GPT-6 Astra in Foundry: the price, the gate and the EU gap

On 3 September 2026 OpenAI released GPT-6 Astra, and Microsoft listed it in Foundry the same day at $10 per million input tokens and $50 per million output tokens on Global Standard. That is exactly the Claude Fable 5.1 price sheet from two days earlier, and double what GPT-5.6 Sol costs. Astra is also the first OpenAI model to reach the Critical threshold for cyber capability under the Preparedness Framework, which is why it is not a self-service deployment. It comes through the Foundry Limited Access Program, in two deployment flavours, Global and US Data Zone, with no EU Data Zone at launch. For a Swedish team already running GPT-5.6 on Azure, the questions are whether the model is worth twice Sol, whether you can get it at all, and what to do about residency while the EU zone does not exist.

What shipped, and where

OpenAI's model page lists gpt-6-astra with a 1,050,000 token context window, 922,000 maximum input tokens, 128,000 maximum output tokens, text and image input, text output, and a knowledge cutoff of 30 April 2026. Reasoning effort runs from low through xhigh to a new max level. The model is served on the Responses API, Chat Completions and Batch, and supports web search, file search, computer use, code interpreter, image generation, a hosted shell, apply-patch, skills, MCP and tool search. The context, output ceiling and tool list are identical to GPT-5.6 Sol on paper. The differences are the price, the reasoning budget and how the model behaves inside long tool loops.

On the Microsoft side, the Azure blog post from Steve Sweetman and Naomi Moneypenny says Astra "begins rolling out today through the Microsoft Foundry Limited Access Program, with availability expanding to participating customers over the coming days." It is consumption-billed with no reserved capacity requirement, and Microsoft points to the Foundry Agent Service as the starting point for cross-application task execution. There is no PTU option in the announcement, no Batch pricing, and no Fast mode. Those three things all exist on OpenAI's own platform, where Batch and Flex run at half the standard rate and Fast mode at double.

Price sheet on Foundry, 3 September 2026

Deployment	Input / MTok	Cached input	Cache write	Output / MTok
Global Standard, short context	$10.00	$1.00	$12.50	$50.00
Global Standard, long context	$20.00	$2.00	$25.00	$75.00
Data Zone US, short context	$11.00	$1.10	$13.75	$55.00
Data Zone US, long context	$22.00	$2.20	$27.50	$82.50
Data Zone EU	Not offered at launch

Microsoft's blog does not define where "short" ends and "long" begins. OpenAI's own pricing does: prompts above 272,000 input tokens are billed at twice the input and cache rates and 1.5 times the output rate for the entire request. The Foundry model documentation says the same 272K rule applies to GPT-5.6 and that "later models might use different thresholds," so confirm the number in the Azure pricing page once it is published. As of this morning that page still reads "GPT-6 prices are currently in processing for publishing." Until then, the blog table above is the only official Azure figure.

The long-context multiplier is the trap. A single call with 300,000 input tokens and 8,000 output tokens costs $6.60 on Global long-context pricing. Trim the same call to 270,000 input tokens and it costs $3.10. Thirty thousand fewer tokens halves the bill, because the surcharge is applied to every token in the request, not just the ones past the line. If your document pipeline routinely lands between 272K and 400K tokens, chunk it or summarise the front half before the call.

Is it worth twice Sol?

GPT-5.6 Sol lists at $5 input and $30 output on Global Standard, and Microsoft has a promotion running from 1 September to at least 30 November that takes Sol to $4 and $20. So the comparison that matters this autumn is Astra at $10/$50 against Sol at $4/$20, a 2.5x gap on both sides of the ledger. Three workload shapes show where that gap bites.

Workload (Global Standard)	GPT-6 Astra	GPT-5.6 Sol (list)	GPT-5.6 Sol (promo)	Claude Fable 5.1
One-shot document job: 200K in, 8K out, no cache	$2.40	$1.24	$0.96	$2.40
60-turn agent loop: 9M cache reads, 180K cache writes, 120K out	$17.25	$9.23	n/a	$10.50
Same loop, 1,000 sessions a month	$17,250	$9,225	n/a	$10,500

The promo column is blank for the agent loop because Microsoft's announcement only quotes reduced input and output rates for Sol, not reduced cached-input rates, and a cache-dominated session cannot be priced without them. The agent-loop shape is the same one we used for Fable 5.1 on Foundry earlier this week, so the columns are directly comparable. Astra and Fable 5.1 tie on a single uncached call. On the long loop Fable 5.1 is 39% cheaper, because Anthropic cut cache reads to $0.25 per million while OpenAI's cached input stays at $1. If your agent re-reads a large stable prefix on every turn, the two "$10/$50 models" are not the same price at all.

Whether Astra earns the premium over Sol depends on what the extra reasoning buys you. Artificial Analysis scores Astra at 61 on its Intelligence Index at max effort, against 66 for Claude Fable 5.1, and reports a cost per Coding Agent Index task of $4.72 for Astra versus $9.18 for Fable 5.1. OpenAI's own numbers put the indirect prompt injection attack success rate at 8.5% for Astra against 27.0% for Sol, and The Register reports a hallucination rate of 2% against 9.4%. Those two safety numbers matter more for an enterprise agent than the leaderboard position: an agent that is three times harder to hijack through a poisoned document, and that goes beyond its assigned scope less often, is cheaper to supervise even if each call costs more. Test that on your own tool set before you believe it.

The gate: Limited Access on Foundry

Astra is not a model you pick from the catalog and deploy. Microsoft's Limited Access policy restricts registration to "customers managed by Microsoft," meaning organisations with a Microsoft account team, and ties use to the use case selected at registration. Reviews take 5 to 10 business days, forms submitted from personal email addresses are rejected, and Microsoft may ask you to re-verify. The general Limited Access page has not been updated for Astra; it still states that standard Azure OpenAI usage needs no registration. Precedent says otherwise for frontier launches. GPT-5 and GPT-5-codex both required a registration form in 2025, and customers who had been approved for an earlier gated model were carried over automatically.

The Azure blog gives no application link. If you already hold a limited-access approval for GPT-5, computer-use-preview or GPT-image-1.5 on your subscription, ask your account team whether it carries over. If you have never registered, start now, because the review clock runs in business days and the "coming days" rollout language covers participating customers, not new applicants. On OpenAI's side the first-party rollout follows the same pattern: Daybreak Access partners and the Trusted Access programmes first, then ChatGPT Plus, Pro, Business and Enterprise and the API over the following days, with AWS Bedrock listed alongside Azure.

Why the gate exists: Critical for cyber

The system card is direct: "GPT-6 Astra is a significant step up in cyber capabilities and meets our Critical threshold." OpenAI's definition of Critical is a model that, with the right tools and access, can find previously unknown vulnerabilities and develop exploits across many well-protected systems without a person guiding each step. No earlier OpenAI model carried that rating. OpenAI says it delayed parts of the release by several weeks to strengthen protections against cyber misuse and against the model acting outside its instructions.

What that means for a deployer is a model that refuses more, on purpose. The system card reports that Astra refused 91.5% of prohibited cyber requests where Sol refused 59%. Offensive-security work that Sol would attempt, such as writing a working exploit for a known CVE, is now routed through the Trusted Access for Cyber programme rather than the general API. A Swedish SOC or penetration-testing firm that wants Astra for that purpose needs to apply to OpenAI's programme separately from the Foundry limited-access registration; the Azure gate and the OpenAI gate are different doors. Ordinary enterprise use, including vulnerability triage, code review and hardening advice, is inside the standard envelope. Budget for a refusal-handling path anyway, the same way you would for a Claude classifier, and log the refusals so you can see which of your own workflows trip it.

Computer use in an enterprise tenant

Microsoft's pitch for Astra is "execution across applications": the model "can interpret on-screen information and interact with approved interfaces," produce documents, spreadsheets and presentations, and run multi-step tasks with human oversight. OpenAI's own benchmark for that is OSWorld 2.0, where it reports 72.6% on the offline subset at roughly 40 minutes per task. Forty minutes of a $10/$50 model driving a desktop is a real cost line, and the way to keep it bounded is the same discipline we described in A classifier is not a sandbox: a dedicated identity per agent, a separate session host or container, an allowlist of applications and URLs, and a token budget per run that fails the task rather than the invoice.

The Foundry Agent Service is where Microsoft wants this to live, and it is the right place if you need Entra ID identity, Azure Monitor tracing and Cost Management alerts in one control plane. Two cautions. First, there is no PTU deployment for Astra in the launch material, so you cannot reserve capacity for a computer-use agent that must run every morning at 06:00 Stockholm time; Global Standard is a shared pool with per-subscription rate limits that Microsoft has not yet published for this model. Second, the Agent Service is the successor to the Assistants API that was retired last week, and if you are mid-migration the sensible sequence is to finish that on GPT-5.6, then swap the model, rather than change both at once. Our Assistants API migration guide covers the mechanics.

import { AzureOpenAI } from "openai";
import { DefaultAzureCredential, getBearerTokenProvider } from "@azure/identity";

const client = new AzureOpenAI({
  endpoint: "https://tsp-foundry-swc.openai.azure.com",
  azureADTokenProvider: getBearerTokenProvider(
    new DefaultAzureCredential(),
    "https://cognitiveservices.azure.com/.default"
  ),
  apiVersion: "preview",
});

const res = await client.responses.create({
  model: "gpt-6-astra",                 // deployment name, once approved
  reasoning: { effort: "high" },        // low | medium | high | xhigh | max
  max_output_tokens: 16000,
  tools: TOOLS,
  input: [
    { role: "developer", content: STABLE_SYSTEM_PROMPT },  // keep the prefix stable for cache hits
    ...history,
  ],
});

// Guard the long-context cliff before you send, not after the invoice
if (estimateTokens(history) > 260_000) compactHistory(history);

Two notes on that snippet. The max effort level is new with Astra and Microsoft has not said whether Foundry exposes it; Fable 5.1 on Foundry tops out at xhigh, and Astra may follow the same pattern. And the 260K guard is deliberately below the 272K line, because token estimates drift and the penalty for crossing is a doubled bill on the whole request.

The Swedish and EU angle

No EU Data Zone means no EU processing guarantee. Astra launches with Global Standard and US Data Zone only. Global Standard may route a request to any Azure region worldwide; US Data Zone keeps it in the United States. Neither satisfies a requirement that inference happen inside the EU. Microsoft's own deployment-type documentation says new deployment types arrive Global first, then Data Zone, then regional, with no guaranteed dates for the later stages. GPT-5.6 launched on 9 July and reached the EU Data Zone; Astra will probably follow, but "probably" is not something you can write into a DPIA. If a workload must process in the EU today, it stays on GPT-5.6 in the EU Data Zone, or on Sweden Central regional PTUs.

When the EU zone arrives, it costs 20% more, not 10%. From 1 September Microsoft charges a 20% premium over Global for EU Data Zone Standard deployments of models launched on or after that date, up from 10%. Astra launched on 3 September, so it is the first frontier OpenAI model that will carry the new premium from day one. Applying the stated percentage to the Global rates gives an expected $12 input and $60 output per million tokens for short context, and $24 and $90 for long context. Those are derived planning figures; the Azure pricing page will publish the actual rate. Your existing GPT-5.6 EU Data Zone deployments are grandfathered at 10%. The full breakdown is in our EU Data Zone premium analysis.

A Critical-rated model changes the AI Act conversation. Astra is a general-purpose AI model whose provider has publicly classified it at the highest tier of its own cyber risk framework. That is OpenAI's obligation to manage under the GPAI provisions, not yours as a deployer, and the Commission has been enforcing those provisions since August. But if you deploy Astra in an agent that touches security tooling, the internal risk assessment should cite the system card, name the Trusted Access boundary, and explain which of your use cases fall on which side of it. Regulators and auditors read vendor system cards now. Being able to show you read it first is cheap insurance.

The exit plan still applies. Two days ago we wrote about OpenAI cutting Cursor's model access and why every Azure workload needs a second model behind a routing layer. Astra's Limited Access status makes that more true, not less: an approval granted for one use case can be revoked, and a gated model is by definition one the vendor can withdraw. Keep GPT-5.6 Sol or Fable 5.1 warm behind the same Responses-API abstraction, and make the swap a config change.

Decision guide

Running GPT-5.6 Sol for reasoning-heavy agents? Register for Limited Access this week, then run your existing evals on Astra in a Global Standard deployment before you touch production. Sol at promo pricing is 2.5x cheaper until 30 November; Astra has to earn the gap on your tasks, not on a leaderboard.
Choosing between Astra and Fable 5.1 at the same list price? Measure your cache hit ratio. On cache-heavy loops Fable 5.1 is about 39% cheaper. On single-shot calls they tie, and Astra's lower cost per completed agent task in independent testing tips it the other way.
Need EU processing? Astra is not a candidate yet. Stay on GPT-5.6 in the EU Data Zone and put an Astra EU Data Zone review in the risk register with a Q4 2026 date, expecting a 20% premium when it lands.
Doing offensive security work? The Foundry gate is not enough. Apply to OpenAI's Trusted Access for Cyber programme, and expect refusals on exploit development outside it.
Documents above 272K tokens? Chunk them. Crossing the line doubles input and cache rates and adds 50% to output for the whole request.
Batch or offline workloads? Foundry has no Batch pricing for Astra at launch. OpenAI's own Batch tier is half price. Decide whether the MACC benefit is worth paying double for batch traffic.