GPT-6 Astra for business: 3 processes to hand to an AI agent first

In 60 seconds: GPT-6 Astra is built for long, tool-using work. It can browse, use a computer, call MCP tools, and work with a 1.05 million-token context window. That makes it useful for business workflows that cross a CRM, inbox, help desk, and internal documents. It also raises the cost of a careless rollout. Start with one workflow that reads data and prepares a draft. Keep a person responsible for sending, paying, deleting, or changing production systems.

OpenAI’s new flagship model is a better fit for an agent than a chatbot. The API supports computer use, web and file search, a hosted shell, and MCP. That lets an agent move through software your team already uses instead of waiting for a custom integration for every screen.

The model is expensive enough to make workflow selection matter. OpenAI lists GPT-6 Astra at $10 per million input tokens and $50 per million output tokens. A high-value process with a clear stopping point is a better first test than a vague request to “automate operations.”

Watch the launch video

The product demo is useful because it shows the interaction model: give the agent a goal, let it gather context and use tools, then review the result. A business workflow needs one more layer. The agent must know which tools it can use, which records it can see, and when it has to stop for approval.

Read the benchmarks without turning them into a buying decision

OpenAI reports a modest gain over GPT-5.6 Sol on DeepSWE and a larger one on Terminal-Bench 4.0. Both are agent benchmarks, but neither tells you whether an agent understands your account model, your exception rules, or the quality bar your customers expect.

Use the numbers to choose a pilot, not to skip one. If your workflow mostly involves browser and terminal steps, the Terminal-Bench improvement is a reason to test Astra. If it depends on policy decisions or customer relationships, the benchmark says much less.

The security result that changes the rollout

Astra is OpenAI’s first model to reach the Critical cybersecurity capability threshold in its Preparedness Framework. That is not a reason to avoid it. It is a reason to treat permissions as part of the product.

OpenAI’s system card reports a lower success rate for indirect prompt-injection attacks than GPT-5.6 Sol on Gray Swan’s IPI Arena. The result is encouraging, but an 8.5% attack success rate is not a permission model.

Untrusted text can arrive through an email, webpage, ticket, or document. A model may be more resistant to malicious instructions and still make a bad action if it has broad credentials. Limit what the agent can read and write before you connect it to live systems.

Three useful first pilots for a SaaS team

1. Lead research and CRM preparation

Give the agent a list of target accounts, access to approved public sources, and permission to create a lead record or a draft. It can gather basic company context, identify likely fit, and prepare a first message. A salesperson checks the record and sends the outreach.

This works because the output is easy to sample. You can compare the agent’s drafts with the team’s current research time and catch weak assumptions before they reach a prospect.

2. Support triage with a proposed response

Let the agent read a support ticket, the account plan, and the relevant knowledge-base articles. It can classify the request, collect the facts, and propose a response. Keep refunds, plan changes, account deletion, and production fixes behind human approval.

The agent saves time when it removes the search work. It should not become the final authority on a customer exception.

3. Product feedback into a reviewable backlog

Connect the agent to interview notes, tickets, and product feedback. Ask it to group repeated problems, cite the source records, and create proposed tickets with an owner and a short rationale. A product manager decides whether the item enters the backlog.

The useful output is a smaller review queue, not an autonomous roadmap.

Five controls before the agent gets write access

1. Start in read-only mode and save its proposed actions.
2. Give it a separate account with the smallest useful role.
3. Require approval for sends, payments, deletes, permission changes, and production deployments.
4. Keep an action log that links each change to the source material and the approving person.
5. Set a time, token, and tool-call budget for every run, then provide a stop switch.

These controls are ordinary operational hygiene. They also make it easier to find out whether the model is helping. If the team cannot explain why an agent changed a record, the workflow is too broad.

Run a 30-day pilot before a broad rollout

Choose one workflow, one owner, and a small group of users. Record the baseline: time per case, correction rate, response time, and the cost of the current process. Then compare it with the agent after a representative number of cases.

Keep the pilot if it saves meaningful time without raising the correction rate or creating security exceptions. Otherwise, reduce the scope or choose a workflow with cleaner inputs. Astra’s capability is useful only when the surrounding process gives it a clear job and a clear boundary.