- OpenAI says GPT-6.1 Terra meets the Critical cybersecurity threshold in its Preparedness Framework. Its standard API prices are 50% below GPT-5.6 Terra's.
- Our argument: cheaper access makes wider use likely, so price is a weaker filter. The announcement does not say what access controls OpenAI applies.
- Before agents touch invoices or accounts, limit what they can reach, read the system card, and test error rates on your own documents.
A cheaper sibling with the same rating
Many leaders assume the price of top-end AI keeps it in fewer hands. That is an assumption, and GPT-6.1 Terra puts pressure on it. OpenAI released the model on October 27. It says Terra meets the Critical threshold for cybersecurity in its Preparedness Framework.
Terra is not OpenAI's strongest model. For the hardest programming work, OpenAI steers buyers to its larger models, Sol and Astra. Even so, it lists Terra at half the standard API rate of both GPT-5.6 Terra and GPT-6.1 Sol. On its Agents' Last Exam benchmark at medium effort, OpenAI reports results level with Astra at a tenth of the cost per token.
Our argument is that a lower price makes wider use likely, so price becomes a weaker filter on who runs the model. The sources say nothing about who is actually adopting Terra. Each new place it runs still needs someone to decide what it may touch.
What OpenAI released
OpenAI describes Terra as a fast model for everyday computer work, from drafting proposals to filling out forms. Customers on the Plus, Pro, Enterprise and Edu plans can use it in ChatGPT Work and Codex. Developers reach it through the API as gpt-6.1-terra.
OpenAI charges $1 per million tokens sent in and $5 per million tokens the model writes. Cached input, which the model has already seen, costs $0.05 per million. A token is a small piece of text, often part of a word. OpenAI's pitch for the lower rate is bulk back-office work, such as pulling details from incoming invoices and keying them into accounting software.
What Critical does and does not tell you
OpenAI's announcement gives no capability detail behind the rating. It does not describe the tests or results. The system card is where that evidence would sit.
Help Net Security summarises the term from the April 2025 version of the framework. Critical is the upper of two cyber tiers. One route to it is a model that can, with tools and no human help, find and weaponise unknown flaws across many hardened systems. The other is a model that, given only a broad objective, can design and carry out a fresh attack on a hardened target from start to finish.
Do not read that definition as a description of Terra. It comes from a 2025 version of the framework, and OpenAI's current criteria may differ. The rating tells you which rules apply, not what the model did in testing.
Help Net Security reports that those rules require safeguards during development, and say work should stop until safeguards fit to that level are defined. OpenAI named Astra its first model at this level on September 1, 2026. It says Terra keeps the protections built for Astra. The announcement does not describe them. We do not know what access controls, if any, gate who can use Terra.
Two different risks
The Critical rating concerns what a model could do offensively, as an attacker's tool. The risk in the next section is different: an agent being manipulated by content it reads. There, Terra is the target, not the attacker.
No source links the two. Our argument connects them only through reach. A model that is cheap to run will sit in more workflows, and each one needs a decision about access. The rating does not tell you that an invoice-reading agent is dangerous.
Why computer use changes the exposure
Terra is built to operate desktop software, not only to answer questions. OpenAI cites OSWorld 2.1, a benchmark in which agents complete multistep jobs in desktop apps. In general, such an agent reads what is on screen or in a document, picks a next step, and issues clicks and keystrokes. It works with whatever access you give it.
Here is the weak spot, in general terms. The task from the user and the content the agent reads reach the model as one stream of text and images. There is no hard wall between data and commands. A line buried in an invoice that says to send payment elsewhere can look like an instruction. That is prompt injection. A model can be good at the task and still be fooled by such a line.
OpenAI says Terra showed strong resistance in its prompt-injection tests. Its evaluations also show Terra sticking to the assigned task more often than its predecessor. The announcement gives no rate for these results; the system card may. A wrong click is no longer a bad paragraph. It can be a wrong entry in the accounts.
The accuracy numbers, with their limits
OpenAI reports large gains on errors. Using prompts it designed to provoke mistakes, it measured Terra at 16.7% wrong at low reasoning effort, against 53.6% for GPT-5.6 Terra. Help Net Security describes that as about one prompt in six. At maximum effort the rate is 4.3%, down 18 percentage points.
On OpenAI's command-line coding test, Terminal-Bench 4.0, Terra at maximum effort succeeds on 50.3% of tasks. GPT-5.6 Terra's published result is 21.5%. Help Net Security notes that leaves 49.7% unsolved. These are OpenAI's own benchmarks. They show direction, not how Terra will behave on your invoices.
Questions to put to your team
Start with access. Which accounts and systems would an agent like this log into? Could each login be limited to the one job it does? An invoice-reading agent has no need to reach payroll.
Next, evidence. Ask your vendor or security lead for the system card. Ask for prompt-injection tests that match your own documents and inboxes. Run an error-rate test on real work before the agent handles anything tied to money.
Last, inventory. If low prices make it easy to start agents, teams may start them without asking. Someone should keep a list of what is running, what it can reach, and who reviews its output.
A cheaper model is easier to start using. Someone still has to decide what it may touch.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: OpenAI.
