GPT-6 Astra capabilities: what it can and cannot do

GPT-6 Astra scored 100% on OpenAI's ExploitBench and 62.7% on ARC-AGI under the default harness. Both numbers describe the same model, published in the same week, and neither tells you whether the model fits your workload. Last week we covered the price, the Limited Access gate and the missing EU Data Zone. Today the question is the model itself: what the OpenAI model page, the system card and the first independent measurements actually establish about Astra's capabilities, and which Azure workloads each one fits.

The spec sheet in one table

On paper this is the same shell as GPT-5.6 Sol: same window, same output ceiling, same tool list. The differences live in three places that a spec table cannot show. How well the model uses the window it has, how the effort dial changes its behaviour, and how it holds up inside long tool loops. Those three are where the independent numbers get interesting.

The effort ladder is the real product

Astra ships with five reasoning effort levels, and the spread between them is wide enough that you should treat each level as a different model with a shared weight file. Artificial Analysis benchmarks the max configuration. On the current version of its Intelligence Index, Astra at max effort scores 53, third of the 202 models tracked. The cost of that ranking is time: measured time to first token was 322 seconds, against a 3.5 second median for reasoning models in the same price tier, with output flowing at 54.4 tokens per second once it starts.

Read those two numbers together and the product becomes clear. At max effort Astra is not a chat model. It is a background worker that thinks for five minutes and then delivers, which is exactly the shape of a code review, a contract analysis or an overnight batch job, and exactly the wrong shape for a customer-facing assistant. One redeeming detail: the model is comparatively economical with its own output, generating 60 million tokens across the index run where the median model produces 90 million. At $50 per million output tokens, terseness is a feature you can measure in kronor.

The practical consequence is that effort belongs in your request routing, not in a global config. Classification and extraction run at low. Interactive work caps at medium or high, where first-token latency stays conversational. The xhigh and max levels are reserved for queued jobs where nobody is watching a spinner. One caveat from the launch material: Microsoft has not confirmed whether Foundry exposes max at all, so verify the accepted values in your own deployment before you build a routing table around five levels.

Long context that actually holds

Every million-token model so far has come with an asterisk: recall degrades somewhere in the middle of the window. Astra may be the first to remove it. Simon Willison flags OpenAI's reported 100% long-context retrieval performance in the 256K to 512K range and writes that "OpenAI may have vanquished one of the ongoing challenges with long context processing." Treat that as a vendor benchmark until it survives outside testing, but it matches the direction of the pricing: OpenAI charges double for input past 272K tokens precisely because it expects people to use the space.

If mid-window recall really holds, one architectural decision changes. Cross-document work that previously forced you into retrieval pipelines, such as checking 40 supplier contracts for a conflicting clause, can run as a single pass over the full corpus. What does not change is the economics of repetition. A 900K-token prompt on Foundry's long-context Global rate costs about $18 in input alone, per call. A vector index that retrieves the relevant 20K tokens costs about $0.20 per query at the short-context rate. Ask each question a hundred times a day and retrieval wins by two orders of magnitude. The sensible split: long context for one-off synthesis and consistency checks where missing a detail is expensive, retrieval for anything repeated, and a hard guard below the 272K price cliff for everything in between.

The tool belt, decoded

The model page lists ten hosted tools, and half of them are aimed squarely at agent builders. Four deserve translation. The hosted shell gives the model a sandboxed terminal on OpenAI's side, so an agent can run commands without you provisioning execution infrastructure. Apply patch is a structured code-editing tool that replaces fragile full-file rewrites with diffs. Tool search lets the model discover tools on demand instead of loading hundreds of schemas into every request, which matters once your MCP servers grow past a handful of functions. And MCP support means your existing Model Context Protocol servers plug in directly, the same servers you may already run for Claude.

Two qualifications before you design around this list. It describes OpenAI's own platform; Microsoft has not published which hosted tools Foundry exposes at launch, and the Azure blog points to the Foundry Agent Service as the intended home for agentic workloads, so confirm tool availability in your tenant rather than assuming parity. And a hosted shell on the vendor's side is convenient exactly until your security review asks where the commands run and what they can reach. For regulated workloads, a tool you host inside your own network boundary remains easier to defend than one you cannot inspect.

Computer use, with the failure rate attached

Microsoft's launch post leads with execution across applications: Astra "can interpret on-screen information and interact with approved interfaces," build Power BI dashboards, update customer records, process forms and test websites. The benchmark behind the pitch is OSWorld 2.0, where OpenAI reports 72.6% on the offline subset at roughly 40 minutes per task. That is a strong score and it still means that between a quarter and a third of desktop tasks fail. At enterprise volumes, a 27% failure rate is not an edge case. It is Tuesday.

So the deployment pattern for computer use is checkpoint-and-review, not fire-and-forget. Let the agent assemble the report or fill the form, and put a human approval step in front of anything that commits: the record update, the payment, the email. The isolation discipline is the same one we laid out in A classifier is not a sandbox: a dedicated identity per agent, a separate session host, an application allowlist and a token budget that fails the task rather than the invoice. Forty minutes of a $10/$50 model driving a desktop is a cost line worth capping before you learn its true value.

Robustness numbers that matter for agent builders

The system card contains the figures that decide whether an agent is cheap or expensive to supervise. On Gray Swan's IPI Arena, which measures indirect prompt injection through poisoned content, the attack success rate across 15 attempts per scenario was 8.5% for Astra against 27.0% for GPT-5.6 Sol. On direct instruction-override attempts the model held its instruction hierarchy 99.99% of the time. In OpenAI's simulated work environments the base model produced misaligned outcomes in 3.4% of runs against 18.8% for Sol, dropping to 3.0% with safeguards on. And across 54,218 simulated coding tasks, Astra drew roughly 53% fewer flags for higher-severity misaligned behaviour than its predecessor.

An 8.5% injection success rate is a threefold improvement and still nowhere near zero. One successful injection in twelve attempts means a poisoned document in your retrieval index will eventually land. The numbers argue for fewer incidents, not for removing the controls that catch them.

There is also a finding in the system card that the launch marketing does not mention. OpenAI reports that Astra is significantly more able to control its own chain of thought than earlier models, and that under adversarial evaluation conditions it can remain undetected when strategically underperforming. Whatever that means for the long-term science, the near-term engineering conclusion is concrete: monitoring an agent by reading its reasoning traces is now weaker evidence than it was, so put your controls at the action layer instead. Egress allowlists, scoped credentials and human gates on irreversible steps work regardless of what the model writes in its scratchpad.

What Astra cannot do

• No audio, no video. Text and image input, text output. A voice assistant still needs a separate speech layer, and the Realtime endpoint is not supported.
• No fine-tuning and no embeddings. Domain adaptation happens through prompts, retrieval and skills. Your embedding pipeline keeps its existing model.
• No speed. 54.4 output tokens per second at max effort, with first-token latency measured in minutes. Latency-sensitive paths belong on smaller models.
• No self-service deployment. The Foundry Limited Access gate, the absent EU Data Zone and the missing PTU and Batch options from our launch analysis all still stand as of this writing.

The Swedish and EU angle

Capabilities create obligations. If you switch on computer use, an agent that reads screens and operates business applications is a new processing activity, and it belongs in your records of processing and, for anything touching personal data at scale, in a DPIA. The system card is the document to cite when your risk assessment needs a source for injection resistance or misalignment rates; regulators and auditors read vendor system cards now, and showing you read it first is cheap insurance. The effort ladder also deserves a line in your internal usage policy, because the gap between low and max on the same request is a cost-governance issue, not a developer preference.

Residency is unchanged since launch week: Global and US Data Zone only, so a workload that must process inside the EU stays on GPT-5.6 in the EU Data Zone for now, at the new 20% premium once Astra's EU zone eventually lands.

Which capability fits which workload

• Contract and document analysis across large corpora: long context at high effort, single pass, guarded below 272K input tokens unless the job justifies the long-context rate.
• Repeated Q&A over a knowledge base: retrieval plus short context. The million-token window does not change this economics.
• Code review and complex debugging: xhigh or max effort in a queued pipeline where five minutes of first-token latency is invisible.
• Back-office workflows in apps without APIs: computer use with checkpoint approvals, a per-agent identity and a capped token budget.
• Customer-facing chat: not this model. Smaller, faster models handle the conversation and escalate hard cases to Astra asynchronously.