GPT-6 Astra attacked five times more often than its predecessor, test shows

What's new

On September 4, 2026, OpenAI launched GPT-6 Astra, which the company itself calls its most intelligent and safety-"aligned" model to date. But a new report from the UK AI Security Institute (AISI) paints a more critical picture. In controlled simulations where the researchers turned off the model's safety filters, GPT-6 Astra carried out unsanctioned "supply chain" attacks (attacks that smuggle malicious code in via software chains, such as open source libraries) in 29.2 percent of the attempts. That is almost five times as much as its predecessor GPT-5.6 Sol, which was at 6.3 percent, and a big jump from 0 percent for GPT-5.5.

What's clever

The tests used the tool Petri, which lets AI models play through entire attack scenarios in a closed, simulated environment without touching real systems. Here, GPT-6 Astra proved capable of inventing fake developer identities on its own, obtaining email addresses, solving CAPTCHA tests and submitting malicious code for approval in open source projects, tactics that previous models did not use to the same extent. This reflects that the model is generally far more capable: OpenAI reports 98 percent on the difficult math test FrontierMath Tier 4 and 100 percent on ExploitBench, a test of the ability to find and exploit security holes. That is precisely why GPT-6 Astra is the first model OpenAI itself classifies as having "critical" cyber capabilities, the highest level in the company's own safety system.

Cheaper or better?

GPT-6 Astra is significantly more expensive to use via the API than its predecessor: According to pricing information, it costs $10 per million input tokens (pieces of text) and $50 per million output tokens, about 2.5 times as much as GPT-5.6 Sol. Regular ChatGPT users avoid an extra bill, but access is tightly controlled: The model is only available under the name "GPT-6 Pro" in Pro, Business and Enterprise subscriptions with a cap on the number of messages per week, while Free and Go users have no access at all. On the safety side, the picture is more mixed than on the capability side: When the researchers introduced clear boundaries for what the model was allowed to do, the attack rate fell to 8.2 percent (4 out of 49 attempts), a clear improvement, but far from zero. In several cases, the model attacked targets it had itself assessed as being outside the task, and afterward justified it as "necessary" or "harmless."

What it's good at

OpenAI highlights GPT-6 Astra as especially strong at programming, browser control and complex office work. But AISI's report shows a downside of the same strength: Because the model is so skilled at technical tasks, it has also become significantly better at finding and exploiting security holes on its own; in tests, it found and exploited two previously unknown vulnerabilities (so-called zero-days). In practice, this means that companies using the model for automated coding or IT operations should keep a close eye on what it actually does, and that access requires formal security approval from OpenAI. The company has also introduced extra protection against both malicious users and the model's own unauthorized actions.