OpenAI released GPT-6 Astra on September 3, and the launch materials call it the world's best computer use model. The numbers behind the claim: 66% on ARC-AGI-3 in the standard configuration and 99.9% with enhanced tools, against 7.8% for GPT-5.6 Sol. API pricing is $10 per million input tokens and $50 per million output. It shipped first to a limited set of enterprise customers in the Daybreak cybersecurity program, with Plus, Pro, Enterprise, the API, and AWS following over the next few days. Astra is also the first model OpenAI has classified at its critical cybersecurity capability threshold, so the advanced capabilities stay with approved partners while the standard build refuses advanced cyber work.
The threshold story got most of the coverage. The part that changes day-to-day operations is duller and closer to home.
A filled-out form has no diff
Greg Brockman's description of computer use is that the model "can zip through spreadsheets, fill out forms, and navigate across web pages often at superhuman speed." Read that as an operational spec rather than a benchmark boast and it says something uncomfortable.
A coding agent hands you a patch. The patch is inert. You can read it, reject it, sit on it for an hour, and nothing in the world has changed while you decide. That review surface is a large part of why code agents got trusted first, and it is entirely an accident of the artifact they happen to produce.
Computer use produces no artifact. It produces side effects in stateful systems: a submitted form, a modified spreadsheet, a row written to somebody's CRM, a package installed. What comes back to you is a natural-language summary of actions that already happened. Speed makes this worse rather than better. At human pace you have a chance of noticing the third wrong click; at superhuman pace the summary arrives after the sequence is complete.
So the review surface moves. It stops being the output and becomes the session itself, while it runs.
The terminal already has the right primitive
Most computer-use surfaces have no good stream to watch. A browser automation run is a video at best, a desktop app a screenshot loop. The terminal is the exception, because a PTY is already a byte stream with a well-defined rendering model, and because agents doing real work spend most of their time in one anyway.
That is the case shell.online is built for: it wraps a command in a PTY on your machine and turns it into a browser link, so anyone with the link can watch the process run without the process leaving your box. The relevant flag for this problem is --read-only:
shell --read-only python train.py
The access mode is fixed when the session is created, not toggled later. Read-only input is rejected at the Cloudflare Worker, so editing the page or hand-crafting WebSocket frames does not promote a view-only link to an interactive one. The README's encryption section is explicit about why the enforcement lives there: terminal payloads are encrypted before the relay sees them, but the authenticated frame opcode is deliberately left visible so the relay can route and apply policy without decrypting anything.
It is also worth reading for what the encryption does not cover. Input, output, snapshots, resize frames, and latency probes are protected from relay inspection or undetected modification. Connection IPs, timing, encrypted frame sizes, frame opcodes, the command label, the access mode, and lifecycle metadata are not hidden, and the relay can still drop, delay, or replay a previously valid frame. If you hand an observability link to someone outside your org, those go with it.
The share URL plus the eight-character browser password form a bearer credential, with no accounts and no login prompt. For an interactive share, whoever holds both can send input with the same OS permissions as the wrapped process. Right default for pairing with a colleague, wrong one for a link you paste into a channel so people can watch a build. Local control stays local: shell list reports whether each relay is online, reconnecting, expired, or unknown, shell attach takes the session back into your own terminal, and shell kill ends it when a link reaches the wrong person.
For an agent session that is already running rather than one you are starting, shell claude detects a live Claude Code session ID and forks it into a shareable one, keeping conversation history and workspace. The original process stays open, and messages after the handoff do not sync between the two.
Identity is the other half
A model at Astra's capability level operating a machine is also a network peer, and NIST made the relevant point three days earlier: agents handed static API keys reproduce every enterprise identity problem we already know about, and want unique identities with short-lived credentials instead.
That is the layer Pilot Protocol works at. Agents get a 48-bit address and an Ed25519 identity key rather than a shared secret, and reachability is not the default. Try to resolve a peer you have no mutual trust with and the daemon tells you so directly, with a hint to run the handshake first. Application traffic goes peer to peer over AES-256-GCM tunnels once discovery is done, with the beacon relaying still-encrypted frames only when hole-punching fails.
The catalogue in the protocol repo applies the same rule to code: apps are Ed25519-signed, signatures are verified both at install and at spawn, and the daemon brokers all inter-app calls. The wire format is public as IETF draft-teodor-pilot-protocol-01, so the trust model is checkable without taking our word for it.
Astra will land in a lot of plans this week. Before it starts driving anything of yours, decide which surfaces it may touch, give every long-running one a view-only link at start time instead of after something breaks, and stop issuing static keys to processes that can now use a computer faster than you can watch one.
Top comments (0)