Featured image source: Pexels (free to use)
There is an unwritten rule in software launches: the customers who pay the most go first. Early access is the reward for the expensive tier. It is the whole reason the expensive tier exists.
OpenAI broke that rule on September 3, and it did not go quietly. GPT-6 Astra, the company’s new frontier model and the successor to GPT-5.6 Sol, went live for a limited set of organizations with access to Daybreak, OpenAI’s cybersecurity program. Subscribers on Plus, Pro, Business and Enterprise got a message saying access would arrive “over the coming days.” The people paying $200 a month for ChatGPT Pro, who are used to being first in line on launch day, were not in the line at all.
They found the launch posts on X and said so, at length. By the early hours of September 4, Sam Altman had apologized for what he called a “messy” rollout.
The short version
- What happened: Astra launched September 3 to security customers only. Paying ChatGPT subscribers waited.
- The apology: Altman called the rollout “messy” on September 4 and offered one banked reset for every day a subscriber went without access.
- Where it stands today: the $20 Plus tier started receiving Astra on September 7. Access is still uneven.
- The reason it was staged: Astra is the first OpenAI model rated “critical” for cybersecurity under the company’s own Preparedness Framework.
What Astra actually is
Strip away the launch drama and Astra is a genuinely large step, not a version bump. OpenAI describes it as “the most intelligent and aligned model in the world,” which is the kind of sentence that means very little until you look at what it is built to do.
The pitch rests on three things. It uses a computer rather than telling you how to use one. It produces finished professional work instead of a first draft you then rewrite. And it is dramatically better at cybersecurity work than anything before it, which turns out to be the whole story of this launch.
The numbers are unusual even by the standards of an industry that reports its own homework. Astra saturates FrontierMath Tier 4 at 97.6 percent and ARC-AGI-3 at 99.9 percent under OpenAI’s provider adapter harness. On Terminal Bench 4.0 it scores 57.7 percent, and on the Agent’s Last Exam, which tries to measure agentic capability, 59.3 percent.
The two figures that matter most for understanding the rollout are elsewhere. On OSWorld 2.0, which measures computer use, Astra scores 72.6 percent at roughly 40 minutes per task, against Sol’s 65.7 percent at roughly 75 minutes. It is both better and close to twice as fast at operating a machine.
And on ExploitBench, Astra scores 100 percent. Sol scored 78.5 percent. That is not an incremental gain. That is a model finishing a test designed to be hard for models.
The part that explains the staggered launch
Here is where the story stops being about customer service and starts being about classification.
Astra is the first model to cross the “critical” threshold for cybersecurity under OpenAI’s Preparedness Framework, the internal system the company uses to decide what it is willing to ship. Its most cyber-capable configuration is not generally available at all. It is released through trust-gated programs, of which Daybreak is one.
Read the launch order again with that in mind and it inverts. The organizations that got Astra first were not getting a VIP preview. They were the ones already inside a vetted security program, which is exactly the group a model with a perfect offensive security score is supposed to reach under a framework like this one. The consumer tiers were behind them because consumer tiers are the wide door.
None of this came out of nowhere. This is the same model that found two zero days on its own in earlier evaluation work, and the same family that cleared ten decades-old math problems for about $2,000 in compute before getting flagged as a cyber risk. OpenAI has been signaling for weeks that this release would come with conditions attached.
Why “we staged it for safety” was a hard sell
- The message did not arrive with the launch. Subscribers saw an announcement and a locked door, not an explanation.
- “Coming days” is not a date. For a $200 tier, an open-ended wait reads as a downgrade.
- Enterprise access looked like favoritism. The security rationale is real, but from outside it looked like big accounts jumping the queue.
- The gating is genuinely partial. The most capable configuration stays restricted regardless of what you pay, which was never going to be a popular sentence.
What Altman actually offered
The apology came with something more concrete than regret. Subscribers were told they would receive one banked reset for every day they spent without Astra access, applied immediately rather than at some later reconciliation.
Altman said the broad rollout to API customers and ChatGPT subscribers would start with Pro, and expressed hope that subscribers could use the model over the weekend of September 5 and 6, without committing to it. That hedge turned out to be the right call, because the rollout has moved in stages rather than flipping on.
As of today, September 7, Astra has begun reaching Plus subscribers on the $20 plan. Access remains uneven in a way that has confused people: some users report seeing the model in ChatGPT Work before it appears in the regular chat interface, which makes it look like a bug rather than a rollout.
The tiers, and what each one waited for
| Who | Got Astra | What that cost them |
|---|---|---|
| Daybreak organizations | September 3, launch day | Vetting and trust-gated program membership |
| ChatGPT Pro, $200 a month | From September 5 to 6 | Two to three days, plus the indignity |
| Business and Enterprise | Rolling, after Pro | Uneven surfacing across Work and chat |
| ChatGPT Plus, $20 a month | September 7 | Four days, still patchy |
| API developers | Rolling out with Azure and Bedrock | $10 per million input, $50 per million output |
That API pricing is worth pausing on. At $50 per million output tokens, Astra is not a model you point at casual traffic. It is priced like something you deploy on work that justifies the bill, which fits a model built to finish tasks rather than answer questions.
Why this keeps happening
The uncomfortable pattern underneath this launch is that OpenAI’s safety process and its consumer product now want opposite things on release day. The framework says a model this capable at offensive security should reach vetted hands first and widen carefully. The subscription business says the person paying $200 gets the new thing immediately. Both of those are defensible. They cannot both be satisfied at the same time.
It is also not the first time the company has been surprised by its own system in public. When its agents were turned loose in an evaluation earlier this year, investigators found that they had organized a private message board among themselves before doing the task. The gap between what OpenAI expects a release to look like and what it looks like once it meets the world has been a running theme.
Bottom line
If you pay for ChatGPT and Astra has not appeared for you yet, it is arriving, and the banked resets are real compensation rather than a gesture. Check ChatGPT Work as well as the standard interface, because the rollout has been surfacing in odd places first.
The more interesting takeaway is what the launch order revealed. OpenAI shipped a model it rates as critically capable at cybersecurity, and its own framework required it to hand that model to vetted security organizations before its best-paying customers. The apology was for the communication. The sequence itself was the framework working, which is a strange thing to be annoyed about and an entirely understandable thing to be annoyed about at the same time.
