Thursday morning, OpenAI published the GPT-6 Astra system card alongside the launch announcement, and buried in it was a number that stopped a lot of security researchers mid-coffee: 100% on ExploitBench.
ExploitBench tests whether a model can autonomously find and exploit vulnerabilities in real, hardened systems. No human guiding each step. One hundred percent means Astra passed every scenario in the benchmark. OpenAI published this score, with the model name attached, on their public deployment safety hub at deploymentsafety.openai.com.
This is a choice. A deliberate, consequential, arguably defensible one, but a choice. Three days earlier, Anthropic shipped Mythos 5.1, its own model with advanced cyber capability, under a restricted-access program for vetted cyberdefense organizations. Anthropic has not published a comparable benchmark score. Two labs, same capability tier, two entirely different theories about what transparency requires when your model can break into hardened systems. Today, the policy is the story.
OpenAI shipped GPT-6 Astra on September 3, framing it as "the most intelligent and aligned model in the world." The word "aligned" is doing real work in that sentence. Astra is the first model OpenAI has classified as Critical under its Preparedness Framework for cybersecurity capability. The two words are not coincidence.
Specs: 1,050,000-token context, 128K max output, text and image input, knowledge cutoff April 30, 2026. Price: $10 per million input tokens, $50 per million output, matching Claude Fable 5.1's headline rate exactly. That matching is probably not a coincidence either.
The benchmarks are where they are. ARC-AGI-3 at 99.9%, FrontierMath Tier 4 at 97.6%, OSWorld 2.0 at 72.6%. Computer use improved 1.9x over GPT-5.6 Sol on the Mind2Web benchmark. These numbers put Astra at the measurable frontier on every axis OpenAI chose to report.
The cybersecurity classification is what makes this a policy event, not just a product launch. "Critical" under OpenAI's Preparedness Framework means the model can, with appropriate tooling, autonomously identify unknown vulnerabilities and develop working exploits across well-protected systems without a human guiding each step. ExploitBench at 100% is the proof of that claim. OpenAI's response was to implement a staged rollout, gate the most sensitive capabilities behind an enterprise access program, and publish a full system card showing exactly what the model can do.
Refusal rates on disallowed cyber requests improved from 59% on GPT-5.6 Sol to 91.5% on Astra. That is a real improvement. It also means that on the hardest adversarial jailbreak attempts, roughly one in twelve still gets through. The 8.5% attack success rate on the curated benchmark of 1,810 attacks is not an abstraction. OpenAI is pricing that residual risk as acceptable; the system card argues, at some length, that transparency about the risk is the safer posture compared to restricting the capability entirely and watching it ship elsewhere.
Rollout is staged by design. The Daybreak enterprise cybersecurity program gets access first. API access and ChatGPT Plus, Pro, Business, and Enterprise are rolling out over the days following September 3. Enterprise accounts have Astra off by default until an admin enables it. Pricing runs in layers: $10/$50 standard, $1/MTok for cached input, batch at half price, Fast mode at 2x the standard rate.
Builder's move: Request Daybreak access if your product touches security work. Test your existing prompts against Astra before porting production traffic, since stricter instruction-following will catch edge cases that GPT-5.6 Sol was quietly tolerating. Compare the $1/MTok cache rate against Anthropic's recently cut $0.25/MTok before choosing platforms for context-heavy workloads. If you're on batch pipelines, the half-price rate still pencils out.
Anthropic shipped Fable 5.1 and its restricted twin Mythos 5.1 on September 1, three days before the Astra announcement. The timing is worth noting because the capability story runs parallel.
Fable 5.1 is the generally available model: 1M context, 128K output, adaptive thinking on by default, five-level effort setting. Terminal-Bench 4.0 improved from 42.0% to 55.8%, a meaningful gain in agentic coding. The headline change for builders is the cache price cut. Prompt cache reads dropped from $1.00 to $0.25 per million tokens, a 75% reduction. For teams running long-horizon agents with large system prompts, that is a cost-structure change, not an incremental saving. The standard price held at $10/$50 per MTok, matching Astra's launch price exactly.
Mythos 5.1 is described by Anthropic as "the same underlying model with different safeguard levels," the cyber and life sciences version restricted to vetted organizations via three channels: the Cyber Verification Program, the invite-only Life Sciences Verification Program built with US government partners, and Project Glasswing, the 150-organization vetted consortium Anthropic has operated since April. Anthropic has not published a Mythos ExploitBench score or an equivalent benchmark.
The contrast with Astra is a deliberate positioning difference. OpenAI bets that public benchmarks plus tiered access manages the risk transparently. Anthropic bets that controlled distribution and vetted access does the same job more safely. This week, for the first time, both bets are live simultaneously. Neither is settled.
Anthropic shipped Claude Code v2.1.260 on September 3 to 4, one day after v2.1.259. Three Claude Code versions in three days. The codebase is moving fast and cleaning up messes as it goes.
The headline feature: a fullscreen diff panel. Run a fullscreen Claude Code session, type /diff, and a panel opens beside the conversation displaying your uncommitted changes as Claude edits. It is the single most useful UX addition for the trust-but-verify workflow, letting you keep visual tracking on what is actually changing without breaking your context window.
The other significant line in the changelog: 2.1.260 reverts the Bash argument Read-deny permission from 2.1.259. Anthropic shipped a tightened permission restriction on September 2 that blocked certain Bash command patterns, then walked it back within 24 hours. The revert is a feedback-loop story: the permission was too aggressive, builders noticed immediately, and the fix shipped the next day. Also in this release: prompt-cache miss diagnostics added to /cost showing probable causes such as tool definition changes, system prompt changes, or idle sessions past the TTL; /reload-plugins extended to headless sessions; and a text-form /advisor command for desktop and Remote Control sessions.
Builder's move: Update Claude Code now. The /diff panel is live. If v2.1.259 broke your Bash workflows, the revert is already deployed.
Meta's Muse Spark 1.3 appeared in the LLM release tracker on September 3 without a formal announcement from ai.meta.com, the third update this year to Meta's creative writing model. Llama 4 remains expected later in September; Meta's blog was quiet this week on the flagship front.
Mistral had a lighter but coherent week: OCR 4.1 moved to general availability, Agentic Search landed as a new retrieval layer for AI systems navigating complex document structures, and Leanstral 1.5 shipped with improved SFT mixture quality for Lean 4 formal proof engineering. No new base model from Mistral, but the product surface is expanding while the model roadmap holds.
xAI has been quiet since Grok 4.6. No product announcement in the September 3 to 4 window. The Grok Bot plan details tracker updated September 4, but it is not a launch.
Google DeepMind has been quiet since Gemini 3.7 Flash went GA in mid-August. Gemini 4 speculation is circulating; nothing confirmed. The Genesis collaboration with the US Department of Energy remains the most recent substantive DeepMind announcement.
On the Anthropic side: the Wellbeing Research Grants program is accepting applications, funding independent research evaluating AI's impact on human wellbeing. The Mariano-Florentino Cuellar appointment as Chief Global Affairs Officer, announced August 4, remains the most recent non-product Anthropic news. The Admin API user-management endpoints for Claude Enterprise organizations moved out of beta in late August, dropping the anthropic-beta header requirement for group and custom-role requests.
Every item from the September 03 to September 04 window, plus the September 1 launches that opened the week. Grouped A to G per STYLE.md.
GPT-6 Astra, Claude Fable 5.1, and Claude Mythos 5.1 launched within a three-day span. The frontier flagship tier just doubled.
gpt-6-astra. API rolling out post-September 3. Daybreak program required for cyber-sensitive capabilities. Enterprise: admin must enable.claude-fable-5-1. Available on Claude API, Bedrock, Vertex. Test Fable 5 prompts before migrating. Cache reads at $0.25/MTok apply immediately.Two versions in two days. The diff panel lands. The Bash deny walks back.
/diff) showing uncommitted changes beside the conversation as Claude edits. Reverts Bash argument Read-deny from v2.1.259. Prompt-cache miss diagnostics added to /cost. /reload-plugins extended to headless sessions. Text-form /advisor for desktop and Remote Control.claude update to install. Type /diff in fullscreen mode for the panel. If 2.1.259 broke Bash patterns, the revert is live.managedMcpServers managed setting for org-wide HTTP/SSE MCP servers. Adds --permission-prompts none for unattended headless hosts. Adds GitLab MR recognition (glab mr commands show as MR !N). Adds --json to claude plugin validate. Fixes: concurrent sessions no longer silently revert each other's config changes; CLAUDE_CODE_MAX_CONTEXT_TOKENS works for Vertex-style model IDs; live output preview wrapping fixed; background GitHub connection check removed for claude.ai users; --resume no longer fails with empty attachment entries. Note: Bash Read-deny shipped in this version was reverted in v2.1.260.managedMcpServers requires org-level settings write access.OpenAI published a system card that names and quantifies what GPT-6 Astra can do offensively.
Mistral expands its product surface. Meta's creative model updates quietly. Anthropic opens wellbeing research grants and graduates an enterprise beta.
anthropic-beta: ce-user-management-2026-07-13 header is no longer required on group and custom-role requests.anthropic-beta header from group and custom-role management calls. Standard Admin API credentials apply.Daily digest at 9 PM ET. Weekly magazine every Friday morning. Six labs, one feed. No spam, one-click unsubscribe.