GPT-6 Astra computer use: what the numbers mean for your website

What GPT-6 Astra actually is

Stripped of the launch language, here is the model card. Every figure below comes from OpenAI's own GPT-6 Astra model documentation and launch post.

Two deployment details worth knowing before you plan anything around it. Rollout is phased — cyber-focused enterprises in OpenAI's Trusted Access Program first, everyone else over the following days — and for Enterprise workspaces, Astra is off by default at launch until an administrator enables it. If you are building on top of it for a client, confirm their workspace has it turned on before you promise a date.

The computer-use benchmarks, and where the lead is real

OpenAI published a wide comparison table. These are the rows that matter for anything agentic:

Read that table honestly and it says something more specific than "Astra is the best model." On coding, the lead is thin — 74.1% against 73.7% on DeepSWE is inside the noise you would expect from harness differences, and on the Artificial Analysis Intelligence Index in OpenAI's own table, Astra does not come first. On operating a screen, the lead is not thin: nearly 16 points over the previous OpenAI model on ScreenSpot-Pro, with no tools. That is the number to pay attention to, because it measures the thing that has been holding browser agents back — locating the right UI element from pixels.

Two accuracy notes, because they matter if you are quoting these figures. OpenAI's page reports Terminal-Bench 4.0 as 57.7% in the comparison table and 57.9% in the chart caption; use the table. And the 87.3% ScreenSpot-Pro figure for Claude is footnoted as coming from Mythos — Fable with fewer safeguards — so it is not a like-for-like production comparison.

The speed claims are arguably more important than the accuracy claims. In latency simulations on OSWorld 2.0, OpenAI reports Astra hitting 72.6% at roughly 40 minutes per task against Sol's 65.7% at roughly 75 minutes — better results in about 47% less time. Paired with an updated Codex harness, they report 1.9x faster task completion on Mind2Web. A browser agent that finishes in 40 minutes instead of 75 is a different product, not a better version of the same one.

What Astra costs, and the 272K pricing cliff

Batch and Flex run at 50% of standard rates. Fast mode costs 2x for up to 2.5x the speed of standard processing.

The line almost nobody is quoting is the one that will actually surprise people on their first invoice: prompts over 272,000 input tokens are billed at 2x input and cache rates and 1.5x output — for the entire request, not just the overflow. So the 1,050,000-token context window is really two windows with different economics. Below 272K you pay list. Above it, a request that would have cost $10 costs $20 on input, and your output rate effectively becomes $75 per million.

This is a design constraint, not a footnote, because agent loops accumulate context by nature — every screenshot, every tool result, every page of DOM. If you are building on Astra, the architectural decision is whether to engineer aggressively for staying under 272K (compaction, note-taking across context windows, retrieval instead of stuffing) or to accept the multiplier on long-running sessions and price it into the job. Pick deliberately. Drifting across that line by accident is how an agent workflow that penciled out at $0.40 per task lands at $0.90.

Prompt caching is the other lever, and the arithmetic is worth doing once. A cache write costs 1.25x the uncached input rate ($12.50 vs $10.00), while a cache read costs a tenth ($1.00). So caching a prefix is a loss on the first pass and a win from the second read onward — 13.5 units for write-then-read versus 20 for two uncached reads. For a system prompt or a fixed tool schema hit hundreds of times a day, that is close to a 10x saving on the stable portion of your input.

What changes when your visitor is an agent

AEO and GEO work up to now has mostly been about being read — getting your content extracted, summarised, and cited in an AI answer. Astra-class computer use shifts the problem: the model is not only reading your page, it is operating it. Filling the quote form. Applying the filter. Adding to cart. Getting through checkout. OpenAI's own examples for Astra are filling out online forms, updating CRM records, apartment hunting, booking a DMV appointment.

Here is the part practitioners get wrong. The agent is not blocked by your design taste. It is blocked by the same defects that block a screen reader and a scraper, and the list is boringly consistent across the sites I have audited:

• Inputs with no label, name, or autocomplete attribute. The agent has to infer field purpose from adjacent pixels. It usually gets it right, and "usually" is a terrible property for a checkout.
• Custom dropdowns and comboboxes with no ARIA roles. A div soup select is invisible as a control; the agent brute-forces it by clicking and re-screenshotting.
• Bot challenges on read paths. A Cloudflare interstitial in front of your product pages blocks the scraper and the buyer's agent equally. Most sites have never separated the two decisions.
• Prices or stock status rendered only in a JavaScript widget — or worse, inside an image. Visible to a vision model, invisible to anything cheaper.
• Multi-step flows that die on a direct URL because state lives in a hidden session. Agents retry from URLs constantly.
• Infinite scroll with no paginated fallback. There is no last page to reach, so the agent stops guessing when to stop.

Every one of those is billable now. Input images are priced as input tokens, so a page that forces a screenshot-interpret-click loop costs real money per attempt, and a page that hands over the same information as a few kilobytes of text does not. Whether agent harnesses will start systematically preferring cheap-to-parse sites is an open question and I would not build a pitch on it — nobody has published that data. What is already true and measurable is simpler: agents fail on badly structured sites, and every failure mode above is simultaneously an accessibility defect and an SEO defect. You do not need the speculative argument.

Making a site agent-ready for Astra-class agents

The work splits into two layers: give agents a structured way to read you, and make the interactive surface unambiguous. Ordered by cost-to-benefit, this is what I ship:

On the content negotiation point: this is not a fringe idea waiting for adoption. OpenAI's own developer documentation serves a markdown version of any page by appending .md to the URL, and publishes an llms.txt index at the top of every docs page. The company building the agents is structuring its own site for agents. That is the strongest signal available about where this is going.

We implemented exactly this stack on a client auto-parts store — llms.txt, markdown content negotiation via a reusable Django view mixin on product and blog detail views, AI crawler rules with Content-Signal, and an api-catalog endpoint with token-authenticated API access. The genuinely fiddly part was none of the above; it was keeping the markdown representation and the HTML representation from drifting apart as the templates changed. Generate both from the same source of truth or you will ship an agent-facing price that is three weeks stale. If you want the cheapest possible starting point, our free llms.txt generator will produce a valid file from your sitemap in a couple of minutes.

Is WebMCP worth shipping yet?

The obvious next question, since it addresses precisely the screenshot-loop problem: should you implement WebMCP, the proposal that lets a page register callable tools that browser agents can invoke instead of clicking around?

My read: not as a priority, and definitely not as a rewrite. WebMCP is a W3C Community Group Draft Report from the Web Machine Learning Community Group, co-edited by Microsoft and Google. The spec page says outright that it is not a W3C Standard and not on the W3C Standards Track. It has been through a Chrome origin trial, and the API surface has already moved once — earlier implementations exposed navigator.modelContext, the current draft defines document.modelContext. Anything you write against it today is against a moving target.

The judgment call that follows: build the durable layer first. llms.txt, markdown negotiation, clean form semantics, and a real API do not depend on any spec landing, they help the agents that exist right now, and they help humans and search engines too. When WebMCP or something like it does stabilise, exposing tools becomes a thin adapter over functions you already have — the developers who have written this up consistently report it is a wiring problem, not a construction problem, provided the underlying logic is already well factored. Do the factoring now; do the adapter when the spec stops moving.

What Astra's Critical cybersecurity rating means if you run a site

Astra is the first model OpenAI has classified as meeting the Critical threshold for cybersecurity under its Preparedness Framework. The numbers behind that classification, tested without production safeguards:

• 100% on ExploitBench, against 78.5% for GPT-5.6 Sol.
• 39.0% on an internal ExploitBench built from vulnerabilities disclosed between June and August 2026, against 5.5% for Sol — and during that evaluation Astra found and used two previously unknown zero-days, which OpenAI says it has disclosed to the maintainers.
• 88.0% of SRE-Bench reverse-engineering tasks solved on the first attempt, 99.2% within four, against 55.9% and 68.7% for Sol.

The launch version refuses advanced offensive work such as writing proof-of-concept exploits, and less restrictive access is being rolled out through OpenAI's Daybreak program for defenders. Do not read this as "GPT-6 is going to hack you next week." Read it as a change in cost: the effort required to find an exploitable bug in a stack like yours just dropped by a lot, and the safeguards holding that back are model-side policy, which is a different kind of guarantee than a technical one.

The practical consequence for a small team is unglamorous and entirely within reach. Patch cadence stops being something you get to when there is time. Dependency updates get automated. Anything you were protecting through obscurity — an undocumented endpoint, a guessable admin path, an internal API with no auth because nobody knows the URL — should be assumed to be findable now. On the defensive side the same capability is genuinely useful: secure code review and patching are explicitly supported at launch, and running Astra over your own codebase before someone else runs it over your deployed site is a reasonable use of $10 per million tokens.

What I would actually do this week

Three things, in order. First, open your own highest-value conversion page and try to complete it as an agent would — no mouse memory, no knowing what the icons mean, reading only labels and text. The unlabelled inputs and the ARIA-less dropdowns will find themselves within five minutes. Second, decide your crawler policy deliberately rather than inheriting whatever your CDN defaults to; blocking every AI user agent to stop scraping also blocks the agent your customer sent. Third, if you are building on the API, instrument your token counts against that 272,000-token line before you scale anything.

None of this is speculative preparation for an agentic web that might arrive. The measurable version of it — structured content surfaces, clean semantics, a crawler policy you chose on purpose — is what our SEO, AEO and GEO service implements, and it pays off against the crawlers and answer engines that are already reading your site today, regardless of what Astra turns out to be a year from now.