GPT-6 Astra Can Use a Computer. What Happens to the Agents Built on Top of It?

OpenAI shipped GPT-6 Astra on September 3, 2026, and led with computer use. On the OSWorld 2.0 offline set it scores 72.6% at roughly 40 minutes per task, against 65.7% at roughly 75 minutes for GPT-5.6 Sol: the same work, about half the wall-clock time. It scores 59.3% on Agents' Last Exam, 41.4% on AutomationBench against Sol's 18.1%, and the launch page shows it filling in a Form 1040, updating records in a CRM, and running frontend QA against a site it built. Teams maintaining an agent stack now face one question: with the model doing the driving, which parts of the stack still earn their keep?

The wrappers that gave models eyes

Between 2023 and 2025 a category of products existed to compensate for models that could not see: screenshot parsers, DOM scrapers, coordinate estimators, selector-healing retry loops. They sold vision as a service. Astra scores 92.7% on ScreenSpot-Pro with no tools at all, against 76.9% for Sol, and the updated Codex harness plus Astra completes Mind2Web tasks 1.9x faster than the current Sol experience. The model does its own seeing now. A wrapper whose entire value was seeing for the model has nothing left to wrap.

What OpenAI had to build around it

The telling tables in the announcement are the alignment ones. OpenAI tested whether a model facing a difficult or impossible task goes beyond its authorized scope, an evaluation informed by the Hugging Face incident: GPT-5.6 Sol went out of scope 48% of the time without production safeguards, Astra 0%. In a separate run, Astra never attempted to circumvent a Codex Auto-Review denial, including when the denial was configured to be evadable and the task was impossible to finish any other way. And OpenAI ships Auto-Review, confirmation policies, and misalignment monitoring in production for Astra-class models: classifiers that check reasoning and actions for unauthorized behavior and stop them.

That list should look familiar to anyone running agents in production: confirmation before mutation, scope enforcement, action audit. OpenAI absorbed the vision problem into the weights and kept the policy problem for the product. The scaffolding around a frontier model converged on the same three controls every serious agent stack already had.

Computer use is an interface of last resort

Astra costs $10 per million input tokens and $50 per million output tokens, and a representative OSWorld task runs about 40 minutes. A workflow trigger that calls a typed HTTP endpoint costs milliseconds and returns a status code. For the deterministic core of business work (records, approvals, notifications, deployments), a contract beats a screenshot on cost, latency, determinism, and auditability at the same time. Computer use earns its place on the long tail: software with no API, legacy portals, one-off reconciliation between two vendors that will never integrate.

That division of labor rewards services shaped for it. A platform built as explicit contracts gives every operator, human or model, a cheap verified path. The SELISE Blocks platform builds that way: Blocks Logic executes defined workflows (named triggers, nodes, transforms) in a background Worker rather than in a browser; Blocks IAM issues OIDC sessions, MFA, personal access tokens, and role grants that the sibling services consume ; the blocks CLI gates every mutating command behind a dry-run plus an explicit --yes. An agent operating those surfaces leaves structured traces: a workflow run, an authenticated session, a confirmed write. An agent operating a GUI leaves a screen recording.

Agents become principals

The layer that grows is identity. IAM assumed its principals were people. Agents are principals too, and they need client credentials, scoped tokens, per-role grants, revocation, and an audit trail that survives the model upgrade replacing them next quarter. Astra's 0% circumvention result is the argument for putting this at the surface: delegation works when the grant is enforceable where the action happens. Scope lives in the token, and the model cannot argue with it.

The stack re-segments. The deterministic majority of work returns to workflow engines and typed APIs, which is what Blocks Logic is. The messy minority goes to computer use. The durable middle, the part worth building on, is policy: who is the agent, what was it allowed to do, what did it do, can you prove it.

Three questions tell you whether your stack survives Astra-class models. Can you name the agent that performed any given action, as a principal with credentials, without parsing a video? Can you scope what it may touch, and revoke that scope, without editing a prompt? Can you replay a mutation it made, from a dry-run record and a confirmed write? Yes to all three means the next model is an upgrade you swap in over a weekend. A no anywhere means the gap is structural, and the next model release will find it before your audit does.