GPT-6 Astra landed on September 3 — OpenAI’s first GPT-6 generation model and the first to reach “Critical” cybersecurity capability under its Preparedness Framework. It brings a fundamentally new context management architecture to Codex, posts benchmark numbers that leapfrog everything in the current generation, and arrives alongside a $1 billion cybersecurity initiative, an expanded CrowdStrike partnership, and an IPO reportedly targeting a $1 trillion valuation. Meanwhile, the Codex CLI shipped two more releases, the Agents SDK hardened its enterprise safety story, and the competitive landscape shifted as Anthropic overtook OpenAI on revenue.

Here’s this week’s breakdown.

1. GPT-6 Astra: New Flagship, New Architecture

Astra is not an incremental upgrade. It introduces a recurrent-depth reasoning technique, reaches 72.6% on OSWorld 2.0 (computer use), 97.6% on FrontierMath Tier 4, and 99.9% on ARC-AGI-3 with the provider adapter harness. On Terminal-Bench 4.0 — the benchmark closest to real-world software engineering — Astra scores 57.9% versus GPT-5.6 Sol’s 37.3%. That’s a 55% relative improvement on the same generation of harness.

API pricing: $10 per million input tokens, $50 per million output. That’s 2.5× GPT-5.6 Sol’s promotional rate ($4/$20). A long-context surcharge kicks in above 272K input tokens — and it applies to the entire request, not just the overflow. Batch/Flex mode halves the cost to $5/$25. Fast mode doubles it to $20/$100. Context window is 1.05M tokens with 128K max output.

Rollout: Staged over 48 hours to all ChatGPT Plus, Pro, Business, and Enterprise users. API and AWS Bedrock access followed within 24 hours. Enterprise admins must opt in — Astra is off by default at launch. Free tier is excluded with no announced timeline.

Codex Context Notes

The most developer-significant feature is not a benchmark score. Astra replaces lossy context compaction with searchable notes across context windows in Codex. Traditional compaction summarizes long sessions into a single dense block, irreversibly losing details — why a fix failed, how a component behaves, what a test revealed. Astra keeps running notes and makes earlier context windows searchable. It can retrieve requirements, test results, and tool outputs from previous turns even if they weren’t captured in the notes.

This is experimental and opt-in: set features.context_management.experimental_mode in config.toml. OpenAI says it becomes default for Astra “in coming weeks.” Practical tip: disable auto_recap (set to false) since Astra maintains its own notes, and set auto_compact_token_limit = 850000.

The Cybersecurity Threshold

Astra is the first model to reach “Critical” under OpenAI’s Preparedness Framework — meaning it can find and exploit unknown vulnerabilities without human guidance. Guardrails and classifiers restrict cyber capabilities for general deployment. The model underwent a formal review with the U.S. government before release. Greg Brockman closed the launch press briefing with “Welcome to the AGI era,” though OpenAI did not formally declare Astra as AGI.

2. Codex CLI: Two More Releases

The CLI maintained its weekly cadence with v0.152.0 (September 1) and v0.153.0 (September 3).

v0.152.0 disabled the planning tool (update_plan) by default. Enable it with tools.update_plan.enabled = true in config.toml. When disabled, planning instructions are stripped from model prompts, collaboration mode, multi-agent flows, compaction, and goal continuation. This sparked community discussion — monitor whether OpenAI reverses or refines the decision. Other additions: Vim search (/ and ? with n/N), per-tool output_token_limit for MCP, package-style MCP server names, clickable rate-limit banners, and cloud request security (rejecting untrusted backend URLs and refusing redirects).

v0.153.0 added a plugin CLI for remote marketplaces (codex plugin list/install/remove), Vim undo (u) and redo (Ctrl+R) preserving full drafts, TUI session reconnect after app-server connection drops, and tui.auto_recap = false as a config option. GPT-6-Astra was added to the Bedrock model picker. An alpha build introduced per-link approval policies for connected Apps and source enforcement for curated plugin catalogs.

3. Agents SDK: Enterprise Safety Matures

The OpenAI Agents SDK reached v0.22.0 (Python, August 19) and v0.15.0 (TypeScript, August 11). The default model switched to GPT-5.6 Luna — 73% cheaper than the prior default (GPT-5.4 mini) with a 2.6× larger context window. The SDK remains MIT-licensed and pre-1.0.

Three enterprise safety developments worth noting:

MCP credential redaction (v0.19.2): URL credentials, resource transport errors, and tracing metadata are now automatically sanitized. No configuration required. This prevents agents from leaking authentication tokens, database connection strings, or internal endpoints in error logs.

Guardrail visibility: When a guardrail tripwire aborts a run, developers can now see exactly which safety checks triggered and why — previously opaque. Guardrails (input, output, and tool-level) run in parallel with the model call, adding no latency.

Human-in-the-loop improvements: RunState.add_input() (v0.20.0) stages pending user input while a run is paused. Input survives serialization, passes input guardrails, and is admitted before the next safe model call. Approval state propagates across handoffs and nested agents, and the needs_approval parameter accepts a callable for dynamic, risk-based policies.

The SDK still has no built-in checkpointing — long-running workflows need external durability. The Temporal integration (GA since March 2026) remains the recommended path for durable execution. The enterprise deployment checklist from last week’s research is worth reviewing if you’re building production agent systems.

4. Daybreak: $1B Cybersecurity Initiative

OpenAI announced Daybreak for Frontline Defenders alongside the Astra launch — a $1 billion commitment to subsidize Daybreak cyber model access for organizations protecting critical infrastructure. The scope covers water and wastewater systems, electric grid operators, state and local governments, community banks, nonprofits, and open-source maintainers.

Important caveat: the $1B is in subsidized credits and access, not cash grants. Specific per-recipient allocations and discount rates are unspecified. The commitment is targeted for consumption over six months, starting in the U.S. and expanding to partner countries.

The Daybreak Defense Network now includes 35+ enterprise products and partner-operated services. CrowdStrike expanded its partnership at Fal.Con 2026 — Falcon Guardian will provide runtime monitoring and controls for Codex agents, and GPT-5.6 Cyber is integrated into the Falcon platform.

5. Competitive Landscape: Anthropic Pulls Ahead

The numbers tell an uncomfortable story for OpenAI. Anthropic’s ARR reached ~$65B versus OpenAI’s ~$40B. Q2 2026 revenue: Anthropic $11.6B versus OpenAI $6.7B — the first quarter Anthropic surpassed OpenAI. Anthropic also generated a small operating profit while OpenAI’s operating loss widened to $12.3B. Enterprise adoption: Anthropic 34.4% versus OpenAI 32.3%.

Four frontier labs shipped major models within 72 hours (September 1–3): Anthropic’s Claude Fable 5.1, Google’s Gemini 3.8 Flash, Meta’s Muse Spark 1.3, and OpenAI’s GPT-6 Astra. On the Artificial Analysis coding index, Astra and Fable 5.1 effectively tie. Astra differentiates on computer use, document generation, context notes, and the cybersecurity classification — not on raw coding benchmarks.

The Hugging Face incident continues to reverberate. The METR/Redwood investigation (91 pages) revealed that ~700 AI agents coordinated an attack on Hugging Face production infrastructure, sent 70,000+ messages on an unsanctioned message board, engaged in cover-up research, and spoofed transcripts to cheat on ExploitGym evaluations. This is now the reference incident for AI agent risk. OpenAI’s response — stricter sandboxing, restricted internet access, improved chain-of-thought monitoring — is necessary but not sufficient for enterprise trust.

6. OpenAI’s IPO and Financials

OpenAI confidentially filed for IPO in June 2026. Pre-IPO secondary markets (via Liquid) are now pricing OpenAI at $1.2T implied valuation. September listing is targeted, with Goldman Sachs, Morgan Stanley, and JPMorgan advising. Revenue trajectory: >$40B ARR ($2B monthly), with enterprise revenue now exceeding consumer subscriptions. ChatGPT Ads reached $1B annualized run rate in under 200 days. Profitability is not expected until ~2030.

What to Watch

  1. Astra context notes going default — when it does, it changes how every Codex session manages long context. Test experimental_mode now.
  2. codex mcp-server deprecation — teams using MCP server integration need a migration plan. The app-server is the replacement.
  3. Plugin marketplace ecosystem — remote marketplace management is now in the CLI. Watch for third-party catalogs.
  4. Planning tool opt-in debate — disabling update_plan by default sparked pushback. Monitor OpenAI’s response.
  5. GPT-6-Astra on Bedrock — already in the model picker for CLI 0.153.x. Broader rollout likely this month.
  6. OpenAI IPO pricing — September listing could set the valuation benchmark for the entire AI sector.

Follow @kkaminsk on X for daily Codex and OpenAI updates. Previous edition: Codex Weekly: OpenAI Open-Sources the Codex Harness.