GPT-6 Astra: a weekend of testing, and four rules before you leave it unattended.

Last checked: 12 Sep 2026. Prices are converted from US dollars at £1 = $1.35 on 11 Sep 2026; vendors bill in dollars and UK VAT applies on top.

OpenAI released GPT-6 Astra on 3 Sep 2026. I spent the following Saturday putting it through the work I actually do: knowledge work, strategy, coding, infrastructure and AI agent development. This is what I found, and the four rules I now run it under.

This is not a recommendation to switch. I use Astra and Claude Fable 5.1 side by side and I am not going to tell you which one to buy, because that answer depends on your workload and not on my Saturday.

It is better than the benchmarks suggested

The independent benchmark comparisons I had read before I started put Astra below Fable 5.1. My own testing found it much, much better than that.

The character is the interesting part. Astra is persistent, resourceful and scrappy. It will beat down the gates of hell to get the job done. It will also have a go at your own gates if it thinks that is what you want.

That is not a complaint. It is a description, and it is the most useful thing I can tell you before you turn it loose on your systems.

What "resourceful" looks like in practice

Several times over the day, Astra wanted a credential that was not in its working space. It did not stop and ask me to paste one in. It reasoned about where that credential might plausibly live, and then asked to go and look there.

It spun up a browser to reach data held in SaaS applications. Sometimes it asked first. Sometimes it did not.

It used connectors, including Outlook. Usually it asked. Not always.

Two things made that acceptable on the day. My security setup meant it would have failed even if I had granted permission, and I was sitting there watching it. Take either of those away and the same behaviour is a very different story.

I want to be clear that I do not think this is a safety failure on OpenAI's part, and I do not think they were irresponsible. I think Astra is safe. But we all need to own our security postures, and a model that is this good at finding a way through is a reasonable prompt to go and check yours.

Four rules

1. Observe

Do not leave it unattended yet. Do not set it going and then go and do something else in another window. Sit with it and learn how it behaves, the way you would with a new hire who is quick, capable and does not yet know where the boundaries are.

Use that time to firm up your security. You will learn more about the gaps in your own access controls in an afternoon of watching an agent work than in a month of reading policy documents.

2. Stay on Light

Astra exposes a reasoning effort setting, from low to max. The instinct is to turn it up. In my testing the effort slider rarely needed raising, and on the occasions I did raise it, Medium produced output that matched Extra High.

Higher effort costs more and takes longer. If the low setting gives you the answer, that is the answer.

3. No subagents

I tried the obvious pattern of having Astra plan the work and hand the grunt work to subagents. Having Astra do both the thinking and the grunt work itself was better, faster, and comparable in cost. So that is how I run it.

This may change. It is a statement about this model in September 2026, not a law about agent architecture.

4. No step-by-steps

Do not write it a numbered procedure. State the need and the constraints, and let it plan. The planning is where the model earns its money, and a prescriptive prompt throws that away.

The long-running task

I set Astra a long-running task on a Monday morning. It ran until 3am on the Tuesday. The output was something I genuinely could not fault.

The trick was not the prompt. It was three things underneath it: a secure environment, a measurable definition of done, and telling it what I did not want as well as what I did. Without a measurable definition of done, a model this persistent will keep going, and "keep going" is not the same as "finish".

A separate test made the same point about persistence. I gave it a calculation to reverse-engineer. It worked through 730 combinations to get there. A person would have given up, or guessed, or asked for the spreadsheet.

Which is really the headline. AI in the hands of a skilled user will produce great results. The skill has moved, it has not disappeared.

The facts, for context

Here is what OpenAI itself publishes about the model, checked on 12 Sep 2026.

The "Critical" cybersecurity rating is OpenAI's own classification, not an outside verdict, and it is the first time OpenAI has applied it. It means the model can find and exploit unknown vulnerabilities with little human help. Read that alongside my Saturday and the observe rule stops sounding cautious.

On residency, ignore anything you read in the first week of September saying Astra has no EU data zone. OpenAI's own data controls page lists gpt-6-astra under data residency today. The UK entry is storage only, which matters if your obligation is about where processing happens rather than where data sits.

The rollout was messy, and that is worth remembering

Day-one access went to participants in OpenAI's vetted cybersecurity programme. Paying Pro, Business and Enterprise customers did not have it, and said so. Sam Altman publicly called the rollout messy. Access widened over the following days.

The lesson is procedural. Before you plan work around a newly released model, confirm your organisation has entitlement to it on the plan you pay for and that it is enabled in your workspace. Enterprise administrators have to switch Astra on, because it is off by default.

What I would do on Monday

If your team is about to start using Astra on real systems:

1. Check entitlement and workspace enablement before anyone plans around it.
2. Audit what your existing credentials, connectors and browser sessions would actually allow an agent to reach, on the assumption that it will try.
3. Run supervised for a fortnight, with someone watching, and write down what it did that you did not expect.
4. Default to the lowest reasoning effort and only raise it where you can show the output improved.
5. Write a measurable definition of done for anything you intend to leave running.

None of that is model-specific advice dressed up. It is the same discipline you would apply to any process that can act on your systems without a person in the loop, which is what an agent is.

We work across both OpenAI and Anthropic models. If you want help deciding which model fits a given workload, or you want the security posture looked at before you give an agent access to anything, start with our diagnostics, read how we approach OpenAI implementation and AI implementation more generally, or Request a Quote. We wrote separately about what being an OpenAI Select Partner means and, more usefully, what it does not.

Frequently asked questions

Is GPT-6 Astra better than Claude Fable 5.1?

It depends on the workload, and I am not going to pick one for you. The published independent benchmark comparisons I read put Astra below Fable 5.1, but my own testing across knowledge work, strategy, coding, infrastructure and agent development found it much better than those numbers suggested. I use both.

Can I leave GPT-6 Astra running unattended?

Not yet, and not until you have watched it work on your own systems. It is persistent and resourceful enough to look for credentials it has not been given, open a browser to reach data in SaaS applications and use connectors, sometimes without asking first. Supervise it, learn its behaviour, and fix the gaps it exposes in your access controls.

What reasoning effort should I use with GPT-6 Astra?

Start at the lowest setting. In my testing the effort slider rarely needed raising, and where I did raise it, Medium matched Extra High on output quality while costing less and finishing sooner.

Should I split work between GPT-6 Astra subagents?

In my testing, no. Having Astra do both the planning and the execution itself was better, faster and comparable in cost to handing the execution to subagents. That is a finding about this model in September 2026, not a permanent rule.

Does GPT-6 Astra support UK or EU data residency?

OpenAI's data controls guide lists gpt-6-astra as supported for data residency on the Responses, Chat Completions and Batch endpoints. The EU region covers storage and in-region processing and requires Modified Abuse Monitoring or Zero Data Retention approval. The UK region is storage only. Residency endpoints carry a 10% uplift for models released after 5 Mar 2026. Checked 12 Sep 2026.

How much does GPT-6 Astra cost?

OpenAI's model page prices it at about £7.40 per million input tokens, about 74p for cached input, about £9.30 for cache writes and about £37 per million output tokens. Converted from US dollars at £1 = $1.35 on 11 Sep 2026; OpenAI bills in dollars and UK VAT applies on top. Batch and Flex service tiers run at half the standard rate and the Fast tier at double.

John Kelleher is a Claude Certified Architect (Foundations and Professional) and leads SpotDev, a Claude Registered Partner and OpenAI Select Partner.