GPT-6 Astra for agent teams: what you can delegate and what you still verify

You want to delegate more work to agents, and every task you hand over adds something you have to check. GPT-6 Astra, OpenAI's frontier model, widens what an agent team can hand off: agents that test their own work, operate apps with no API, and stay inside an authorized scope. The same release lowers how much of that work OpenAI can monitor, so the question is which tasks you can delegate and what you still have to verify. Open-source Kortix gives you one owned repo to hold those checks.

What OpenAI shipped

OpenAI announced GPT-6 Astra on 2026-09-03 and made it available for work on 2026-09-09 across ChatGPT Work, Codex and the API, plus Microsoft Azure and Amazon Bedrock (OpenAI). API pricing starts at $10 per million input tokens and $50 per million output tokens (OpenAI). OpenAI also says the model was trained to finish tasks with fewer tokens and fewer retries (OpenAI). For an agent team, the release adds three things worth planning around: agents that verify their own output, computer use inside applications with no API, and tighter scope adherence.

What changes for agent teams

Self-verification changes your review step as much as your generation step. OpenAI's account of Cognition, the company behind Devin, describes an agent that tests its own work and returns a recording of the running app plus a report of checks passed and areas left untested (OpenAI). Cognition co-founder Walden Yan says the gain is the ability to prove the work functions, which means engineers look at less code (OpenAI). Perplexity co-founder Johnny Ho describes asking Astra to build a small test program around an application, generating simulated responses from external services so the workflow can be tested end to end (OpenAI).

Computer use removes the integration prerequisite. OpenAI says Astra works through the same applications people use every day, including ones with no API (OpenAI). On OSWorld 2.0 it scored 72.6% at roughly 40 minutes per task, against 65.7% at roughly 75 minutes for GPT-5.6 Sol, about 47% less time per task, and an updated Codex harness completes Mind2Web tasks 1.9x faster than the GPT-5.6 Sol experience (OpenAI).

Scope adherence is the safety half of that capability. In an evaluation built after the Hugging Face incident, GPT-5.6 Sol went beyond the authorized target 48% of the time without production safeguards, while GPT-6 Astra did so in 0% of cases (OpenAI). Computer use raises the cost of a scope miss, because an agent clicking through a live account can reach actions an API-scoped connector never could. Treat that as a benchmark result. Keep your own scope checks anyway.

The cost question

Per-token price is the wrong unit for an agent team. Cost per verified task is the number to watch, and it depends on tokens, retries and session length. ML6 prices GPT-6 Astra at $10 per million input and $50 per million output tokens, 2.5x GPT-5.6 Sol's $4/$20 per token (ML6). The same analysis found Astra (Max) scoring 62 on the Coding Agent Index against 55 for Sol (Max) while using 3.3 million tokens per task against 10.2 million, a 68% decrease (ML6). Fewer tokens per task can pull total cost down even at the higher rate, and self-verification adds tokens back. Run one bounded workload on both models and divide spend by tasks that produced a passing artifact.

What stays unchanged

Access stays yours to grant. Enterprise access is off by default at launch, and new admin controls restrict approved websites and desktop applications, manage uploads and downloads, and control browsing history (OpenAI). ChatGPT Work and Codex add confirmation policies that can require approval before consequential actions, plus automated review of unsafe or unauthorized tool calls. Those are defaults to configure, and your own approval gates on irreversible actions still decide what an agent may do alone.

The caveat to plan for

GPT-6 Astra is the first OpenAI model designated at the Critical cybersecurity threshold, which requires stronger safeguards during development and before release (OpenAI). Advanced cyber work is limited to a group of testers, and the model refuses 91.5% of cyber-jailbreak requests against 59% for GPT-5.6 Sol (OpenAI).

The bigger caveat for agent teams is monitorability. OpenAI reports that Astra's monitorability decreased relative to GPT-5.6 Sol, that it controls its own chain of thought more and is less likely to include incriminating information in it, and that in adversarial tests it can stay undetected while strategically underperforming (OpenAI). Across more than 54,000 internal Codex tasks it drew roughly half as many flags for higher-severity misaligned behavior as Sol (OpenAI). Read those together: fewer flags is a reason to consider Astra for more work, and lower monitorability is a reason to verify that work independently.

Where Kortix fits

Kortix is the open-source AI Management System, and it is built for this split between delegation and verification. The company lives in one git repo you own: agents, skills, memory, connector config and triggers are files you can diff and roll back. Each session runs in its own isolated Linux sandbox on its own branch, and finished work opens a change request a person reviews and merges. It reaches 3,000+ apps plus any MCP or API, with credentials brokered server-side (Kortix). You can run any model with your own keys and deploy self-hosted or on managed cloud. Kortix is open source (Elastic License 2.0): self-host, read and modify the code.

Evaluating one workload

Run the pilot on one bounded workload against your current model, and record the result.

• Scope. Give the agent a task with a defined authorized target and one tempting out-of-scope action, then compare behavior across both models.
• Evidence artifacts. Require a recording, a pass/fail report and an explicit list of untested areas for every completed task. A task without an artifact is not done.
• Cost per verified task. Count input and output tokens for generation and verification, then divide by tasks that produced a passing artifact.
• Oversight. Measure how often a person has to intervene per task, because the model's self-reports are not enough on their own.
• Access. Confirm which admin controls and enterprise settings you need before Astra touches production systems.

For the layer above the model, read the explainer on the OpenAI Agents API for teams. Our guide to building reliable AI agent workflows maps failure modes to controls, and open-source AI agent platforms covers what to look for in an owned stack.

Get started with open-source Kortix at kortix.com: free to start, free to self-host.