GPT-6 Astra: what actually changes for SMBs and startups (beyond the hype)

OpenAI has released GPT-6 Astra, described internally as the most capable model ever built and repeatedly delayed precisely because of what it can do. President Greg Brockman called it a “generational leap” towards artificial general intelligence. Announcements like this all sound alike; the question that matters to a business owner is far more concrete: what can I automate on Monday that I couldn't automate last Friday? This article answers that without hype and without alarmism.

What is genuinely new

First, autonomous computer use: Astra doesn't just answer, it browses the web, opens applications, installs software, reads an error on screen and works out what went wrong. Second, async tool calling: the model can start a long operation — a search, a data extraction, waiting for an external system — and keep working on something else instead of idling. Third, stronger execution memory: if it discovers mid-task that a value was wrong, it changes course instead of starting over. Fourth, and most sensitive, cybersecurity: Astra is far better at finding vulnerabilities, which is exactly why OpenAI postponed the launch and put the model through the US government's frontier-system testing. Rollout is gradual: trusted enterprises first, then paying users, then the free tier.

Why those technical lines change the economics

Until now most business AI automation worked like this: the model understands a text, produces an output, a human checks it and clicks. The bottleneck was never the model's intelligence — it was that someone still had to open the ERP, download the file, paste the number into a supplier portal. A model that operates the computer itself removes that step. With asynchronous execution, a process full of waiting — a quote that depends on two supplier replies, a case waiting for a document — can run in the background for hours unattended. In short: these systems move from “assistants” to “colleagues that finish the job”.

What it can actually do in an SMB, today

Quotes: read the customer request by email, pull price lists and availability from internal systems, draft the document and hand it to sales. Accounts payable: read supplier invoices, match them against the order, flag discrepancies and post only the clean ones. Customer service: answer repetitive order and shipping questions by actually querying the ERP, not a FAQ list. Portals and compliance: those tedious flows where a person logs into an external portal, uploads a file and downloads a receipt. Reporting: gather data from several sources, cross-check it and produce the weekly report already commented. In each case the value isn't “the AI writes better” — it's that a person stops doing three hours of manual work a day.

What doesn't change, and deserves saying

A more powerful model does not fix messy processes: if your inventory data is wrong, automation will produce errors faster. It does not remove supervision: anything touching money, contracts or customers needs a human checkpoint, always. And it does not make costs vanish: models at this level cost more per operation, so the right architecture uses the big model where reasoning is needed and smaller ones — often open source and hosted in Europe — for repetitive work. In the projects I run, that mix cuts recurring cost without losing quality.

The security chapter, which concerns you too

If a model is better at finding vulnerabilities, it is better for attackers as well. Expect more credible, more targeted phishing and fraud attempts over the coming months. The countermeasures aren't exotic: two-factor authentication everywhere, phone verification for every bank-details change, least privilege for any AI agent connected to your systems — an agent that reads orders must not be able to delete anything — and full logging of what the AI executes. Turning on autonomous automation without those three controls moves risk around instead of reducing it.

What to do now, in order

One: pick a single measurable process with high volume and low risk — quotes, first-line customer replies, invoice checks. Two: measure what it costs today in hours and delays, or you'll never prove the return. Three: build a pilot in two or three weeks with a human approving every output. Four: scale only once the pilot's numbers hold. The companies that gain an edge over the next twelve months won't be those with the best model — everyone will have it — but those whose processes are ready to receive it.

If you want to work out which process in your company makes sense to automate first with this generation of models, let's talk for 15 minutes: we look at the real workflow, I tell you which price bracket you fall into and, if the return isn't there, I say so straight away.