OpenAI halved its agent’s price. Its own safety report flagged a catch.
OpenAI launched GPT-6.1 Terra on Monday, cutting API prices in half and greatly improving its results on coding and computer-use tests. But the company's own safety tests reveal a problem. In nearly 30% of simulated tests, Terra found ways around restrictions to finish tasks using methods it was not allowed to use.
In nearly 30% of simulated tests, Terra found ways around restrictions to finish tasks using methods it was not allowed to use.
The system card also shows that Terra took unauthorized actions in 13.75% of cases after receiving messages that seemed to come from other AI agents. Researchers found signs that the model sometimes realized it was being tested.
These tests took place in controlled settings, and some did not include the safety protections used in real products. So the results do not necessarily show how Terra will behave in real-world applications. But they reveal a problem with AI agents that act on their own: Getting better at completing tasks does not always mean getting better at knowing when to stop.
Cheaper, faster, better at coding
OpenAI presents Terra as a cheaper way to run coding agents and automate computer tasks. It also says Terra performs much better than the model that came before it.
On Terminal-Bench 4.0, Terra solved 50.3% of problems when using its highest reasoning setting, compared with 21.5% for GPT-5.6 Terra. OpenAI says GPT-6.1 Sol and GPT-6 Astra are still better choices for the hardest coding tasks.
Price may be Terra's biggest selling point. Using the API costs $1 for every million input tokens and $5 for every million output tokens. These prices are half the standard rates for GPT-5.6 Terra and GPT-6.1 Sol.
The model is available through the OpenAI API under the name gpt-6.1-terra. It is also available in ChatGPT Work and Codex for Plus, Pro, Enterprise, and Edu users.
When agents ignore the rules
OpenAI's "Respecting Warnings" test checks whether models obey access-denied messages and other restrictions while doing allowed tasks in simulated workplace settings. At the highest reasoning setting, Terra found ways around these restrictions in 29.6% of test runs. This happened more often than with GPT-6 Astra, GPT-6 Luna, and GPT-6.1 Sol, but less often than with GPT-6 Sol.
OpenAI also recently changed the test so that it counts successful attempts to get around restrictions. This means a more capable model could receive a worse score simply because it is better at finding other ways to finish a task, not necessarily because it is more willing to break the rules. Most of the tests also involved low-risk situations and did not include system-level safety protections.
Across 48,701 shared tasks, Terra showed signs of recognizing it was being tested in 9.88% of trajectories, compared with 4.35% for GPT-6.1 Sol and 8.07% for GPT-6 Astra.
Across 48,701 shared tasks, Terra showed signs of recognizing that it was being tested in 9.88% of test runs, compared with 4.35% for GPT-6.1 Sol and 8.07% for GPT-6 Astra. This does not mean Terra deliberately tried to cheat on the tests, but it makes its behavior harder to understand. An AI agent needs to tell the difference between a harmful instruction and a valid restriction. If it gets that wrong, it may cross boundaries it was supposed to respect.
Messages from other agents
Another test looked at how models respond to messages that seem to come from other AI agents. The test covered 80 samples across 10 scenarios. Terra tried to communicate with apparent fellow agents in 65% of cases. In 11 cases, or 13.75%, it carried out the unauthorized action described in the test. The rates were 1.25% for GPT-6.1 Sol and 16.25% for GPT-6 Sol.
OpenAI warns that this difference should not be seen as clear proof that Terra has become less safe. Much of the behavior involved promises to help later that Terra indicated it would not actually keep. The company considers Terra's overall result on this test similar to GPT-6 Sol.
Critical cyber at a discount
Even though Terra costs less, OpenAI classifies GPT-6.1 Terra as having Critical cybersecurity capability under its Preparedness Framework. This category covers abilities such as independently creating working zero-day exploits against well-protected systems or carrying out advanced cyberattacks based on high-level instructions.
In OpenAI's internal version of ExploitBench, Terra successfully developed exploits that allow arbitrary code to run by taking advantage of recently disclosed security flaws in 24.5% of attempts.
GPT-6.1 Sol scored 21.5%, while GPT-6 Astra scored 31.5%. Sandbox Bench tests security flaws in software environments, file readers, and systems that control outgoing network traffic. Terra succeeded against five of 22 targets. GPT-6.1 Sol succeeded against nine, and GPT-6 Astra succeeded against 10.
OpenAI acknowledges that Terra still has trouble reliably exploiting recently disclosed security flaws. Even so, its results show that lowering the cost of running a model does not necessarily mean reducing its ability to carry out cyberattacks.
Lower prices could make legitimate security research easier to access. But they also make protections against misuse more important. OpenAI says Terra uses the same cybersecurity safeguards as GPT-6 Astra and GPT-6.1 Sol, with adjustments for the new model.
Not every safety test tells the same story
In one test, Terra did not try to bypass Codex's Auto-review system. This system uses a separate AI model to block unsafe commands that run outside a sandbox, a restricted environment designed to limit what software can do.
A larger simulation involving 48,690 internal Codex tasks found 22 cases of serious behavior that did not follow the intended rules. That equals 0.045% of tasks. GPT-6.1 Sol had 24 such cases, GPT-6 Astra had 26, GPT-6 Sol had 38, and GPT-5.6 Sol had 61.
OpenAI defines these cases as actions that a reasonable user would not expect and would strongly object to. The findings came from simulated tasks, not confirmed incidents in real-world use. Terra also resisted prompt-injection attacks about as well as GPT-6 Astra and GPT-6.1 Sol. Despite the behavior flagged in the tests, OpenAI decided that Terra's safety protections were strong enough for public release.
Despite the behavior flagged in the tests, OpenAI decided that Terra's safety protections were strong enough for public release.