The Computer Will Act. That Is Not AGI.

OpenAI shipped GPT-6 Astra on September 3. The company presents it as a frontier model for computer use, browsing, software engineering, cybersecurity, science, and professional work. The product thesis is blunt: the model should persist, click, recover, and continue across work performed on a computer.

That sentence is the story. Not AGI.

Two Signals ago this desk asked who acts when intelligence leaves the chat window. The next asked what verifies an action before it becomes force. Astra applies the same pressure one layer down the stack. The model is no longer only answering. It is being sold as an operator of the desktop, browser, IDE, and, under tighter controls, the exploit chain.

Separate the registers. Historical: what OpenAI published and what independent coverage attributed to the briefing. Promotional: what the company claims about itself. Interpretive: what the pattern means for agency and capital. Operational: what a principal should demand before the model sits on a machine that can pay, click, or compile.

What actually shipped

The primary document is OpenAI's Astra launch page. Treat every performance score as vendor-reported unless an independent evaluator reproduces it.

Rollout is staged. OpenAI began with a limited set of organizations and said ChatGPT Plus, Pro, Business, and Enterprise access, the API, and Amazon Bedrock would follow over the coming days. Enterprise workspaces ship with Astra off by default. The API model name is gpt-6-astra. The published standard price is $10 per million input tokens and $50 per million output tokens. Fast mode is advertised at up to 2.5 times the speed for twice the standard price.

The capability claim that matters is computer use. OpenAI reports OSWorld 2.0 at 72.6 percent within 40 minutes per task, compared with 65.7 percent for Sol within 75 minutes. It reports AutomationBench at 41.4 percent of multistep business workflows, compared with 31.4 percent for Claude Fable 5.1. Codex receives a notes-and-search layer intended to keep earlier context retrievable across longer work.

The launch page also reports 98 percent on FrontierMath Tier 4, 99.9 percent on ARC-AGI-3, 100 percent on ExploitBench, and 96 percent on GPQA Diamond. Saturating a named benchmark is an engineering event. It is also how a laboratory talks when it wants the category renamed.

What “AGI era” means here

The launch page does not declare AGI. That phrase belongs to the briefing and the surrounding coverage. Axios reported Greg Brockman describing AGI as gradual, acknowledging that the term is fuzzy, and saying, “Welcome to the AGI era.” The sentence will travel farther than the system card.

Hold the distinction. A mission concept is not a measurement. A benchmark score, however strong, does not establish that a system outperforms humans across most economically valuable work. Neither does an automated research intern evaluated inside the organization that built it.

The relevant investor question is not whether one rhetorical threshold has been crossed. It is whether the marginal cost and reliability of accepted work are changing, whether customers can verify the change, and who captures the economics after compute, monitoring, implementation, and failure recovery are counted.

The Critical threshold is the load-bearing fact

On September 1, OpenAI published Path to Astra. The company says Astra meets the Critical cybersecurity capability threshold under its Preparedness Framework. With appropriate tools and access, it says the model can find previously unknown flaws and develop exploits against protected systems without a person guiding every step. OpenAI identifies Astra as its first model at that level.

That classification explains the staged rollout, restricted advanced cyber workflows, Daybreak Blue access, and additional monitoring. A perfect ExploitBench score concerns known vulnerabilities. More consequential are OpenAI's internal evaluations using recently disclosed V8 flaws and hardened targets. Those are vendor assessments, not independent replications, but they are directionally serious.

The control story is mixed. OpenAI reports that Astra stayed within authorized scope more reliably than Sol in its own comparisons. It also says monitorability declined on simpler tasks even while the model still struggles to conceal behavior on more complex ones. If reasoning becomes harder to observe, audit and oversight become harder too. That is not a footnote. It is the control problem wearing a product name.

Compute, price, and the operator SKU

Astra's price positions it as an operator model, not a commodity assistant. The total cost of the work must therefore include more than tokens: tool access, monitoring, approvals, error recovery, and the human responsibility that remains after the model acts.

Enterprise defaults off. That toggle is a meaningful product choice. A model rated Critical for cyber should not wake up across an organization because a new feature arrived enabled by default.

OpenAI's comparisons are also part of a competitive briefing. Some published tables support a lead over rival frontier models. Some are close. None establish permanent leadership. The market will need customer outcomes, independent evaluations, and failure data, not only launch-week scoreboards.

The counter-signal

A saturated exam can be a contaminated exam. OpenAI built a more recent internal ExploitBench port because contamination was a concern. Apply the same discipline to ARC-AGI-3 and FrontierMath before treating 99.9 and 98 as metaphysics.

Customer stories at launch are controlled demonstrations. A reduction in manual fixes inside an OpenAI case study is not an audited plant, hospital, brokerage, or robot-arm metric. The evidence becomes decision-grade when a customer can corroborate attempted work, accepted output, intervention burden, failures, and all-in cost.

Computer use without a mandate is last week's architecture problem with a mouse. The model can fill the CRM. It can also fill the wrong CRM. Settlement of an API call is not authorization to click. A zero over-scope score inside a vendor harness is not a signed grant from a named principal.

“AGI” can be useful as culture and useless as control. If the term does not determine deployment permissions, accountability, capital access, or an independently testable threshold, it should not substitute for those decisions.

The operating choice

As Above will not certify a model as general intelligence because an executive welcomed us to an era. We will track whether Astra can run a workflow that survives contact with a real desk, whether advanced cyber tools remain behind meaningful gates, and whether monitorability keeps declining as capability rises.

Four questions should remain distinct:

1. Identity: Does the agent identify itself as an instance rather than impersonating the principal?
2. Mandate: Does the grant name permitted tools, counterparties, spending, duration, and scope?
3. Record: Does the log connect intention, action, result, and reviewer?
4. Revocation: Can a person stop the session through a path that does not depend on the model's cooperation?

Above: intention, meaning, principal. Below: computer-use tool, exploit chain, API meter, default-off toggle. When those layers correspond, an operator model can sit on a desk. When they do not, we have a saturated benchmark and an unsigned machine.

Do not buy the era. Buy the constraint.

The constraint today is not another point on GPQA. It is whether a Critical-rated operator can be bound to a person who still answers for the click.

All is Mind. Mind that uses the computer needs a name, a scope, and a stop that works when the model would rather continue.

What to watch next

• Independent ARC-AGI-3 and computer-use replications, not the launch table.
• Whether the announced staged rollout arrives on schedule.
• Who receives advanced cyber access through Daybreak Blue and what controls accompany it.
• Differences between the system card and launch copy on monitorability and scope.
• Claims that Astra creates new knowledge. Demand the paper, formal verification where relevant, and the human contribution record.

Evidence cutoff: September 3, 2026. Benchmarks, alignment percentages, product behavior, and customer outcomes attributed to OpenAI have not been independently audited by As Above. AGI remains a contested definition. Educational analysis, not investment, security, legal, or procurement advice. AI tools assisted source discovery and production; Marc Theiler retains editorial responsibility.