Originally published at korixinc.com.
GPT-6 Astra is disabled by default in ChatGPT Business and Enterprise. An owner must turn it on. It is worth enabling for most teams, but three things changed that your AI policy probably does not cover: it is the first OpenAI model at the Critical cybersecurity threshold, its reasoning is materially harder to inspect than the model you use today, and OpenAI published both of those facts itself.
Who this guide is for
The person in a regulated firm who owns the decision: an IT director, a compliance lead, a managing partner. No machine learning knowledge required. If you are choosing a model for an engineering team, the benchmark round-ups will serve you better than this will.
Three facts, not the benchmark table
The capability is not in dispute. In OpenAI's own announcement Astra saturates three of the hardest public benchmarks: 98% on FrontierMath Tier 4, 99.9% on ARC-AGI-3 and 100% on ExploitBench, plus 72.6% on OSWorld 2.0 computer use. Those matter to an engineer choosing a model. They are not what a compliance officer, an IT director or a managing partner has to decide. These three are.
1. It is off until an admin enables it
In Business and Enterprise workspaces, Astra is disabled by default. An owner enables it for the whole workspace or for specific roles, and Early Model Access does not carry it over. Doing nothing is a valid choice. It should be a recorded one rather than an accident.
2. It is the first model rated Critical for cyber capability
OpenAI's Preparedness Framework reserves Critical for capabilities that open a new pathway to severe harm. Astra is the first model it has placed there, which requires safeguards during development rather than only at release.
3. It is harder to monitor, by OpenAI's own testing
Astra reasons using recurrent depth, which does not expose a readable chain of thought. OpenAI reported a substantial decrease in chain-of-thought monitorability against previous models.
What you gain, and what you can no longer see
Until now, a reasoning model wrote down its working. That scratchpad was not a nicety. It was the practical mechanism by which a human, a red team, or an automated monitor could look at a model's output and ask how did it get here. It is the closest thing the industry has had to an audit trail on a model's judgement.
Astra reasons differently. Its recurrent-depth approach loops internally before producing an answer, and that loop is not rendered as readable text. The capability gain is real, and so is the trade-off: you are getting a better model and a less inspectable one in the same release.
That trade-off is worth naming plainly, because it decides who this guide is for. If a person reads every output before it does anything, the downside barely touches you. If you were planning to let the model act on its own against a customer record, this is not the release to start with.
OpenAI put it plainly in its own disclosure: Astra's written reasoning is harder to monitor than the model it replaces. We looked for a figure putting a number on that gap and could not source one to OpenAI, so this piece does not carry one. The direction is what matters, and OpenAI has stated the direction itself.
"CoT monitoring is a core part of our misalignment safety strategy that has no good substitute now." — Tomek Korbak, alignment researcher at OpenAI, quoted in TechRadar
"Progress in intelligence does not guarantee progress in alignment." — Jakub Pachocki, chief scientist at OpenAI, quoted in Vellum
Both come from inside the company that built it, published alongside the release rather than dragged out of it. That candour is exactly what makes the model possible to plan around.
Critical is a word with a published definition
Critical is not marketing language. In OpenAI's Preparedness Framework it is a defined threshold, and the definition is worth reading slowly: a model reaches it if it can identify and develop functional zero-day exploits of all severity levels in many hardened real-world systems without human intervention, or devise and execute novel end-to-end cyberattack strategies against hardened targets given only a high-level goal.
The framework separates High capability, which amplifies an existing route to serious harm, from Critical, which opens a route that did not previously exist. Critical requires safeguards during development, regardless of whether the model is ever deployed. Astra is the first model OpenAI has placed in that band, and the cyber-sensitive capabilities are gated behind a restricted access programme OpenAI calls Daybreak, rather than shipped to everyone.
Two honest readings of that follow, and you should hold both. The first: OpenAI classified its own model at its most serious tier and restricted it, which is the framework doing its job in public. The second: your firm is now deciding whether to enable a tool its maker has described in those terms, and your AI policy was almost certainly written before that sentence existed.
Who should enable it, and who should wait
There is no universal answer here and anyone giving you one is selling something. The useful question is not "is Astra safe" but can we evidence what it did, and can we undo it. That splits cleanly by what the model is allowed to touch.
| If the work is | Enable it? | Because |
|---|---|---|
| Drafting, research, summarising, internal analysis | Yes, with logging | A human reads the output before it does anything. Opaque reasoning matters far less when a person is the last step. |
| Coding and engineering work | Yes, in a reviewed pipeline | Code review is already your inspection layer. You are reviewing the artefact, not the reasoning. |
| Anything that writes to a system of record | Only with an audit trail and a reversal path | If you cannot read the reasoning, the log of actions becomes your only evidence. |
| Anything that touches a customer outcome unsupervised | Not yet | Under Consumer Duty and similar regimes you must evidence why a customer was treated a certain way. "The model decided" is not evidence. |
| Security testing or offensive tooling | Separate decision entirely | These are the capabilities OpenAI gated behind Daybreak. Treat it as a procurement and legal question, not an IT toggle. |
It is worth being precise about the standard we are applying, because "governed" gets used loosely. KORIX defines governed AI as a system whose every action is logged against a named accountable human, scoped to what it may touch, and reversible without a rebuild. Those three properties are what let a firm answer a regulator, an auditor or an angry client after the fact. None of them depend on being able to read the model's reasoning, which is precisely why they matter more now than they did last month.
Notice that the first two rows are a straightforward yes. The concern is not the model. It is the gap between what it can do unsupervised and what you can prove afterwards. That gap is exactly what governed AI exists to close, and it just got wider by default.
Five things to settle before you enable it
None of these require a project. They require a named person and an afternoon.
- Name the owner. One person decides whether Astra is on, for which roles, and reviews that quarterly. If nobody owns the toggle, the answer to "who approved this" is nobody.
- Check the toggle rather than assume it. Astra is off by default and Early Model Access does not carry over, so your workspace state may not be what you think. Look at it.
- Decide what it may write to. Reading and drafting is one risk profile. Writing to your system of record is another. Put that line in writing before someone discovers it by accident.
- Make the action log the audit trail. You can no longer lean on readable reasoning, so what the model did has to be logged completely, with timestamps and a named accountable human, in a system you already trust.
- Write down the reversal path. For every action it can take, know how to undo it and who can. If an action cannot be undone, it should not be automated yet, whatever the model scores.
If your staff are already using AI outside sanctioned tools, settle that first. A model policy nobody follows is not a control, and shadow AI does not wait for a rollout plan.
What we are doing with it, and where we are not
KORIX is an OpenAI Select Partner, which is why we read a release like this closely and why our first instinct is to help clients adopt it rather than avoid it. It does not mean we speak for OpenAI: everything above is their published material and our own reading of it. We have also said publicly that roughly 60% of our production AI runs on OpenAI and the other 40% deliberately does not. That split has never been about loyalty. It is about which workloads we are willing to put behind a single vendor's judgement.
Astra has not changed that ratio and we are not going to pretend it did in the first week. We are using it where a human reads the output before anything happens, which is most of our engineering and research work, and the speed gain there is real. We are not putting it behind an unsupervised action on a client's system of record until we can evidence what it did as well as we could with the previous model. Not because we think it is dangerous, but because the honest answer to "show me why it did that" got harder this month.
The bottom line
GPT-6 Astra is a genuine capability step and most firms should enable it for work where a person reads the output. The decision that deserves an hour of your time is narrower: anywhere the model acts without a human in the loop, your action log has just become the only evidence you have.
If that log is complete, timestamped, and owned by a named person, this release is good news for you. If it is not, the right move is not to block the model. It is to fix the log first, then switch it on.
Originally published at https://korixinc.com/learning-center/gpt-6-astra
Top comments (0)