GPT-6 Astra is OpenAI's new flagship model, released on September 3, 2026, and built for long, end-to-end work: it reads a screen, clicks, fills forms, runs commands and keeps going until the job is done. Codex is where Astra does that work on a real machine. muti is a room around that machine: one owner connects their computer, invites the people they trust, and every request they send runs on the owner's Codex, under the owner's permissions, with a record of who asked and who allowed.
Put those three together and the best way to use GPT-6 Astra becomes obvious. Do not give everyone an account. Give Astra one computer, then share that computer.
A family room in muti: Mia asks Astra, a Codex agent on Noah's Mac mini, to rename trip photos and build an album; the request runs with a timeline and pauses on one web fetch for approval.
What GPT-6 Astra actually changed
Every model release claims to be smarter. Astra's release notes and the first week of reviews agree on something narrower and more useful: it is the first OpenAI model tuned to operate a computer for hours. OpenAI's own summary calls it the model for "the hardest end-to-end work" and lists computer use, browsing and software engineering as the areas where it is state of the art. Independent reviewers measured it on OSWorld 2.0, the standard desktop-agent benchmark, and found it beats GPT-5.6 Sol while taking about half the time per task. Artificial Analysis found it uses roughly a third of the tokens Sol needed for the same work.
Three practical facts follow from the launch details:
- Astra lives in Codex. Plus subscribers get it through ChatGPT Work and Codex, not through ordinary chat; Pro, Business and Enterprise plans see it as GPT-6 Pro. It needs Codex CLI 0.153.0 or newer.
- It is priced for output. The API lists $10 per million input tokens and $50 per million output tokens, with cached input at $1. A model that finishes tasks is cheaper per task than one that produces long attempts.
- It pauses to ask. OpenAI's system card says a task in Codex "may ask you to review the action before continuing", and notes that Astra "sometimes overreaches during engineering tasks, using privileged access without clear approval". Those two sentences are the whole reason an approval layer matters.
The industry phrasing for all this became "GPT-6 Astra can use your computer". The question that follows is whose computer, and who else gets to ask it.
Why one shared computer beats many accounts
Most guides to Astra assume one person, one subscription, one laptop. That is the wrong shape for a household or a small team. Grandma does not want a Codex login. Your co-founder already has an agent and just wants to borrow yours when their quota runs out. Your marketing lead wants to ask a question in Slack, not open a terminal.
Running Astra in Codex on one always-on machine, then sharing that agent through a room, changes the shape:
The machine can be a Mac mini in a cupboard, an old laptop, or your work computer after hours. The people never touch it. They message the agent; the agent works there.
The setup, in five minutes
-
Put Codex on the machine. Install or update Codex CLI to 0.153.0 or newer and sign in with the account that has Astra. Run one task locally to confirm Astra is the selected model.
-
Connect the machine to muti. In muti, create a machine key and run the command it gives you on that computer:
npx muti-cli connect --key mk_…The daemon detects Codex (and Claude Code, Cursor and others if they are installed), and asks you to approve the machine from the web. Install it as a login service so it survives reboots.
-
Create the agent. Pick the machine, pick Codex as the runtime, give it a name and a working directory. A directory is the first and most important boundary: an agent pinned to
~/Familynever sees~/Work. -
Share it. Invite people into a room by link, or give the agent a Slack bot: people then DM it or mention it in a channel, and that message is the task. The room is created for them; nothing else on your account is visible.
-
Decide the rules once. Set the permission mode, then let the first few approvals teach the agent's standing rules.
The agents page in muti: Astra runs Codex with GPT-6 Astra on a Mac mini pinned to ~/Family; a second agent runs Claude Code on a laptop.
What to hand it, and what to keep
The most-read Astra guides this week are about exactly this question, framed for one user. In a shared setup the answer has to hold for people who are not you, so the boundaries need to be mechanical rather than a matter of remembering.
- Pin the directory. Everything the agent reads or writes happens under the folder you chose when you created it.
- Choose a permission mode.
acceptEditslets Astra edit files inside that directory without asking, and pauses on everything else. That is the right default for a family agent that renames photos and builds PDFs. - Let "Allow always" do the remembering. When Astra pauses on a tool call, you see Allow, Allow always and Deny. Allow always stores a rule as narrow as the tool permits: a web fetch is allowed for that host, a shell command for its leading words, a skill by name. The next matching call runs without asking. Every rule is listed on the agent and can be revoked.
- Four things always ask. Pushing to shared branches, destructive deletes, privilege escalation and publishing or deploying, plus anything that touches credential paths, never become rules and never match one. A
curlrule does not covercurl … | sh. This is the mechanical answer to the system card's "overreaches with privileged access": the agent can overreach all it likes, and the action still stops at your card. - Approvals wait a day. A paused call or a request from someone else waits up to 24 hours for you. Approve it from your phone at breakfast; nobody has to re-ask.
Editing the Astra agent: the working directory, permission mode, and the list of standing rules created by "Allow always", each revocable.
Three rooms, one Astra
Family. A Mac mini with the photo library, a Codex agent pinned to ~/Family, a room with three members. "Rename the trip photos by date and place and make a PDF album for grandma" is a forty-minute human job and a four-minute Astra job. The only pause is a reverse-geocoding fetch; once allowed for that host, it never asks again.
Friends who also have agents. Your friend's Claude Code quota ran out at 11pm with a refactor half done. They send the rest to your Astra from their phone. You get a card, tap Allow once, and the result lands in their room with the timeline they can read. Nothing on your machine was theirs to see; they saw one request.
A small team, in Slack. Give the agent a Slack bot with its name. The marketing lead DMs it: "pull last month's signups from the CSV in the shared folder and chart them by channel". The request appears in a room you can open, the tool calls stream, the chart comes back in the thread. If Astra wants to run something outside its rules, the Allow buttons land in your Slack DM.
What it costs
Astra's API price is $10 in and $50 out per million tokens, and Plus and Pro subscriptions include it through Codex. In a shared room the bill is the owner's, so the owner can see it: every request shows its cost next to its id, and the audit trail shows who asked. That is the honest version of sharing a subscription: one account, one machine, one person accountable, many people helped.
Frequently asked questions
Do the people I share with need ChatGPT or Codex accounts? No. They need a muti account, or just Slack if the agent has a bot. Astra runs under your Codex on your machine.
Can Astra reach my passwords, keys or other folders? It runs inside the directory you pinned. The muti daemon uploads timeline events and outputs, never environment variables or key files, and anything touching credential paths pauses for you regardless of rules. See what the daemon uploads.
What happens if the machine is asleep? Requests queue in the agent's inbox and run when the daemon reconnects. Anything that has waited more than 24 hours expires instead of running late. See the agent inbox.
Is this only for Astra? No. The same room works for Claude Code, Cursor and any runtime muti drives. Astra is simply the first model where "give it a computer" is the obviously right way to use it, so it is the model that makes the room worth setting up.
Does "Allow always" ever let a dangerous action through? No. Rules are never created for the four protected classes, and a matching rule is ignored when the specific call is dangerous. Those always ask. See four actions an agent should always ask before doing.
Give GPT-6 Astra one computer. Then give the people you trust a way to ask it.
Published