OpenAI has released GPT-6.1 Terra, a model that operates desktop software, and the GPT-6.1 Terra cyber threshold rating is Critical, the top tier of OpenAI's Preparedness Framework. Its API costs half as much as GPT-5.6 Terra's. For regulated Cyprus firms, the question is what that agent may touch.
Key takeaways
- OpenAI rates GPT-6.1 Terra at the Critical cyber threshold, the higher of two in its April 2025 Preparedness Framework; no external review is mentioned.
- API pricing is $1 / $0.05 cached / $5 per million tokens, half that of GPT-5.6 Terra and GPT-6.1 Sol.
- OpenAI published no prompt-injection rate; error-inducing prompts still trip Terra 4.3 to 16.7 percent of the time.
- Before Terra reads invoices, give it a separate identity, least privilege, segregated payment duties and full action logging.
What is GPT-6.1 Terra?
GPT-6.1 Terra is an OpenAI model built to operate desktop software. Plus, Pro, Enterprise and Edu users get it in ChatGPT Work and Codex. Developers call it through the API as gpt-6.1-terra at $1 per million input tokens, $0.05 per million cached input tokens and $5 per million output tokens, which OpenAI says is 50 percent below GPT-5.6 Terra and GPT-6.1 Sol. OpenAI’s own example of high-volume work for Terra is reading incoming invoices into accounting software.
What does the GPT-6.1 Terra cyber threshold rating mean?
It means OpenAI judges Terra capable of the most serious offensive work its framework describes. Critical is the higher of two cybersecurity thresholds in the April 2025 Preparedness Framework. A model reaches it if either holds:
- With tools and no human involved, it finds unknown zero-days in many hardened real-world critical systems and builds working exploits.
- Given only a high-level goal, it plans and runs a new attack end to end against a hardened target.
If Critical-standard safeguards have not been specified, development must stop until they are. OpenAI designated GPT-6 Astra its first Critical-level model on September 1, 2026, and says Terra keeps Astra’s protections, without describing them or saying whether anyone outside OpenAI reviewed Terra’s rating. Treat it as a vendor self-assessment.
What did OpenAI say about prompt injection?
It gave no numeric injection rate. OpenAI says only that Terra “held up well” against malicious instructions meant to pull it off task and is more likely than GPT-5.6 Terra to stay within scope. The published figures measure performance:
- Agents’ Last Exam, medium effort: 15 points above GPT-5.6 Terra at about one-third the cost; on par with GPT-6 Astra at one-tenth the price per token.
- Max effort vs Anthropic’s Claude Opus 5.5: a quarter of the price per token, roughly nine times cheaper per task.
- Error-inducing prompts: low-effort error rate down from 53.6 to 16.7 percent, about one prompt in six; 4.3 percent at max effort.
- Terminal-Bench 4.0, max effort: 50.3 percent of command-line tasks solved, against 21.5 percent for GPT-5.6 Terra.
None of this tests the Critical rating or injection resistance.
Why does a cheaper desktop agent change risk for Cyprus firms?
Cheap, fast agents spread. OpenAI says Terra finishes tasks more than three times faster than Astra and GPT-6.1 Sol, so expect it on many back-office desktops, each acting with whatever mail, file and application access its session holds.
Invoices are written by outsiders. Indirect prompt injection hides instructions in a PDF, email or web page so the agent reads them as commands. A supplier, or whoever controls a supplier’s mailbox, can put invoice data and a hostile instruction in one file.
Under DORA the agent falls within ICT and third-party risk management; under NIS2 an incident it causes is assessed for reporting like any other. The announcement says nothing about EU data residency; get that in writing before client data reaches the agent.
What should you restrict before Terra touches finance systems?
“More likely to stay within scope” is a test result, not an authorization boundary. Enforce scope outside the model:
- Give the agent its own OS account and identity, separate from staff SSO, with least-privilege roles on mail, drives, ERP and browsers.
- No standing access to production admin, payment ledgers or customer PII; allowlist tools and restrict egress.
- The agent that reads an invoice must not change vendor bank details or release payment.
- Log tool calls, file reads, connectors and outbound destinations. Name an owner and an off switch.
Our quickest check is a harmless booby-trapped invoice telling the agent to ignore policy, email an external address and change payment details. It passes only if every sensitive action stays blocked. Our prompt injection testing and AI agent penetration testing run that check across every input.
Keep the decision, scope and test results as evidence for NIS2, DORA and CySEC, and revoke credentials when a pilot ends: as our piece on dormant AI agents that still hold live keys showed, idle agents rarely lose access on their own.
FAQ
What is OpenAI's Critical cybersecurity threshold?
The higher of two cyber thresholds in OpenAI's April 2025 Preparedness Framework: finding and exploiting unknown flaws in hardened critical systems with no human involved, or running a new attack end to end from a high-level goal.
How much does the gpt-6.1-terra API cost?
$1 per million input tokens, $0.05 cached and $5 output, which OpenAI says is half the price of GPT-5.6 Terra and GPT-6.1 Sol.
Does a Critical designation mean the model was independently certified?
No. OpenAI presents the rating as its own assessment and names no outside reviewer.
Planning to let an AI agent near invoices, payments or client data? Our agentic AI threat modeling maps what it can reach before it goes live.