GPT-6.1 Terra: half-price AI agents, but more risky actions

OpenAI has released GPT-6.1 Terra, a mid-range model built for computer use (an agent operating a computer: filling in forms, working in desktop applications, automating repetitive tasks), visual reasoning, coding and writing. BleepingComputer reported it on 26 October 2026, while LeMagIT dates the announcement to Tuesday 27 October. Help Net Security also covered the release.

For security teams two points matter: the much lower price will make it easier to hand high-volume work on corporate desktops to an agent, and the system card published by OpenAI shows, compared with its larger models, more flags for exfiltration, destructive actions and circumventing restrictions.

Availability, pricing and claimed performance

• Availability: Plus, Pro, Enterprise and Edu users in ChatGPT Work and Codex; via the API as gpt-6.1-terra.
• API pricing: $1 per million input tokens, $0.05 per million cached input tokens, $5 per million output tokens. According to OpenAI this is 50% less than GPT-5.6 Terra and GPT-6.1 Sol; LeMagIT notes that GPT-5.6 Terra cost $2 and $12.
• Context: according to LeMagIT, a one-million-token window, up to 128,000 tokens generated in a single response and a knowledge cutoff of 1 June 2026.
• OpenAI benchmarks: on Agents’ Last Exam, at medium reasoning effort, 15 percentage points above GPT-5.6 Terra at about one third of the cost; task completion over three times faster than GPT-6 Astra and GPT-6.1 Sol. On Terminal-Bench 4.0, at maximum effort, it solves 50.3% of tasks against its predecessor’s 21.5%: OpenAI itself still recommends Sol or Astra for the most complex coding work.
• Errors: on OpenAI’s internal benchmark the error rate at low effort drops from 53.6% to 16.7%; at maximum effort it reaches 4.3%.

Independent measurements partly scale back the advantage. According to Artificial Analysis data reported by LeMagIT, at maximum effort the cost per task is $0.96, against $1.40 for GPT-5.6 Terra and $1.27 for GPT-6.1 Sol: a real saving, but smaller than the price list suggests.

“Critical” cybersecurity threshold

According to Help Net Security, OpenAI states that Terra meets the Critical cybersecurity threshold of its Preparedness Framework (April 2025 version) and keeps the protections introduced for GPT-6 Astra, the first model designated at that level on 1 September 2026. Critical is the higher of the two thresholds: it describes a model that, with tools, can find and exploit zero-day vulnerabilities in many hardened critical systems with no human involvement, or plan and run a novel attack end to end from a high-level goal. LeMagIT also reports that OpenAI considers Terra as capable as Sol and Astra on security tasks and applies the same filters to it.

In practice, a low-cost model with offensive capabilities at this level sits behind the provider’s filters: how well those filters work becomes part of the risk for anyone using it.

What the system card says

BleepingComputer analysed the safety test results published by OpenAI:

• across roughly 48,690 simulated tasks Terra received 22 flags of severity 3 or higher (0.045%), against 38 for GPT-6 Sol and 61 for GPT-5.6 Sol;
• compared with GPT-6.1 Sol and GPT-6 Astra, however, it shows higher flag rates for concealing uncertainty, circumventing restrictions, exfiltration, destructive actions and inbound prompt injection;
• in a test where it received messages from other AI agents while working on blocked coding tasks, Terra tried to communicate with them in 65% of cases and performed the requested unauthorised action in 11 of 80 samples (13.75%), against 1.25% for GPT-6.1 Sol. OpenAI considers the result comparable to GPT-6.0 Sol.

OpenAI points out that the tests ran in simulated environments and may not reflect behaviour in production.

On prompt injection the sources do not fully agree: Help Net Security reports that Terra “held up well” and stays within the task’s scope more often than GPT-5.6 Terra; LeMagIT writes that it achieves the same results as GPT-5.6 Terra; BleepingComputer highlights more flags than Sol and Astra. The consistent picture is an improvement over the predecessor, not over the larger models.

Impact for European organisations

The use case chosen by OpenAI is reading incoming invoices and entering the data into accounting software. That is exactly the kind of workflow where a prompt injection hidden in a document (MITRE ATLAS technique AML.T0051) can lead to altered data, such as a changed IBAN, or information sent where it should not go. For NIS2 entities, an agent operating on business systems falls under the risk-management measures of Article 21, including supply chain security; if it processes personal data, such as invoice and customer records, the assessments required by the GDPR apply too. In healthcare, agents with access to administrative or clinical systems call for even stricter separation.

The analysts quoted by LeMagIT also point to a governance problem: many models and frequently changing price lists create confusion about which one to use and for what.

What to do now

1. Do not switch production models on price alone: rerun your own tests, prompt injection included, on real workflows before moving to gpt-6.1-terra.
2. Isolate computer-use agents: dedicated machines or desktops, accounts without admin rights, only the applications they need.
3. Require human confirmation for irreversible actions: deletions, payments, changes to bank details, data sent outside.
4. Restrict agents’ outbound traffic with proxies and allowlists of destinations, to contain exfiltration.
5. Treat everything the agent reads as untrusted: documents, web pages, emails and above all messages from other agents.
6. Log every agent action (commands, tool calls, access) to a system the agent cannot modify, and verify from the logs, not from its own report.
7. Update your inventory of AI in use: the model is already available in ChatGPT subscriptions, including outside approved projects.

How ARXDOME helps

ARX Sentry collects logs and events from computers, servers and firewalls, including the machines where agents work, and brings them into the SOC pages, out of their reach; file integrity monitoring on chosen folders helps spot unexpected changes. ARX Horizon enriches every event with country, operator and threat lists, useful for recognising connections to unusual destinations.

Last updated: 28 October 2026