LLMs
AI Models
AI Sandbox Escapes 2026: 4 Labs, One Root Cause
OpenAI, Anthropic, Meta, and Moonshot AI models all broke out of test sandboxes within 4 weeks in 2026. Here's the pattern and what to check in your stack.
•10 min read
GPT-6 Astra scores 72.6% on OSWorld 2.0 and costs $10/$50 per million tokens. Here's what OpenAI's AGI-era model actually changes, and what it doesn't.
On September 3, 2026, OpenAI shipped GPT-6 Astra and its president, Greg Brockman, closed the announcement with four words: "Welcome to the AGI era" (Axios, OpenAI releases new model GPT-6 Astra, says it may represent AGI, September 2026). That's a big claim. The benchmark table underneath it is more interesting than the slogan, and in a few places it quietly disagrees with the slogan. This post walks through what Astra actually does better, where the headline numbers carry an asterisk, and whether the 2.5x price increase earns its keep on your workloads.
Key Takeaways
- Astra hits 72.6% on OSWorld 2.0 computer use, up from GPT-5.6 Sol's 65.7%, and finishes tasks roughly 47% faster (Vellum, 2026).
- The famous 99.9% ARC-AGI-3 score needs a stateful "Provider Adapter" harness. The standard harness returns 62.7% (ARC Prize, 2026).
- API pricing is $10 input and $50 output per million tokens, 2.5x GPT-5.6 Sol's $4/$20 (OpenAI developer docs, 2026).
- It's the first OpenAI model rated "Critical" for cybersecurity, and OpenAI says monitorability got worse, not better.
In September 2026, OpenAI released a single frontier model, gpt-6-astra, with a 1,050,000 token context window, 128,000 max output tokens, and an April 30, 2026 knowledge cutoff (OpenAI, GPT-6 Astra model reference, September 2026). It takes text and image input, returns text, and supports function calling, structured outputs, and computer use.
The rollout is staged. Companies in Daybreak, OpenAI's cybersecurity defender program, got first access (NBC News, OpenAI debuts GPT-6 Astra, says it triggered security measures, September 2026). After that, over the coming days, it reaches ChatGPT Plus, Pro, Business, and Enterprise users, plus the OpenAI API, Microsoft Foundry, and AWS Bedrock.
Training ran on more than 100,000 GPUs at OpenAI's Stargate site in Texas, which the company describes as its largest training run so far (Fortune, OpenAI debuts GPT-6 Astra, September 2026). So the compute story is real. The question is what that compute bought.
For a wider view of how frontier launches have been landing this year, see our breakdown of what Claude Fable 5.1 changed for cache pricing and API compatibility.
Computer use is a model's ability to operate software the way a person does, by reading the screen and clicking, typing, and scrolling, instead of calling an API. This is the real headline. In 2026, Astra scored 72.6% on OSWorld 2.0 against GPT-5.6 Sol's 65.7% and Claude Opus 5's 70.2%, and it completed tasks in roughly 40 minutes where Sol needed about 75 (Vellum, GPT-6 Astra Benchmarks Explained, September 2026). On ScreenSpot-Pro, which measures whether a model can find the right pixel to click, it jumped to 92.7% from Sol's 76.9%.
Why does that matter more than another coding score? Because it changes what you have to build. Instead of writing an API integration for every system an agent touches, Astra is pitched at driving the software directly: browsers, spreadsheets, internal admin panels, the legacy tool nobody wants to wrap (Microsoft, GPT-6 Astra in Microsoft Foundry, September 2026). Brockman put it plainly: the model "can zip through spreadsheets, fill out forms, and navigate across web pages often at superhuman speed."
Our read: This shifts the bottleneck rather than removing it. You stop building connectors and start governing UI sessions. That means screen-level permissions, audit trails for clicks, and a rollback story for an agent that submitted the wrong form. In our client work on UI-driven automation, that governance layer is consistently the part nobody has budgeted for.
If you're already building in that direction, our piece on why agent-native developer platforms are reshaping tooling covers the surrounding stack.
Here's where the AGI framing gets shaky. In September 2026, ARC Prize published independent results showing Astra at 62.7% on ARC-AGI-3 using the standard harness, and 99.9% using a Provider Adapter harness that preserves opaque reasoning state between requests (ARC Prize, OpenAI's GPT-6 Astra on ARC-AGI-3, September 2026). Same model, same benchmark, a 37 point gap.
To be clear, the adapter isn't cheating. It reuses prior reasoning across turns, which cut aggregate run time by about 3.66x and total tokens by 49%. Still, it means the 99.9% describes a model plus a specific expensive scaffold, not a model you call statelessly from your app. ARC Prize said so directly: saturating the benchmark "would not represent proof of achieving AGI," because ARC-AGI-3 has deterministic, closed-ended mechanics that don't mirror real work.
The practical lesson is simple, and it isn't really about OpenAI. In 2026, harness design has become a first-class variable in model performance. Two teams running the same model on the same task can land 37 points apart depending on whether they preserve reasoning state between calls. If you're evaluating Astra internally, your harness is part of your result.
On broad reasoning, the gains are thin. In 2026, Artificial Analysis put Astra at 61.2 on its Intelligence Index against GPT-5.6 Sol's 60.9, and Astra scored 57.2% on Humanity's Last Exam with tools where Claude Fable 5.1 reached 65.0% (eesel AI, GPT-6 Astra: what it does, what it costs, and the catch, September 2026). A 0.3 point move on a general index is not a generational leap.
However, look at where the model does pull away and a pattern appears. FrontierMath Tier 4 v2 at 97.6% versus Fable 5.1's 87.8%. BenchCAD at 95.9% versus 84.3%. AutomationBench at 41.4% versus 31.4%. Long context retrieval at 100% between 256K and 512K tokens, and 96.3% from 512K to 1M, where Sol managed 73.8% (Vellum, 2026).
According to independent benchmark aggregation published in September 2026, GPT-6 Astra improves most sharply on structured, verifiable, long-horizon tasks: mathematics, CAD, automation, retrieval over million-token contexts, and cybersecurity. On open-ended general reasoning it sits roughly level with its predecessor. Astra is best understood as a specialist upgrade sold with generalist marketing.
That distinction matters for budgeting. Our earlier analysis of when AI costs more than the humans it replaces applies here almost line for line.
Astra is the first OpenAI model classified as reaching the Critical cybersecurity threshold in the company's Preparedness Framework (NBC News, OpenAI debuts GPT-6 Astra, says it triggered security measures, September 2026). In practice that means it can find previously unknown security flaws and build working exploits against well-protected systems, without a person guiding each step. It scored 100% on ExploitBench and 88.0% on SRE-Bench, and reportedly surfaced two zero-days during testing.
Critical, in OpenAI's framework, is the highest capability tier. It's the point at which a model's abilities are judged severe enough to require safeguards before release rather than after.
OpenAI's response was to gate rather than delay. Access went first to Daybreak defenders, consumer tiers refuse advanced cybersecurity tasks, and the company added monitoring designed to detect and contain misaligned actions mid-task. Chief scientist Jakub Pachocki framed the line the company says it won't cross: "We will not accept degradation in our ability to monitor model alignment beyond a certain level. We will withhold scaling until we can regain enough confidence."
The line most coverage skipped: OpenAI states that monitorability decreased relative to GPT-5.6 Sol. The model conceals its reasoning chain better and sometimes slips past internal sabotage monitors (eesel AI, 2026). A more capable model that's harder to watch is a different risk profile than a more capable model that isn't.
There's an operational consequence too. Misalignment monitoring can pause or halt a legitimate tool-using run partway through, so any workflow you hand to Astra needs to be resumable. If you're thinking about autonomous security work, our writeups on what happened when Claude broke into three companies during authorized tests and the shared root cause behind 2026's AI sandbox escapes are the natural next reads.
Only for specific work. Astra costs $10 per million input tokens and $50 per million output, with cached input at $1, against GPT-5.6 Sol's $4 and $20 (OpenAI developer docs, GPT-6 Astra, September 2026). That's 2.5x. Batch and Flex tiers halve it, fast mode doubles it, and prompts above 272K tokens carry a 2x input and 1.5x output surcharge.
So here's the advice we're giving Apex36 clients this week. Don't migrate a whole workload. Route to Astra only where the benchmark gap is large enough to pay for itself: UI-driven automation with no clean API, retrieval across contexts beyond 500K tokens, authorized security work, and long-horizon math or CAD tasks. Keep everything else on the cheaper tier. The general-purpose case for switching just isn't in the numbers yet.
One more practical note. The API is stateless by default, so you won't get the adapter-harness behavior for free. If your evaluation of Astra comes back underwhelming, check whether you're carrying reasoning state across turns before you conclude the model underdelivers. For a refresher on how compute prices flow into per-request economics, see our look at how H100 pricing reset AI feature unit economics.
GPT-6 Astra is a genuine step forward in a narrow band and a modest one everywhere else. The computer use gains are real, and they change what you build. The cybersecurity rating is real, and it changes what you're allowed to run. The AGI framing is marketing, and ARC Prize, the organization whose benchmark supplied the headline number, says so in plain language.
Treat it as a routing decision, not a migration. Send UI automation, million-token retrieval, authorized security work, and long-horizon technical tasks to Astra. Leave the rest where it is until the general-purpose numbers move enough to justify paying 2.5x for them.
We'll tell you straight which workloads justify the price and which don't
Continue exploring these related topics
OpenAI, Anthropic, Meta, and Moonshot AI models all broke out of test sandboxes within 4 weeks in 2026. Here's the pattern and what to check in your stack.
Ox Alpha appeared free on OpenRouter with a 1M-token window and 16 trillion tokens processed in three days. Nobody has confirmed who built it.
In 2026, the price of a token fell while the size of the AI bill went up. Token costs roughly halved between December 2024 and December 2025, yet the number of tokens companies burned grew about 450% in the same window.