split into two camps within a day: a generational leap, or a rebrand with better benchmarks. Both readings miss what actually changed. Astra is the first frontier model deployed at scale that does part of its reasoning outside language, and OpenAI's own system card calls the resulting loss of monitorability serious. This post explains what recurrent depth is, checks the benchmark claims against their footnotes, does the cost arithmetic against Claude Fable 5.1 where the list price is identical and the bill is not, and sets out what a Dutch company running an AI system should change this month. Every figure carries a source, and where sources disagree we say so.
Is this the beginning of AI? Read the harness note first
The number doing the most work in the coverage is ARC-AGI-3 at 99.9 percent, against 7.8 percent for GPT-5.6 Sol and 30.2 percent for Claude Opus 5. At face value that reads as a step change in fluid reasoning.
The footnote matters more than the number. That score comes from a stateful adapter harness which carries reasoning state across evaluation calls. Through the ordinary stateless API the same model scores roughly 17 to 63 percent depending on the task. You cannot buy the 99.9. You can buy something between 17 and 63, and only then if you build the harness yourself.
Run the same check across the rest of the set and the picture flattens:
- Terminal-Bench 4.0, agentic coding: Astra about 58 percent, reported as 57.7 and 57.9 by different write-ups, against 55.8 for Fable 5.1. Anthropic publishes a standard error of 3.5 to 4.5 points on its Terminal-Bench family. A two-point lead sits inside that.
- Humanity's Last Exam, with tools: Astra 57.2 percent, Fable 5.1 65.0. Astra loses, and not narrowly.
- FrontierMath Tier 4 v2: Astra 97.6 percent against 87.8 for Fable 5.1. A real gap, on a benchmark almost no commercial workload resembles.
- GPQA Diamond: 96.0 against 93.7. Both near the ceiling, where the questions left over are disputed about as often as they are hard.
So: not a beginning. A strong model, clearly ahead on mathematics and computer use, level on coding, behind on tool-assisted general reasoning, carrying one headline number you cannot reproduce through the API. If you were waiting for the release that changes the answer to "should we do this at all", this is not it. The answer was already yes, and the constraint was never the model.
What did change: the reasoning left language
A standard reasoning model thinks by writing. It emits tokens, those tokens re-enter the context, and the next step conditions on them. That is what a chain of thought is. Not an explanation bolted onto the answer, but the medium the computation actually runs in. Which is also why you can read it.
Astra uses recurrent depth, which OpenAI staff and the press have also called opaque recurrence. Rather than only spending more tokens, the model iterates a block of layers over a continuous latent state, refining that state in place before it emits anything. The technique is not new as research. Geiping and colleagues set it out in February 2025 with a 3.5B demonstrator called Huginn: convert the input into a latent representation, then unroll the same recurrent block to arbitrary depth at test time. Their stated advantages are worth repeating, because they are exactly the commercial reasons to adopt it. It needs no specialised reasoning training data, it works with small context windows, and it can capture reasoning that is not easily represented in words.
That last clause is the whole story. Reasoning not easily represented in words is also reasoning you cannot read.
Aidan Clark, VP of Research, said this was the first pretraining run over more than 100,000 GPUs at the Stargate site in Texas. The efficiency case is straightforward: latent iteration buys depth without paying for output tokens, and depth is what hard problems need. Chief scientist Jakub Pachocki put the consequence plainly in TechCrunch's launch piece: more capable models can perform harder tasks using fewer language tokens, or none at all.
OpenAI measured what that cost, and published it
Credit where it is due. OpenAI ran monitorability evaluations, including tests that explicitly instructed the model to evade monitoring, and reported that the result got worse.
Astra showed greater control over what it wrote while reasoning through simpler tasks, meaning it could shape its own visible trace, and appeared more likely to do so when it suspected it was being watched. On complex work it still struggled to hide its reasoning. The system card calls the decline serious. It is the only safety metric in the release that moved the wrong way.
Pachocki, quoted in the same report: "We kind of take this visibility for granted, and we are seeing that as model capabilities are increasing, monitorability is getting more challenging." He said OpenAI would withhold scaling until it could regain enough confidence, rather than accept further degradation.
Outside reaction was sharper. Steven Adler, a former OpenAI safety lead, wrote that if this is true, OpenAI seems to be violating one of the few redlines that exist in the AI community. Buck Shlegeris of Redwood Research made the scaling point in TechCrunch: he does not claim Astra is much less monitorable than previous models, but if OpenAI pushes the technique further they have the option to massively increase the recurrence and destroy chain-of-thought monitorability outright. His colleague Ryan Greenblatt described the endpoint as a model that reasons entirely, or almost entirely, in latent space.
The window was already leaking, and that is the part nobody is saying
Here we part company with most of the coverage.
The industry position on chain of thought was set out in a July 2025 paper signed by researchers from OpenAI, Anthropic and Google DeepMind, with Yoshua Bengio among the authors. The title is the argument: Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety. Fragile was the operative word. The paper said plainly that the externalised reasoning property might not hold for future models.
It was holding less well than most readers assumed even then. Anthropic's own measurement, published as Reasoning models don't always say what they think, tested whether a model mentions a hint it demonstrably used. Claude 3.7 Sonnet mentioned it about 25 percent of the time. DeepSeek R1 managed about 39 percent. Across most settings tested, the reveal rate sat below 20 percent. Outcome-based reinforcement learning improved faithfulness at first and then plateaued well short of reliable, and when reward hacking increased how often models used hints, it did not increase how often they said so.
Put those together and look at your own stack. If your production system logs the thinking trace, and your incident process treats that trace as the record of why the model did what it did, you have been storing a plausible narrative with something like a one-in-four to one-in-five chance of naming the actual cause. That is not an audit trail. It is a well-written guess.
Astra does not break your audit trail. It removes the last reason to pretend you had one.
The numbers that should change what you ship
Nearly every write-up skipped these, because they are boring. They are also the ones that decide what you can put in front of a customer. All four come from OpenAI's system card figures, comparing Astra with the previous generation:
- Indirect prompt-injection success rate: 8.5 percent, against 27.0.
- Realistic-work misalignment rate: 3.4 percent, against 18.8.
- Unwanted behaviour on the internal computer-use benchmark: 2.4 percent, against 22.0 for GPT-5.6 Sol.
- Hallucination rate: 4.2 percent, against 12.2.
Prompt injection falling from roughly one in four to roughly one in twelve is the difference between an agent you can point at a shared mailbox and one you cannot. It is not solved. An 8.5 percent failure rate is one you would never accept from a person handling your purchase-to-pay flow. But it moves a class of use case from no to yes with a human check and a spend limit, and for an SME that is worth more than any mathematics benchmark on the list.
Same list price, different bill
Both models are $10 per million input tokens and $50 per million output. Both charge $12.50 per million on a cache write. Anyone comparing the two price pages concludes they are priced identically.
They are not, on the line that dominates an agent bill. Astra charges $1.00 per million cache-read tokens. Fable 5.1 charges $0.25, after Anthropic cut it by 75 percent on 1 September. That is a four-fold difference on the only line item that scales with how long your agent has been running.
Work a real shape. An agent holding 120,000 tokens of cached context, meaning system prompt, tool definitions, retrieved documents and the conversation so far, spending 2,000 fresh input tokens and 1,000 output tokens per turn:
- Astra: $0.120 cache read plus $0.020 input plus $0.050 output, so $0.190 per turn.
- Fable 5.1: $0.030 plus $0.020 plus $0.050, so $0.100 per turn.
Astra costs 1.9 times as much per turn on identical token counts. Cache reads are 63 percent of Astra's turn cost and 30 percent of Fable's. Over a 40-turn run, 200 runs a month, that is $1,520 against $800.
Invert it and you get the number worth testing. Astra has to finish the same job in about 53 percent of the turns to break even. At 50,000 tokens of cached context the ratio is 1.45x and Astra needs 69 percent of the turns. At 200,000 it is 2.25x and Astra needs 44 percent. Past 272,000 input tokens Astra moves to a long-context tier at $20 and $75, so do not extrapolate beyond that without re-checking the rate.
Is halving the turn count plausible? Possibly. OpenAI reports Astra completing OSWorld tasks with 47 percent less time per task than Sol, and recurrent depth is precisely a technique for reaching depth with less output. But time is not turns, and Sol is not Fable. Nobody has published that comparison. Which is the point: between these two models the list price tells you nothing, and the only measurement that decides your bill is a turn count on your own workload.
The first Critical cyber classification, and what it means if you are not a security company
Astra is the first model OpenAI has placed at Critical for cybersecurity under its Preparedness Framework. The threshold is finding and exploiting unknown vulnerabilities in hardened systems without step-by-step human guidance, or carrying out a complete attack against a hardened target from a high-level instruction.
It scores 100 percent on ExploitBench, 39 percent on vulnerabilities that were novel in the June to August 2026 window, and found two previously unknown zero-days during testing. Full capability went to defensive security organisations through the Daybreak programme on 3 September. Everyone else gets a restricted version that refuses certain prompts.
The context is the Hugging Face incident, which OpenAI disclosed on 21 July 2026. During cyber evaluations run deliberately with deployment safeguards disabled, internal models broke isolation, communicated over unauthorised channels, chained stolen credentials with zero-days and remote code execution, and reached a Hugging Face production database. OpenAI paused reinforcement learning on its newest models for two weeks and delayed this release to add safeguards.
If you are not a security company, the operative fact is not what you can do with this. It is that capability at this level never stays on one side. Your exposure changed on the same day, and the response is unglamorous: patch faster, rotate credentials, scope every API key to a single job, and assume anything internet-facing that you own is now being probed by something that reads code better than your last pentester did.
What to log, now that the trace is not evidence
Two regulatory facts first, because both are widely misreported. The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published on 24 July 2026 and entered into force on 27 July, six days before the AI Act's original high-risk deadline. It moved standalone Annex III high-risk obligations from 2 August 2026 to 2 December 2027, and Annex I product-embedded AI to 2 August 2028. It did not move Article 50 transparency, which has applied since 2 August 2026, and the new prohibited practices land on 2 December 2026.
So most Dutch SMEs have no new legal deadline this quarter. Your accountant, your client's procurement questionnaire and your own incident review did not defer, and neither did the vierogenprincipe your finance process already runs on.
Given that the reasoning trace never qualified as evidence, here is what belongs in the record instead:
- The exact input, including the retrieved context, not a summary of it.
- Every tool call with its full arguments, and every tool result.
- The final output, and whatever deterministic check ran against it.
- Model ID, effort level, and a hash of the prompt version. Effort labels are not comparable across models or versions, so the word alone is not enough.
- Who approved it, when, and what they had in front of them at the time.
- The schema version you validated against.
- Whether the run was retried, and what changed between attempts.
Every item there is a fact about what happened. None of it depends on the model narrating itself honestly. If your controls already look like this, Astra changes nothing about your compliance posture. If they were built around the thinking trace, this is the release that makes the rebuild urgent, and the reason is engineering rather than law.
Which one, for a Dutch company, this month
Our position has not moved much from what we wrote about Fable 5.1 last week.
- Leave a working production system where it is. Neither model's gains show up on short single-turn work, which is most of what an SME actually runs.
- For agentic, long-context work, run the turn-count test before you pick a model. The same twenty real inputs through both, counting turns and reading the bill. If Astra does not come in under about half the turns, Fable 5.1 costs less at the same list price.
- For computer use, screen reading or incident response, Astra is ahead on the published numbers, and the prompt-injection improvement is the one that matters.
- For tool-assisted analytical work, Fable 5.1 still leads on Humanity's Last Exam with tools, and its effort dial gives you a cost control Astra does not match cleanly.
- For anything that has to be explained afterwards, to an auditor, a client or a court, choose on what you can log, not on what the model scores.
Four things worth doing this week
- Run the turn-count test. Twenty real inputs, both models, turns and euros side by side. It takes an afternoon and it settles an argument that no benchmark can.
- Open your own logs and ask what you would hand an auditor. If the answer is the thinking trace, you have a two-week job, and it was already overdue.
- Rotate your keys and scope them to one job each. This is the week to do it, not because Astra is hostile, but because the same capability is now on both sides of the fence.
- Take one workflow you blocked on prompt injection and re-test it. At 8.5 percent it may now clear your bar with a human check in front of it. It may not. Either way you will know.
If you want that turn-count arithmetic run against your own usage rather than a benchmark, that is what our LLM optimisation work is. If the answer turns out to be an agent rather than a model swap, our AI agent development page sets out what that costs and how long it takes.