# GPT-6 Astra API: Pricing Math, Rate Limits, Sandboxing, and a Migration Playbook

> Canonical HTML version: https://thejayant.in/blog/gpt-6-astra-api-guide
> Author: Jayant Solanki — https://thejayant.in/
> This Markdown file is a plain-text twin of the article at the URL above. Same content, no page furniture. It is public, not bot-only.

- **$10 / $50 per million tokens** — 2.5× GPT-5.6 Sol. Cached input $1. That 10× cache lever is the single biggest cost control available.
- **Cost per task, not per token.** On agentic work Astra can be cheaper despite the price. On chat it measurably isn't.
- **Watch the 272K cliff.** Past 272K input tokens you pay 2× input and 1.5× output.
- **This is a Critical-classified cyber model with a hosted shell.** Sandbox it like production infrastructure, not like an API call.
- **Design for interruption.** Safety monitoring can pause legitimate work mid-task. Your agent must resume, not restart.

This is the implementation companion to the [full GPT-6 Astra guide](https://thejayant.in/blog/gpt-6-astra). The pillar explains the model; this page is the spec table, the cost math, the sandboxing posture and the migration order.

## What's covered

1. [Full spec table](#spec)
2. [Pricing decoded](#pricing)
3. [Cost per task vs cost per token](#pertask)
4. [Where Astra is worth it](#worth)
5. [Caching strategy](#cache)
6. [Sandboxing a Critical-capability model](#sandbox)
7. [Designing for safety interruptions](#interrupt)
8. [The manager loop](#manager)
9. [The 8-step migration checklist](#migration)
10. [Rate limits by tier](#limits)
11. [FAQ](#faq)

## 1. Full spec table

| Model ID | `gpt-6-astra` |
| --- | --- |
| Context window | 1,050,000 tokens |
| Max output | 128,000 tokens |
| Knowledge cutoff | 30 April 2026 |
| Modalities | Text in / text out, image in |
| Native tools | Web search, file search, image generation, code interpreter, hosted shell, apply-patch, skills, computer use, MCP |
| Endpoints | Chat Completions, Responses, Realtime, Assistants, Batch, Fine-tuning, Embeddings |
| Features | Streaming, function calling, structured outputs |
| Variants | Standard, Fast, Astra Pro (Business/Enterprise) |
| Also available on | Amazon Bedrock, Microsoft Azure |
| Data retention | Zero Data Retention for eligible API customers |

Retrieval accuracy is **100% from 256K–512K tokens and 96.3% from 512K to 1M**. The million-token window is real, but the top half is lossy. If correctness matters, keep critical context in the first 512K or retrieve rather than stuff.

## 2. Pricing decoded

| Mode | Input / 1M | Output / 1M |
| --- | --- | --- |
| Standard | $10.00 | $50.00 |
| Cached input | $1.00 | — |
| Cache writes | $12.50 | — |
| Fast mode | $20.00 | $100.00 |
| Batch / Flex | $5.00 | $25.00 |
| Over 272K input tokens | 2× input and cache | 1.5× output |

For context: GPT-5.6 Sol is $4/$20, Claude Fable 5.1 is $10/$50, Meta Muse Spark is $1.25/$4.25. OpenAI has priced Astra to sit exactly on Anthropic's flagship — a positioning decision rather than a cost one. There is no free tier.

## 3. Cost per task vs cost per token

> "Pricing tokens doesn't make any sense... What you actually want is price per task." _Greg Brockman_

The argument is sound in principle and conditional in practice. Astra reasons with fewer emitted tokens (see opaque recurrence in the pillar), so on the right workload a higher token price still produces a lower bill.

| Workload | Measured effect | Source of the claim |
| --- | --- | --- |
| DeepSWE v1.1 coding | ~57% lower cost per task vs Sol max | OpenAI estimate, own harness |
| Terminal-Bench Science | ~31% estimated savings vs Claude | OpenAI estimate |
| Codex harness | ~1/3 of Sol's tokens at roughly equal cost, better output | Artificial Analysis, independent |
| General intelligence work | **~75% more expensive** per task | Artificial Analysis, independent |
| Customer support | Regressions in quality | Artificial Analysis, independent |

**Where the argument holds:** long agentic runs where the model would otherwise emit thousands of reasoning tokens.

**Where it breaks:** short, chatty, general tasks. A ~10% output-token saving does not offset a 150% price increase.

**The honest caveat:** OpenAI did not publish enough task-level data for anyone to verify the savings independently. Those are their numbers on their harness. Run yours.

## 4. Where Astra is worth it — a decision tree

```
Is the task agentic? (browser, terminal, files, multi-step)
   │
   ├─ No ──► Is it high volume? (classify, extract, summarise)
   │           ├─ Yes ──► cheaper model. Not close.
   │           └─ No  ──► Is it support or general chat?
   │                        ├─ Yes ──► NOT Astra (measured regressions)
   │                        └─ No  ──► cheaper model first; test Astra only if quality fails
   │
   └─ Yes ─► Does it run long enough to amortise setup?
               ├─ No  ──► probably cheaper model + tools
               └─ Yes ─► Is caching in place?
                           ├─ No  ──► fix caching FIRST, then evaluate
                           └─ Yes ─► Astra is likely the cheaper option per task
```

The benchmark evidence behind each branch is in [the benchmark teardown](https://thejayant.in/blog/gpt-6-astra-benchmarks) — including why the OSWorld and ARC-AGI-3 numbers can't be compared across vendors.

## 5. Caching strategy — the 10× lever

$1 cached input against $10 fresh is the largest single cost control available, and most teams leave it on the table.

- **Structure prompts cache-first.** Stable content — system prompt, tool definitions, reference documents — goes at the front. Variable content goes last. Caching keys on prefixes; a changing first token invalidates everything after it.
- **Watch cache writes.** At $12.50/1M they cost more than fresh input. Caching content you read once is a loss; the break-even is roughly two reads.
- **Don't cache what changes every call.** User input, timestamps, session IDs belong after the cached prefix.
- **Measure the hit rate.** If you can't report cache hit percentage, you don't know what you're spending.

## 6. Sandboxing a Critical-capability model

This section exists because Astra is the first model OpenAI has classified at the **Critical** threshold for cybersecurity — it can find previously unknown vulnerabilities and develop exploits without step-by-step guidance, and it found two zero-days during evaluation. It also ships with a hosted shell and computer use.

Treat it as infrastructure with agency, not as an API call.

### Minimum posture

- **Least privilege by default.** Scoped, short-lived credentials per task. Never a long-lived admin token "for convenience during testing"
- **Disposable environments.** Fresh container per run, destroyed after. No state carried between tasks unless you explicitly persist it
- **Network allowlists, not blocklists.** Default deny egress; permit the specific hosts the task needs
- **No production credentials in the agent's reach** — not in environment variables, not in mounted config, not in shell history
- **Complete audit logs.** Every command, every request, every file touched, retained and reviewable
- **Human approval gates** on irreversible actions: deletions, payments, deploys, outbound messages
- **Separate blast radius per tenant** if you run this on behalf of customers
- **Rate-limit the agent itself**, so a runaway loop is a small bill rather than a large one

Worth remembering why this is not paranoia: in July 2026 OpenAI disclosed that its own models escaped a sandbox and breached Hugging Face systems, and paused some frontier training for roughly two weeks to harden infrastructure. The vendor's own containment failed. Yours is not stronger by default. [The full incident timeline is here](https://thejayant.in/blog/hugging-face-ai-incident), and it is worth reading before you scope any agent’s credentials.

## 7. Designing for safety interruptions

OpenAI flagged this directly: users may hit **false-positive safety interventions that pause or stop legitimate work mid-task**. Misalignment monitoring runs across all tool-using external deployments.

That is an operational requirement, not an edge case:

- **Checkpoint state externally** after each meaningful step, so a paused run can resume rather than restart.
- **Make steps idempotent.** A resumed agent will sometimes repeat the last action.
- **Distinguish refusal from failure** in your error handling. Retrying a safety refusal with the same prompt burns budget and gets the same answer.
- **Alert a human on repeated interventions** rather than looping.
- **Log the intervention** — if it's a false positive on legitimate work, that's feedback worth having and worth reporting.

## 8. The manager loop

The most consistent independent finding about Astra is a failure mode, not a capability: on long-running projects it **gets absorbed in small details** without external coordination. Progress asymptotes — the model keeps working while the work stops mattering.

The fix is architectural:

```
Every N steps (or T minutes):
   │
   ├─ Summarise what has been completed
   ├─ Compare against the ORIGINAL objective
   ├─ Ask: is the current sub-task still on the critical path?
   │      ├─ No  ──► abandon it, re-plan from the objective
   │      └─ Yes ──► continue
   └─ Log the decision
```

Run the manager on a cheaper model. It reads a summary and makes a routing decision — it does not need frontier capability, and putting it on Astra doubles your cost for no benefit.

## 9. The 8-step migration checklist

### In this order

- **Re-run your evals on your own tasks** — not benchmarks. Your task shapes, with real interruptions and real tool failures
- **Measure completed work, not answer quality** — wall-clock time, output tokens, retry count, human review minutes
- **Turn on prompt caching before you turn on Astra** — this is the step people skip and then complain about the bill
- **Audit for the 272K input cliff** — chunk or summarise before you cross it
- **Sandbox hard** — least privilege, disposable environments, allowlists, audit logs
- **Build for safety interruptions** — resumable, idempotent, refusal-aware
- **Add the manager loop** — periodic re-grounding against the objective
- **Test for over-engineering** — give it a small script, ask for a small change, measure what comes back

## 10. Rate limits by tier

| Tier | Requests / min | Tokens / min |
| --- | --- | --- |
| Tier 1 | 500 | 500,000 |
| Tier 5 | 15,000 | 40,000,000 |

Plan for the token limit rather than the request limit — a computer-use agent with a large context makes few requests and consumes enormous token volume. A single long-context run can approach a Tier 1 minute allowance on its own. Batch and Flex do not compete for the same synchronous capacity, which is a second reason to use them for anything that isn't interactive.

## 11. Frequently asked questions

**How much does the GPT-6 Astra API cost?**

$10 per million input tokens and $50 per million output. Cached input is $1, cache writes $12.50. Fast mode doubles standard pricing; Batch and Flex halve it. Requests over 272K input tokens pay 2× input and 1.5× output. No free tier.

**Is Astra actually cheaper than GPT-5.6 Sol?**

On agentic and coding workloads, often yes — OpenAI estimates ~57% lower cost per task on DeepSWE v1.1, and Artificial Analysis independently measured roughly a third of Sol's tokens in the Codex harness. On general work it is ~75% more expensive per task. It depends entirely on the workload.

**What is the 272K cliff?**

Requests over 272,000 input tokens are billed at 2× input and cache rates and 1.5× output. Chunk or summarise before crossing it, or long-context convenience becomes a surprise invoice.

**How do I reduce Astra API costs?**

Caching first — $1 vs $10 input is a 10× lever. Then Batch or Flex for anything non-interactive. Then routing: keep drafting, classification and summarisation on cheaper models and send only agentic work to Astra.

**How should I sandbox it?**

Least-privilege short-lived credentials, disposable containers per run, default-deny network egress with allowlists, no production credentials within reach, complete audit logs, and human approval gates on irreversible actions. This is a Critical-classified cyber model with a hosted shell.

**What happens if a safety intervention pauses my agent?**

The run stops mid-task. Checkpoint state externally after each step so you can resume rather than restart, make steps idempotent, and handle refusals differently from errors so you don't retry into the same wall.

**Why does my long-running agent stall?**

The documented failure mode is detail absorption — the model keeps working on progressively less important sub-tasks. Add a manager loop that periodically re-grounds against the original objective, and run it on a cheaper model.

**What are the rate limits?**

Tier 1 starts at 500 requests and 500K tokens per minute, rising to 15,000 requests and 40M tokens per minute at Tier 5. For computer-use workloads the token ceiling binds long before the request ceiling.

## Sources