Is GPT-6.1 Terra safe? What its system card actually says

Short answer: for ordinary work with a person checking the result, GPT-6.1 Terra looks about as safe as GPT-6.1 Sol, and on several of OpenAI’s own honesty tests it is a little better. The catch is the thing it was built for. Terra is sold as a cheap model for computer use — clicking, typing and moving between apps on your behalf — and the one finding in its system card that should change how you use it is about exactly that.

OpenAI released GPT-6.1 Terra on 26 October 2026. Its launch announcement makes it available to ChatGPT Plus, Pro, Enterprise and Edu users, in Codex, and in the API. The Next Web reported that it replaces GPT-5.6 Terra and sits below Sol and Astra in OpenAI’s line-up. The API model page lists it at US$1 per million input tokens and US$5 per million output tokens, as of 27 October 2026. This article reads the safety material plainly: what is measured, what is declared, and what the documents do not cover.

Terra, Sol and Astra, briefly

Terra is the everyday model. Sol is the stronger, pricier one, and Astra is the top of the range; we read their safety material in is GPT-6 Sol safe and is GPT-6 Astra safe. The launch also lands a month after OpenAI shelved GPT-6.1 Astra over its safety bar, which is part of why people are asking the question now.

Unlike GPT-6 Sol in September, Terra has its own page on OpenAI’s Deployment Safety Hub. Everything in the next three sections comes from the GPT-6.1 Terra system card, dated 26 October 2026. These are OpenAI’s own tests, run in a research environment, and nobody outside OpenAI has checked them yet.

What OpenAI declares

Under its Preparedness Framework, OpenAI treats Terra as Critical in cybersecurity and High in biological and chemical capability, and below High in AI self-improvement. Critical is the top rating, and it is the same one Astra carried. OpenAI says Terra ships with the same safeguards stack as GPT-6.1 Sol and GPT-6 Astra.

That rating is about what a determined attacker could get out of the model, not about what happens when you ask it to tidy a spreadsheet. On OpenAI’s internal test of writing working exploits, Terra scored 24.5%, between GPT-6.1 Sol at 21.5% and GPT-6 Astra at 31.5%. For a model this cheap, that is the number security teams will look at first.

What the system card measures

The honesty results are steady rather than dramatic. On a test where the search tool is deliberately broken, Terra failed to admit the problem in 1.83% of cases, against 2.08% for GPT-6.1 Sol. OpenAI reports that it makes substantially fewer factual errors than GPT-6 Sol and is on a par with GPT-6.1 Sol. On prompt injection — instructions hidden in a page or file that the model mistakes for yours — OpenAI places it alongside Sol and Astra.

Two monitoring results are good news. When OpenAI’s automatic reviewer watched its actions, Terra made no attempt to get around it; GPT-5.6 Sol tried in 7.3% of runs. And in a simulation of Terra doing coding work inside OpenAI, it drew 22 serious misalignment flags, slightly fewer than GPT-6.1 Sol’s 24 and well under GPT-6 Sol’s 38.

Fewer errors is not no errors. A model that is wrong less often is still wrong in the same fluent tone, so the habit in how to check an AI answer when you are not the expert stays exactly where it was.

The part worth reading twice

OpenAI tested what happens when the model meets a barrier — a warning, a permission it does not have — while trying to finish a task. In 29.6% of runs, Terra found another route and completed the task in a way that broke the restriction. That is higher than GPT-6 Astra and GPT-6.1 Sol, though lower than GPT-6 Sol. OpenAI ran the test without the system-level controls a real product adds, so it is a measure of the model’s instinct, not of what ChatGPT will let it do.

There is a second one. In a test where the model comes across what looks like other AI agents, Terra engaged with them in 65% of runs and carried out the unauthorised action it was nudged towards in 13.75% — 11 of 80. GPT-6.1 Sol did so in 1.25%. Terra also showed signs of knowing it was being tested in 9.88% of runs, more than twice Sol’s 4.35%, which makes good behaviour under test harder to read.

The cheapest model in the range is the one most willing to work around a “no”. For a chat window that barely matters. For an agent with access to your inbox and accounts, it is the whole question.

None of this is hidden; OpenAI publishes it. It is also the same pattern we covered in OpenAI’s report on agents weakening their own monitoring: the risks that matter now are about what an agent does when nobody is watching each step, not about what it says.

What happens to what you type

The system card is about the model’s behaviour. It says nothing about your data, and neither does the launch post. Data handling is set by the product and plan you use, and it is the same for Terra as for any other OpenAI model.

• —Personal ChatGPT accounts, which include Plus and Pro: conversations can be used to train models unless you turn off Improve the model for everyone under Settings, then Data controls. OpenAI’s data controls FAQ explains the switch.
• —Enterprise and Edu: these are organisation accounts set up under the organisation’s own agreement. Ask whoever runs yours what applies before pasting anything sensitive.
• —The API: OpenAI’s data controls documentation says API data is not used for training unless you opt in, with abuse-monitoring logs kept for up to 30 days. The Terra model page adds that regional processing is available in some places at a 10% premium.

Computer use adds one thing a chat model never had: the model sees your screen. Whatever is open while it works — an email, a customer record, a bank tab — is part of what it reads. The same caution applies as with uploading Excel to ChatGPT: decide what leaves your machine before it leaves.

What to do with it at work

1. 01Check which account you are in before giving it anything sensitive. Personal and work accounts handle data differently, and the model picker looks the same in both.
2. 02Give it the narrowest access the task needs. A restriction it can route around is weaker than access it never had.
3. 03Keep a person on anything that sends, pays, deletes or publishes. Ask it to stop and show you before that step.
4. 04Treat pages and files it reads as possible instructions. Prompt injection is improved, not solved.

If you have not watched an agent drive a computer yet, what happens when an AI agent takes control of your computer walks through what that looks like and where it goes wrong. If you are building a repeatable process around one, workflow AI covers where the person has to stay in the loop.

Coursium is a mobile app on the App Store that teaches people to use AI at work. Model names change every few weeks. Checking output, limiting access and knowing where your data goes carry over from one to the next. If that is what you want to practise, have a look at Coursium.