It beat humans on ARC-AGI-3.
And it went "Critical."
OpenAI's new flagship GPT-6 Astra posted an unprecedented jump on the abstract-reasoning benchmark ARC-AGI-3, pulling the AGI timeline forward. But the same model is also the first OpenAI has ever rated "Critical" on cyber capability under its own safety framework.
What "7.8% to 98.6%
in six months" actually means
GPT-6 Astra, which OpenAI shipped on September 3, 2026, scored 98.6% on ARC-AGI-3, a benchmark of novel visual-reasoning puzzles. Six months earlier, GPT-5.6 Sol scored just 7.8%. This is the first time an OpenAI model has topped the human-average efficiency baseline on the benchmark. ARC Prize founder François Chollet called the pace "2x faster than I expected," and moved up his own AGI timeline as a result.
This isn't a general intelligence score, though. ARC-AGI-3 is built specifically to test whether a model can solve puzzles it has never seen before, on the spot — the kind of reasoning that raw pretraining scale doesn't automatically buy. That's exactly why this particular jump carries more weight than an ordinary leaderboard update.
| GPT-5.6 Sol (previous gen) | GPT-6 Astra (new gen) |
|---|---|
| ARC-AGI-3 score: 7.8% | ARC-AGI-3 score: 98.6% |
| Internal hallucination rate: 9.4% | Internal hallucination rate: 2% |
| External prompt-injection success rate: 27.0% | External prompt-injection success rate: 8.5% |
| Preparedness tier: below Critical | Preparedness tier: Critical (a first for OpenAI) |
The progress is 2x faster than I expected.
— François Chollet, founder of ARC Prize
The benchmark verdicts don't agree
The caveats around that 98.6% number matter just as much as the number itself.
By OpenAI's own account, Astra was scored on a Responses API harness with two settings changed to "better reflect real-world use," while the comparison models kept their standard harness and settings. That asymmetry is a direct reason independent benchmark trackers disagree: Epoch AI ranks Astra ahead of rivals, while Artificial Analysis rates it no better than its predecessor.
In other words, "beats humans on ARC-AGI-3" and "flat on other benchmarks" are both true headlines at once. Reading only one of them is a shortcut worth resisting.
Safety moved at the same time
The capability leap came with a risk-tier upgrade attached.
In its own safety overview, OpenAI says Astra went through adversarial training with an automated red-teaming agent, and is significantly less likely than its predecessor to take "misaligned" actions — unauthorized transactions, data loss, excessive access, circumventing controls. Its resistance to prompt injection also improved, from a 27.0% external attack-success rate down to 8.5%.
At the same time, Astra is the first OpenAI model to reach the "Critical" cyber-capability tier under the Preparedness Framework — a classification meaning it can, without step-by-step human guidance, discover previously unknown security flaws and build new exploits against well-defended systems. The same trade-off shows up for the first time in hard numbers: the more capable the model, the more damage it can do if misused.
Access is still rolling out
Not everyone gets it today — here's where the staged rollout actually stands.
Limited orgs go first
Rollout starts with enterprise customers already on OpenAI's Daybreak program. Access stays off by default until an admin explicitly enables it.
Paid plans follow within days
ChatGPT Plus, Pro, Business, and Enterprise, plus the OpenAI API and AWS, are set to roll out "in the coming days" according to OpenAI.
Free plan isn't included
The announced rollout doesn't cover the Free tier. Individual users on Free will likely see Astra only after the paid-plan rollout completes.
Enterprise admins
Daybreak gets you early access, but it's off by default. Check the rollout against internal usage policy before flipping it on.
Developers
API pricing is $10 input / $50 output per million tokens, with cached input at $1, batch at half price, and Fast mode at 2x — a more granular price ladder than before.
Security teams
The first model rated Critical. Agent access scopes need tightening in advance, and audit logging needs to be stronger than it was for the last generation.
Two homework assignments behind the numbers
What makes this launch matter isn't the benchmark update by itself — it's that a third-party body, ARC Prize, pulled forward its own AGI timeline in response. AGI discussion that used to be treated as "years away, don't worry about it" is turning into a concrete, near-term conversation. For developers, this is a good moment to revisit agent designs and cost models built around the previous generation, against Astra's new pricing ladder and Fast mode. For leadership, "more capability means more governance cost" is now a line item to build into the next round of investment decisions.
None of this should read as pure optimism, though. The fact that benchmark trackers disagree with each other is itself a warning against making decisions off a single number. A high score on a security-focused benchmark like ExploitBench cuts both ways — it can just as easily become a tool for attackers as for defenders. That's exactly why enterprise admins should lock down internal access controls before flipping Astra on, not after.