Astra bills at long-context rates once a request passes 30 percent of its input window

Cache pricing is where an operator loop gets designed. A cached read costs $1 per million tokens against $10 standard, and a cache write costs $12.50 ^[5]. The write premium is $2.50 per million and each read saves $9, so one read pays the premium back about three and a half times over ^[1]. An agent that re-reads the same repo tree and the same shell transcript on every turn should write that prefix once and read it for the rest of the session.

Output is billed five times input, $50 against $10 per million ^[5][4]. A model that produces documents, spreadsheets and file edits works on the expensive side of that ratio ^[2]. The dev.to post does not publish the long-context rates that apply above 272,000 input tokens ^[18].

The computer-use numbers are claims about OpenAI's setup. Astra scores 72.6 percent on OSWorld 2.0, and OpenAI reports roughly 47 percent less simulated task time than GPT-5.6 Sol on the compared setting ^[3][6]. For the time saving to transfer, your desktop tasks have to look like OSWorld's, and simulated task time has to track what you are billed for. The success rate travels worse: 72.6 percent leaves about 27 tasks in 100 unfinished ^[5], and an operator fails inside a workspace with a shell open.

I did not expect the post to argue against its own headline chart. It says the 100 percent ExploitBench score uses known V8 vulnerabilities and may be contaminated, and points instead to recent-vulnerability tests and supervised work against hardened targets ^[8]. A benchmark built on known V8 bugs largely measures how much of V8's bug history was in training. The stronger evidence it cites is the expert-led evaluation, where Astra found unknown vulnerabilities and built working exploit chains against hardened browser and operating-system targets ^[15]. On coding, Astra leads Terminal-Bench 4.0 at 57.9 percent while OpenAI's own tables put other models ahead on some coding and general-intelligence indices ^[7].

Gray Swan's indirect prompt injection evaluation ran 1,810 attacks, and the estimated chance of at least one successful attack in 15 attempts was 8.5 percent ^[13]. I would take that number into a design review. Treating attempts as independent, that is about 0.6 percent per attempt, and 100 attempts reaches roughly 45 percent ^[6]. IPI Arena is adversarial, so that rate comes from attackers who are actively trying.

Deployed Astra ships behind refusals, classifiers, misalignment monitoring, Auto-review, a confirmation policy, account enforcement and trusted-access programs, according to the post ^[12]. Its conclusion is that a deployment like this needs its own identity, workspace, permissions, network boundary and incident trail ^[16]. The spec supports the shape of that argument: something that runs shell commands and calls MCP servers on your behalf is a principal in your systems, and every access grant has to name which one. All of these figures come from one dev.to writeup summarising OpenAI's system card and pricing without reproducing them ^[17].