GPT-6 Astra: Multimodality and Agent Risk

What GPT-6 Astra actually brings

What stands out in this release is not the “most powerful” label, but the broad rollout of GPT-6 Astra across ChatGPT Plus, Pro, Business, Enterprise, the API, and AWS. In OpenAI’s launch materials and official documentation, it is described as the company’s most capable model, while a dedicated gpt-6-astra entry on the pricing page confirms availability through the OpenAI platform.

At launch, the rollout is gradual. Enterprise access is controlled by administrators and is disabled by default. That is a sensible pause: the model is designed not only for chat responses, but also for computer use, agentic behavior, and multimodal tasks.

The discussed Jarvis mode should still be separated from confirmed capabilities. That name does not appear in the available official OpenAI materials. Computer use is confirmed, but a specific mode with that name remains part of the conversation rather than a product specification.

A comparison with Fable 5.1 does not produce a simple winner either. Independent assessments suggest Astra trails it in coding and design, while appearing stronger in mathematics, 3D, computer vision, and science. Third-party summaries attribute 55.8% on Terminal-Bench 4.0, 73.4% on CursorBench 3.2.0, and 100% on ProofBench v1.1 to Fable 5.1.

I would not turn these numbers into a single ranking. They come from different tasks and are reported by third-party sources rather than compared in a common model card. For an agent system, it is especially important whether a test measures only task completion or also resilience to malicious instructions.

Why security matters more than rankings

The main engineering risk around Astra is that a more capable agent has more ways to fail with real consequences. In OpenAI’s safety review, the model is described as the first to reach the Critical level for cyber capabilities under the Preparedness Framework, which is why access for defensive testing is being introduced gradually.

Prompt injection does not require malicious code to run. A hidden instruction in a document or webpage can make an agent change its goal, disclose accessible context, or misuse a tool. To the user, this can look like the agent has been infected, when in fact the model simply treated someone else’s text as a higher-priority command.

In production, I would first test tool isolation, permission boundaries, and the handling of untrusted content. A mathematics or coding benchmark will not reveal those weaknesses. The real bar for GPT-6 Astra is not how far an agent can proceed on its own, but how reliably it can stop before following someone else’s instruction.

We have already examined how Codex arriving in ChatGPT for Android changes remote development and automation workflows. The launch of GPT-6 Astra continues that trend, expanding the assistant's capabilities through a new mode and multimodality.