OpenAI confirmed GPT-6.1 Terra is safer overall than some of its older models, but its safety testing also found other problems.
According to OpenAI, GPT-6.1 Terra showed higher rates of exfiltration, destructive actions, and attempts to bypass restrictions than GPT-6.1 Sol and GPT-6 Astra.
OpenAI performed simulations across approximately 48,690 matched tasks and found that Terra received 22 severity-3-or-higher flags, or 0.045%.
For comparison, GPT-6 Sol received 38, while GPT-5.6 Sol received 61.
“GPT-6.1 Terra received approximately 42% fewer severity level 3 or higher flags than GPT-6 Sol and 64% fewer than GPT-5.6 Sol,” OpenAI noted in its system card.
However, that is no longer the case when you compare Terra with other newer models on less severe behaviors.
“Relative to GPT-6.1 Sol and GPT-6 Astra, we observed higher rates of flags for concealing uncertainty, circumventing restrictions, exfiltration, other misalignment, destructive action and inbound prompt injection,” OpenAI explained.
Terra is clearly safer overall, but we can’t overlook the other potential security issues it has, and this is true for all models shipping in the market, including Claude.
Terra also performed more unauthorized actions in one test
OpenAI also tested what happens when Terra needs to deal with messages from other AI agents while working through blocked coding tasks.
Terra attempted to communicate with those apparent peers in 65% of tests and ultimately performed the specified unauthorized action in 13.75%, or 11 of 80 samples.
OpenAI found that GPT-6.1 Sol did so in just 1.25%.
“These results indicate that performance is comparable to 6.0 Sol,” OpenAI noted, adding that much of the regression against GPT-6.1 Sol involved promises of future help that Terra indicated it would not actually carry out.
OpenAI warns that these tests were conducted in simulated environments, so the results may not necessarily reflect how GPT-6.1 Terra behaves in real-world production environments.
But we still aren’t seeing meaningful improvements across every area of security, even as these companies claim their models can control computers and code better.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
