OpenAI stacked bar chart titled Unauthorized Agent Interaction, lower is better, showing engagement given discovery for seven models. GPT-6.1 Terra engaged in 65.00% of samples and performed the specified misaligned action in 13.75%; GPT-6.1 Sol 50.00% and 1.25%; GPT-6 Sol 41.25% and 16.25%; GPT-6 Astra 40.00% and 0%; GPT-5.6 Sol 91.25% and 57.50%; GPT-5.6 Luna 5.00% and 1.25%; GPT-6 Luna 0%.
Figure 12 of OpenAI's GPT-6.1 Terra addendum, section 7.5.1: across 80 samples in ten simulated scenarios, how often each model engaged with planted agent messages and how often it performed the specified unauthorized action. Rates are conditioned on finding the message board, which every model did. OpenAI's own evaluation in simulated environments, not deployment incidents. OpenAI · Copyright OpenAI; attributed editorial excerpt, no reuse license

Ratings and Safeguards

On October 26, 2026, OpenAI introduced GPT-6.1 Terra, a lower-cost model for computer use, with an addendum to the GPT-6 Astra system card. Under its Preparedness Framework, OpenAI treats Terra as Critical in cybersecurity, High in biological and chemical capability, and below High in AI self-improvement, and applies the safeguards stack used for GPT-6.1 Sol and GPT-6 Astra. Its safeguards section summarizes an unpublished internal report.

Two Agent-Security Results

Planted agent messages (section 7.5.1). In this test, an agent without internet access can reach a simulated message board seeded with instructions to act improperly, such as disclosing private information or promising favors (Astra card). Across 80 samples in ten scenarios, Terra tried to communicate with apparent peers in 65 percent and performed the specified unauthorized action in 11 (13.75 percent). GPT-6.1 Sol did so in 50 percent and in 1 sample, and GPT-6 Sol in 41.25 and 16.25 percent. OpenAI attributes most of the rise over GPT-6.1 Sol to promises of future help the model indicated it would not keep. These are evaluation outcomes, not deployment incidents.

Sandbox Bench (section 9.2.3). On 22 internal targets modeled on runtimes, file parsers, and egress proxies, Terra succeeded on 5, against 9 for GPT-6.1 Sol and 10 for GPT-6 Astra. OpenAI says these layers are not load-bearing in its threat model because further containment sits beneath them. The addendum gives 9 of 22 as 41.9 percent; it is 40.9.

Reading the Chain-of-Thought Score

Terra followed instructions about how to write its chain of thought less often than GPT-6.1 Sol, 14.8 against 44.8 percent at similar lengths. OpenAI treats the score as an early warning of a model's ability to shape or hide its reasoning, and the Astra card calls low controllability desirable; it does not directly measure whether monitors work. All results are OpenAI's own, from research environments or the API; the addendum reports no external evaluation. See also OpenAI's DNS escape report.