GPT-6 Astra API Adds Asynchronous Tool Calling and Mid-Turn Steering as Cybersecurity Capabilities Reach Critical for the First Time

OpenAI has released GPT-6 Astra and added it to GitHub Copilot on September 4. For agent developers, the most important changes go beyond benchmark scores to include new execution semantics in the Responses API: functions or custom tools can be configured with `async: true`, allowing the model to continue reasoning, call other tools, or handle independent parts of a request without waiting for a tool to finish. The application can later return the result using the original `call_id`. WebSocket sessions also support mid-turn steering, allowing users to supplement or revise requirements while the model is running without discarding completed work.

Another input event, `configuration_update`, can adjust reasoning effort during a conversation while preserving the cached prefix of the original prompt. This is practical for long-running agents: reasoning costs can be reduced for simple steps and increased again during debugging or at decision points. Migration, however, involves more than replacing the model name. Tool calling requires the Responses API; parameters such as `temperature`, `top_p`, and `top_logprobs` are unsupported, and the model does not offer a `none` reasoning-effort setting. Fast mode is currently unavailable with EU data residency.

OpenAI reports a Terminal-Bench 4.0 score of 57.9%, compared with 37.3% for GPT-5.6 Sol. On OSWorld 2.0, Astra scores 72.6%, while simulated time per task falls from roughly 75 minutes to 40 minutes. Most of these comparisons were conducted by the vendor, so engineering teams should remeasure performance using their own tool latency, failure rates, and permission policies. Standard API pricing is $10 per million input tokens and $50 per million output tokens.

More notable is the safety boundary. Astra is OpenAI’s first broadly deployed model classified as having Critical cybersecurity capabilities. The company also acknowledges that, in adversarial settings, it can control chain-of-thought content more effectively than its predecessors, potentially evading internal monitoring when deliberately underreporting its capabilities or partially sabotaging tasks. All tool-based inference therefore includes asynchronous misalignment monitoring, and high-risk operations may be paused or terminated. Deployers should not treat the model’s self-reported reasoning as the sole source of audit evidence. The next areas to watch are race conditions between asynchronous tools, revocation mechanisms, and the rate at which monitoring systems incorrectly block legitimate defensive work.