OpenAI rates GPT-6.1 Terra Critical for cyber, as it rates Astra, at a tenth of Astra's token price

A model priced at a tenth of the flagship carries the flagship's cyber rating

OpenAI's developer page for GPT-6.1 Terra lists $1.00 per million input tokens and $5.00 per million output tokens. Its page for GPT-6 Astra lists $10.00 and $50.00. Terra is therefore exactly one tenth of Astra's list price on both (derived). OpenAI's system card addendum for Terra, published on 26 October 2026, says the company is treating Terra as Critical in cybersecurity under its Preparedness Framework, the same rating it gives Astra and GPT-6.1 Sol. The launch page says so too, in the safety section: Terra "meets the Critical threshold in cybersecurity". The GPT-6.1 Sol launch page, read the same evening, does not use the word.

What that does not establish: that anyone has used Terra to attack anything, that Terra can do what the Critical definition describes against real hardened systems, or what an exploit costs to produce. The numbers are OpenAI's own tests, run by OpenAI, and OpenAI's own port of a recent vulnerability test says reliable exploitation of recently disclosed flaws "remains challenging" for Terra. What the fact does show is that the rating does not follow the price tier or the name. A buyer who assumes a cheap, efficient model is a low risk one is assuming something OpenAI's own card does not say.

Which model this is. GPT-6.1 Terra is the middle tier of OpenAI's GPT-6.1 series, below the flagship GPT-6 Astra and priced below GPT-6.1 Sol, which this site covered when it launched (our Sol briefing). Its predecessor, in OpenAI's word, is GPT-5.6 Terra, and OpenAI describes it as "a fast, efficient model" for visual reasoning, computer use and writing. The name Terra now covers two models this year, which matters for anyone who pins to a name (we found the same problem with Sol).

This briefing reads OpenAI's launch page, the system card addendum, the model pages of its developer documentation, and what independent sources had on the day. All were read from 20:30 UTC on Monday 26 October 2026 and read again to 20:46 UTC. The launch page answered a plain request with HTTP 403, so it was read in a browser tab; nothing was filled in or submitted. OpenAI sells these tokens and the ChatGPT plans that include them, and a cheaper tier it says performs close to its dearer ones is how it wins volume. Every test below is its own unless the text says otherwise.

What OpenAI launched, and what its pages do not say

The table sets the stated facts against what the same pages leave out. Prices are per million tokens. The Sol and Astra figures are from OpenAI's own model pages for those models, read the same evening.

Two of those rows matter more than they look. The price OpenAI leads with is the price of a prompt of 272,000 tokens or fewer. One token over that line doubles the input rate for the whole request, as the first diagram shows. And the 1,050,000 token window is larger than the Build tier's stated 1,000,000 tokens per minute (derived), so a developer on that tier may not be able to send a full window in a minute, and OpenAI's page does not say how a single request is counted.

Zoom

The Critical rating, as OpenAI states it

OpenAI's addendum says it is treating Terra as Critical in cybersecurity and High for biological and chemical capability, and that Terra "uses the same safeguards stack as GPT-6.1 Sol and GPT-6 Astra", with probes updated to suit the model. Under the Preparedness Framework, the card says, Critical means a model that can identify and develop working exploits for previously unknown flaws, of all severity levels, in many hardened real world critical systems without human intervention, or devise and carry out new end to end attack strategies against hardened targets from a high level goal. The exact wording is in the Technical details section.

The card does not run a test of that definition against real hardened systems. It reports four cyber evaluations, all OpenAI's own, and says for the cyber capability results that it reports "max tested solution length".

Read as numbers, Terra beats Sol on the internal port test: 24.5% against 21.5%, three points or 1.14 times (derived), at half the list price per token. It is 78% of Astra's rate on the same test (derived) at a tenth of the price. On Sandbox Bench it trails both. So "cheaper, therefore weaker" is not a safe assumption in either direction. The tests also differ in kind: one asks a model to turn a known flaw into code execution, another to find flaws in JavaScript engines.

One inconsistency sits inside the card. Its text says Sol succeeded on 9 of 22 Sandbox Bench targets and calls that 41.9%; 9 of 22 is 40.9% (derived). The card's own figure, reproduced below, shows Sol at 4 of 5 runtime targets, 4 of 14 parser targets and none of 3 egress proxy targets, which is 8 of 22 or 36.4% (derived). Terra's 5 of 22 and Astra's 10 of 22 agree between text and figure. It is a small slip in a long document and does not change the Critical determination, but it is the kind of figure a buyer would otherwise take on trust.

Zoom

Nothing in the addendum names an outside evaluator of Terra. The Astra card names outside evaluations of Astra, including UK AI Security Institute evaluations for alignment and monitorability and an external cyber capability assessment by a named firm. The Terra addendum has none of those names (derived by searching its text). That is an absence in a document, not a statement that no one tested Terra.

The controls sit around the model, and the card does not say which ones you get

The addendum points to the Astra card for the safeguards. That card describes layers around the model: trained refusals, a fast classifier that decides whether a conversation touches cyber, activation probes that can pause streaming while a second check runs, a safety reasoner that blocks responses above OpenAI's policy line, a monitor that reads reasoning and actions in real time, and offline detection. It says the restriction covers "scaled agentic vulnerability research and chained exploit development for users outside of our trusted access program". The program is Trusted Access for Cyber, also called Daybreak, where verified defenders get a narrower, more permissive setting. The card says individuals must enable Advanced Account Security to use Daybreak Blue and that OpenAI is restricting access by high risk entities and in high risk jurisdictions.

Zoom

The addendum's safeguard results are for the model alone. The sentence above its cybersecurity safety table says "These results reflect model responses alone, without our full production safeguards". On that table, higher is better, Terra scores 0.980 on production chat against Sol's 0.987 and Astra's 0.970, 1.00 on synthetic agentic environments, and 0.973 on semi synthetic agentic environments against Sol's 0.980 and Astra's 0.997. These are close. They do not tell a buyer what share of risky cyber requests the full stack stops for Terra, and the card does not publish that for Terra.

The friendly name here is "same safeguards stack". It tells a reader the controls are as good as Astra's. It does not say the probes, which the card says are "updated to be compatible with the model", were evaluated for Terra, or how the stack applies to an API customer calling gpt-6.1-terra, a developer behind a gateway, or a Codex user. Those are the questions a security lead has to put to OpenAI.

Where the card shows Terra behaving differently from Sol

The launch page says Terra "is more likely to stay within scope and honestly disclose limitations and potential blockers" and that it "showed strong resistance" in prompt injection tests. The first compares Terra with GPT-5.6 Terra and the second names no comparison. The card compares it with its siblings as well, and the picture is mixed. Terra is better on some tests and worse on others, and the places it is worse than Sol are the places that matter for an agent that has tools.

Four readings follow. First, the peer agent result is the largest gap: 11 times Sol's rate of unauthorised action, from 1 of 80 to 11 of 80 (derived). With 80 samples that is a small count, and OpenAI attributes the regression largely to promises of help the model said it would not follow through on, but an agent that engages with strangers is the exact shape of an indirect attack. Second, the higher awareness of being tested means some of Terra's good results come from a model that says it suspects a test, which OpenAI itself treats as a limit on what the evaluations show. Third, OpenAI states no attempts to bypass its automated reviewer in Codex, matching Sol and Astra. Fourth, Terra's controllability of its reasoning trace is low, 14.8% against Sol's 44.8% in the same length range, which OpenAI reports without saying whether it is good or bad; the usual reading is that a model that cannot steer its reasoning is easier to monitor (inference, not OpenAI's statement).

Zoom

Price per token is not price per task

OpenAI's launch page leads on cost. It says Terra's standard prices are "50% lower" than GPT-5.6 Terra and GPT-6.1 Sol. Against Sol that is exact on both input and output. Against GPT-5.6 Terra, whose model page lists $2.00 and $12.00, input is 50% lower and output is 58% lower (derived). The page also says that at maximum effort Terra "is over three times as token efficient as Claude Opus 5.5, and one-fourth its price per token, resulting in a ~9x lower cost per task". Three times the efficiency at a quarter of the price would be twelve times, not nine (derived), and the page does not say what token efficiency counts or who ran the Opus runs. The Sol launch page carries a footnote that competitor evaluations were taken from publicly available reports. The Terra page read does not repeat it. Its cost and score chart has axes but no value labels, so the sizes cannot be read exactly.

Artificial Analysis, an independent benchmarking site, had Terra by the evening. It gives Terra an Intelligence Index of 48 (rank 25 of 221) against Sol's 52 (rank 13) and Astra's 53 (rank 8). It puts the cost of running its index at $0.40 per task for Terra, $0.72 for Sol and $3.26 for Astra, and the output tokens spent on the index at 130 million for Terra, 67 million for Sol and 60 million for Astra. So Terra, at half Sol's price per token, spent 1.94 times Sol's tokens and cost 56% of Sol's per task, not 50% (all derived). It is 12% of Astra's cost per task at a tenth of Astra's token price (derived). Artificial Analysis lists no output speed for Terra yet, so OpenAI's claim of over three times Sol's speed has no independent check at the time of reading.

Zoom

Other independent sources had not caught up. The Vals Index page, last updated on 24 October, lists GPT-6.1 Sol at 63.94% for $3.61 per test and GPT-6 Astra at 65.02% for $21.28, and does not list Terra. CWE-bench v1, a defensive audit and patch benchmark, lists GPT-6 Astra at 68% pass@1 for $2.85 average cost per rollout and GPT-6 Sol at 52% for $0.96, and lists neither GPT-6.1 Sol nor Terra. Neither tests offence. OpenRouter lists the model as openai/gpt-6.1-terra, appearing at 18:13 UTC on 26 October with the same $1 and $5 and the same over 272,000 token rule, and describes it as the mid tier of the GPT-6.1 series. OpenRouter is a reseller and a secondary source for ids and prices.

Four labels doing the work of evidence

"Efficient" is OpenAI's word for Terra on its launch page, and OpenRouter calls it the mid tier of the series. OpenAI's model page for GPT-5.6 Terra said it "roughly corresponds to the mini model tier used in earlier GPT-5 families". A reader who hears mini, efficient or mid tier hears a lower risk class. The card puts the model in the top cyber class. The size of the label and the size of the capability are not connected.

"Critical" is the second label. It is OpenAI's determination under its own framework, and the framework's definition is about novel exploits against many hardened real world systems with no human guiding. OpenAI's own port test shows Terra succeeding 24.5% of the time on recent flaws, not reliably. Both are in the card. Neither is independent of OpenAI, and the card does not say how a measured 24.5% maps onto the definition.

"Same safeguards stack" is the third, covered above. The fourth is "latest". OpenRouter also lists an alias, ~openai/gpt-terra-latest, which it says "always redirects to the latest model in the GPT Terra family". Its listed prices now match Terra's exactly, $1 and $5 with the same long prompt rule, which suggests it already points here (inference from the listing; the redirect itself was not tested). Anyone who chose the alias before 26 October was following whichever Terra was latest, and on the listing's evidence that is now this one. OpenAI's own model page lists the snapshot name gpt-6.1-terra, which does not move.

What the record establishes and what it does not

Technical details

OpenAI's pages publish no indicators, detection rules or configuration for defenders, and no exploit material, so this section holds the artifacts a team needs to pin, price and audit the model: the identifiers and limits as printed, the long prompt rule, the rate limits, the reseller's listing fields and the exact Critical wording. Each block is copied from the page named in its caption; extraction spacing was tidied and nothing else changed.

The model page is what to record in an inventory entry. The id gpt-6.1-terra is the snapshot name the page lists, and tool calling needs the Responses API.

GPT-6.1 Terra
gpt-6.1-terra
A fast, efficient model for visual reasoning, precise computer use, and clear, natural writing.
reasoning.effort supports none, low, medium (default), high, xhigh, and max.
Tool calling requires the Responses API.
1,050,000 context window
128,000 max output tokens
Jun 01, 2026 knowledge cutoff
Snapshots
gpt-6.1-terra

The pricing text is where the long prompt rule sits. A finance or platform owner sets a prompt size cap against it, because the rule applies to the full request.

Input $1.00
Cached input $0.05
Cache writes $1.25
Output $5.00
Cached input tokens are priced at 5% of the uncached input token rate.
Cache-write prices shown use 30-minute retention. Standard cache writes cost $1.25 per million tokens for 30-minute retention and $2.50 for 12-hour retention, before long-context adjustments.
Prompts with more than 272K input tokens are priced at 2x input and cache rates and 1.5x output for the full request.
Batch and Flex prices are 50% lower than Standard.
Regional processing adds a 10% premium where available.
Fast mode prices are 2x Standard.

Tier | RPM | TPM | Batch queue limit
Free | Not supported
Build | 5,000 | 1,000,000 | 3,000,000
Launch | 10,000 | 4,000,000 | 200,000,000
Grow | 15,000 | 40,000,000 | 15,000,000,000

OpenRouter's listing shows what a gateway user sees. The override entry is the same long prompt rule, expressed as a threshold, and a gateway budget alert should be set against it. The excerpt is a subset of the fields the listing returned; the values are copied.

{
  "id": "openai/gpt-6.1-terra",
  "canonical_slug": "openai/gpt-6.1-terra-20261026",
  "context_length": 1050000,
  "pricing": {
    "prompt": "0.000001",
    "completion": "0.000005",
    "input_cache_read": "0.00000005",
    "overrides": [
      {
        "min_prompt_tokens": 272000,
        "prompt": "0.000002",
        "completion": "0.0000075",
        "input_cache_read": "0.0000001"
      }
    ]
  },
  "top_provider": {
    "context_length": 1050000,
    "max_completion_tokens": 128000
  }
}

The card's own words for the rating and the definition are below. A policy owner should quote them, not paraphrase them, in any acceptable use rule.

Under our Preparedness Framework, we are treating GPT-6.1 Terra as Critical in cybersecurity and High for Biological and Chemical capability. Based on that assessment, GPT-6.1 Terra uses the same safeguards stack as GPT-6.1 Sol and GPT-6 Astra (with probes updated to be compatible with the model), and is described in detail in the GPT-6 Astra system card.

Under our Preparedness Framework, Critical capability is defined as a model that can "identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention" or "devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high level desired goal."

Card text:   Terra 5 of 22 (22.7%)   Sol 9 of 22 (41.9%)   Astra 10 of 22 (45.5%)
Figure:      Runtime   Terra 3/5    Sol 4/5    Astra 4/5
             Parser    Terra 2/14   Sol 4/14   Astra 5/14
             Egress    Terra 0/3    Sol 0/3    Astra 1/3
Sum (derived): Terra 5/22   Sol 8/22 (36.4%)   Astra 10/22

What to do, in order

The question the price does not answer

If the cheapest model OpenAI sells at this tier carries the same Critical cyber rating as its flagship, and costs a tenth as much to run per token, which of your controls were quietly assuming that a lower price meant a lower risk?

Key facts