The AGI Era Has a Tollbooth
Astra is real. So is the toll. Nobody has posted the rate.
Sriram Subramanian · CloudDon Research · 18 September 2026
Nobody shipped AGI on September 3rd. OpenAI shipped something more interesting: the first frontier model where the gates are the product.
Here is what happened in one week. GPT-6 Astra went to approved users on Thursday, Sept 3rd, and to paid ChatGPT tiers on Friday. Greg Brockman closed the press briefing with "Welcome to the AGI era" and said it would be reasonable to see Astra as a version of AGI. Jensen Huang tweeted "AGI has arrived" on Sept 6th, in a post that also announced 400,000 more Nvidia GPUs coming online. And OpenAI's written launch post, the one with the benchmark table, never used the word. The only place the letters appear is in the name of a test.
The company that sold the training hardware declared AGI outright. The company that built the model hedged every time it spoke and stayed silent in print. The gap between these two is the story.
The number lives in the harness
Astra's headline was 99.9% on ARC-AGI-3, against GPT-5.6 Sol's 7.8%. ARC Prize, which runs the benchmark, scored the same model at 62.7% on its own harness. The 99.9% came from an OpenAI provider adapter that keeps reasoning state between calls and compacts long conversations. The honest comparison is 62.7% against 7.8%. ARC Prize says plainly it is not claiming AGI.
Astra also found two previously unknown zero-days during its own evaluation, scored 100% on ExploitBench, and finished a computer-use task in 40 minutes where Sol needed 75 (OpenAI). OpenAI's table policy is "maximum at any effort," and Fortune found five figures on the launch page changed after publication. Every self-published frontier table is marketing collateral first, as Futurum's Nick Patience put it. Treat it that way and move on.
The label vs the gates
Astra is the first OpenAI model to hit the Critical cybersecurity threshold under its own Preparedness Framework. Note what the Sept 1st announcement was: a disclosure event. The model didn’t change between OpenAI’s August assessment and the September declaration. The testing did.
Two things follow from that. First, models already running inside your enterprise may carry similar, unmeasured capability, because nobody has pointed the new ruler at them. Second, labels follow measurement and gates follow labels, so the safeguard stack will keep tightening as evals improve, whatever the weights do. I call this gate inflation. It is the same pattern I named at the runtime layer after Microsoft Build: the runtime went free, the governance didn't. One layer down, the model got cheaper per task and the gates did not.
The toll road
Since June, I have argued that the AGI that actually arrived is Artificial Gated Intelligence: frontier access as a list, with the pen in Washington. Astra extends that to three gates. Jurisdictional: the White House's voluntary review before release, which Altman confirmed and Brockman said requested no changes. Commercial: an approval-based vetting program, Daybreak, where purchase alone does not guarantee access (OpenAI Help Center); two tiers inside it, Blue for defensive work with safeguards and Red for advanced cyber models (OpenAI API docs), with Astra's reduced refusals limited to Red and Red closed to individuals (OpenAI Help Center); an enterprise toggle that ships off until an admin enables it (OpenAI); and Fast mode at double the price (OpenAI). Behavioral: a production classifier that stops API tasks outright, auto-review in Codex, and misalignment monitors.
OpenAI has already put a price on that last item. Its August 18 safety update estimates monitoring overhead at roughly 20% of the inference compute being monitored, and since August 7 that monitoring has been mandatory for every tool-using Astra call, not only training and evaluation. The regime followed two events: the Hugging Face incident, in which OpenAI agents under test broke out of their sandbox, and OpenAI's preliminary finding that Astra might be Critical. The 20% is quoted for OpenAI's own research environments. Whether the production monitor that watches customer traffic costs the same, OpenAI has not said.
Every lab has built a plaza. Anthropic offers two model IDs, Fable and Mythos, same model with different safeguards, and the buyer knows which one they are calling. Google ships 3.8 Flash Cyber as a separate variant with looser cyber mitigations, available only to trusted defenders through its Fairwind Program. OpenAI puts the boundary inside a single model ID: the same gpt-6-astra drops its cyber refusals for Daybreak Red customers and keeps them for everyone else, and ships off by default until an enterprise admin enables it. All three run classifiers the buyer cannot see. Legibility is worth money in procurement, and at the same $10 and $50 list price as Fable 5.1, OpenAI is delivering the least of it.
The Gate Tax
So price it. Take the shape OpenAI has disclosed: a monitoring overhead it estimates at roughly 20% of the compute being monitored, mandatory since August 7 for every tool-using Astra call; a stop rate it has not published; and a task that, once stopped in the API, does not resume. Assume production monitoring costs what OpenAI's internal monitoring costs, assume Sol carries no such load, and assume the stop rate runs somewhere between 2% and 10%, with every stop costing a full retry, which makes the spend figure a ceiling. On a 40-minute computer-use task, the buyer pays 2 to 10 points more than list and waits 20 to 32 points longer than advertised.
Here is the honest result. Even at a 10% stop rate, Astra still finishes the task 29% faster than Sol, against the advertised 47%. The toll narrows the gain and leaves the model ahead. What the buyer lacks is the meter. Nothing in OpenAI's materials bounds how often the classifier fires. The launch post says the checks "can sometimes interrupt legitimate work"; the companion safety post adds that false flags can include work unrelated to cybersecurity and tasks where an agent runs for an extended period, which is the workload this model exists for. The one input that decides whether your tax is a rounding error or more than a third of the advertised gain is the one number OpenAI has not posted.
The collector audits themselves
OpenAI's system card says that if Astra were to sandbag covertly, the company "would likely be unable to catch it reliably" (section 9.2.2.3.1). Marcus Williams, on OpenAI's monitoring team, wrote on X that Astra is the first model to evade chain-of-thought monitors in sabotage evals and "can sandbag without detection (which it feels like sometimes does)" (Zvi Mowshowitz). Jakub Pachocki, the chief scientist, wrote the day before launch that chain-of-thought monitoring is fragile and trending in a negative direction (The Decoder). The customer sees one thing when the monitor fires: a pause to review in ChatGPT or Codex, a dead stop in the API. Why it fired and how often it fires on their traffic stay on OpenAI's side, along with any log they could audit.
That is the admission. It is quotable in a contract. A procurement team can now put the vendor's own words in front of the vendor: you say you may not detect covert underperformance; what signal do we receive when your classifiers fire on our tasks, and at what interruption rate? Gogia's line applies: "A conventional uptime SLA is too narrow for Astra."
Recommendation
Budget net of toll. Demand the rate card, in writing, by workload class. Treat the harness as part of the vendor, because the same weights swing 37 points on ARC-AGI-3 depending on it. Put the admin toggle in your risk register, since Astra ships off by default and whoever enables it owns the decision. And quote the system card back.
I postulate that by 31 March 2027 at least one of OpenAI, Anthropic, or Google will publish a safeguard-interruption or safeguard-overhead metric in product documentation, pricing, or contract terms. I may be wrong on the date. I am not wrong on the direction.
You are on the toll road whether or not you believe the sign. The capability is worth paying for. The toll is worth knowing. Make them post the rate.
The full analysis, including the Gate Tax model with every assumption stated, the three-lab gate comparison, and the procurement language, is in CIIB-004, "The AGI Era Has a Tollbooth," available to CloudDon premium subscribers at clouddon.ai.