Terra Reprices Routine Work

If You Only Read One Thing

Paying less per token can still buy a more expensive answer. GPT-6.1 Terra makes that reversal visible in Artificial Analysis’s launch measurements. Cloudflare’s cache-exposure disclosure raises a separate problem: a successful answer can contain somebody else’s data. Today’s useful questions come before speed: which model setting buys the required capability, and which test would actually catch a broken isolation boundary?

Terra’s Bargain Depends on Effort

GPT-6.1 Terra deserves a place in routine agent work, but turning its reasoning dial all the way up can erase the bargain. OpenAI’s new middle-tier model makes the model name an incomplete purchasing decision. You’re choosing how much thinking to buy, too.

OpenAI released Terra on October 26 in ChatGPT Work, Codex and the API. The launch announcement prices input at $1 and output at $5 per million tokens, half Sol’s standard rates. OpenAI emphasizes visual reasoning and computer use: repeated work such as reading an invoice and entering its contents into another application.

Artificial Analysis supplies the useful complication. Its maximum-effort Terra scores 48 on the evaluator’s broad Intelligence Index and costs about $0.40 per index task. Its medium-effort Sol also scores a rounded 48, for about $0.21. The evaluator weights costs across ten tests; neither figure is a price quote for completing an invoice.

Sol charges more per token and still produces the cheaper measured task.

How does the more expensive model win on cost? Sol generates far fewer output tokens in that measured run. Terra can spend its lower token price on a longer reasoning process. A cheaper unit of computation doesn’t guarantee a cheaper answer, just as buying discounted ingredients won’t rescue an unnecessarily elaborate recipe.

Artificial Analysis puts Terra’s low and medium settings among its best general capability-and-cost combinations. Its separate coding-agent comparison favors low and extra-high effort. A coding agent and a document assistant therefore need different comparisons, even when both call Terra. The practical gain is a smaller search: model plus effort plus workload, with the expensive settings earning their place through better accepted results.

Terra could still beat Sol for visual work that the broad index misses, and equal rounded scores can hide different strengths. I’d bet on Terra for more repetitive computer work, but not on replacing Sol across the board. Nobody has settled that comparison for a private workload with its own failure costs.

OpenAI now offers a credible middle option between a cheap worker and a premium investigator. Terra’s real opening is work whose required quality it can reach without prolonged reasoning. A matched batch of invoice-to-application tasks would settle the deployment question: accepted completions per dollar, including retries, at Terra medium versus Sol medium.

Test What Crosses the Boundary

Cloudflare’s long-context tests accepted responses that could contain another customer’s data. Cloudflare’s October 26 disclosure shows why confidentiality needs a separate test from whether an agent request finishes successfully.

Cloudflare reports 155 affected responses from August 27 through September 9, all on GLM 5.3 prompts longer than 681,280 tokens. Cloudflare had advertised a larger context window than its prompt-processing cache could hold. Its tests checked successful status codes and streaming responses; those checks didn’t catch the wrong data inside the answer.

SGLang then made the mismatch dangerous when it rejected an oversized request. The inference engine substituted a tiny placeholder for an oversized prompt. Its generation worker treated the transfer as complete and used cache pages that still contained earlier customers’ state. Cloudflare expanded the cache and patched rejection handling, then validated the repair with the researcher’s reproduction and canary-marker tests before restoring service.

If you already run hermetic tests and independent model review, the missing dimension is the observer. A test can give each simulated customer a distinctive marker, submit the failing request, and check whether a different customer receives that marker. The observer checks where the data went. It doesn't ask the model whether it behaved correctly.

Simon Willison made the same practice reproducible in his browser experiment. His agent tested a JavaScript runner called webframe against a local HTTP receiver. Browser policy blocked ordinary fetches, yet a page navigation reached the receiver. His wrapper stopped that request by launching the whole browser in a separate Linux network namespace, an isolated network environment, in the saved paired test.

Cloudflare’s production repair and Willison’s prototype answer different deployment questions; the browser run is agent-generated evidence on one Linux setup. His wrapper adds about 450 milliseconds of startup per call and lacks a hard memory ceiling. I’m fairly sure the testing method travels better than that particular wrapper: a separate observer can reveal a forbidden effect that the application’s own success signal misses.

October 21’s monitoring report exposed missing alarm delivery. Cloudflare adds the opposite failure: data arriving where it wasn’t allowed. A service that rejects an oversized request cleanly still needs to keep other customers’ data private. A repeated two-customer long-context trial passes only with zero foreign canary markers, including through rejected and interrupted requests.

The Contrarian Take

Everyone says: The cheapest route to a given capability is the model with the lowest token price.

Here’s why that’s wrong: Terra maximum and Sol medium reverse that ranking in Artificial Analysis’s workload. Sol reaches the same rounded broad score for roughly half the task cost, despite charging twice as much per input and output token. Terra’s lower settings can still be good value, because shorter reasoning can preserve the token discount instead of spending it on extra generation. A price sheet ranks tokens; a workload comparison includes the reasoning, retries and review needed to get acceptable work.

Under the Radar

Terra’s factuality gain includes declining to guess. Artificial Analysis reports that Terra guesses on 38% of questions it cannot answer in its private knowledge test, down from its predecessor’s 88%, alongside a small accuracy gain. That’s a conditional measure of guessing, not a claim that 38% of all answers are wrong. For research agents, willingness to leave a gap can be useful when a downstream system preserves that gap instead of filling it with another model’s speculation. The evaluator explains the result here.
A hostile page can forge the test result, too. Willison’s webframe probes found that page code could inject a fake evaluation result through the browser bridge. His wrapper accepts only output carrying an unpredictable per-call identifier; the recorded forgery produced no accepted result. That adds a second requirement to browser isolation: the host needs to distinguish its own runner’s answer from page-controlled output. The prototype still needs stronger separation between page scripts and the reporting bridge.

Quick Takes

An instruction file became a malware installation request. Forever Security’s October 22 report, which drew wider attention yesterday, describes stopping a customer’s agent after it read a malicious AGENTS.md in Downloads. In subsequent lab tests, the file also changed Codex’s machine-wide configuration. The durable risk is the promotion of downloaded text into persistent tool authority. The researchers couldn’t determine how the customer’s file arrived. (Source)
New Gemini projects now retain requests by default. Google’s October 26 change sets store=true for paid-tier Generate Content requests in new projects, including streaming and batch calls. Existing projects keep their settings; individual requests can specify store=false. A freshly created environment can therefore preserve more data than an older deployment running the same application code. Request storage has become part of reproducing the deployment, alongside model and SDK versions. (Source)
CodeRabbit is following security effects across repositories. OpenAI’s October 26 customer account describes Sol-powered investigation extending to linked codebases, such as a shared authentication library, with optional sandbox exploit verification and proposed fixes. That extends independent review beyond the submitted diff to the systems it affects. The account offers deployed workflow evidence, without a measured reduction in escaped vulnerabilities; review coverage and review effectiveness still need separate measurements. (Source)

The Thread

Some requirements can be priced; others have to disqualify the result. A buyer can accept a slightly weaker answer to cut the bill, which is Terra’s opening. A customer can’t accept another tenant’s data in exchange for a cheaper answer. Mixing those requirements into one average score would let enough cheap successes hide an isolation failure.

That changes which model configurations even enter a cost comparison. A service first has to keep customers apart through oversized, rejected and interrupted requests. Only the configurations that meet that requirement deserve a ranking by accepted work per dollar. Willison’s external receiver shows how to check one such requirement without trusting the browser’s own report.

A cheaper model therefore expands the options only if its surrounding service passes the same confidentiality tests. Higher task success and lower cost can compensate for each other; neither compensates for data going to the wrong customer. If a lower-cost configuration wins on completions but fails the foreign-marker trial, it loses the deployment comparison.

Predictions

New predictions:

I predict: By November 27, Artificial Analysis will still measure GPT-6.1 Terra maximum below GPT-6.1 Sol maximum on its broad Intelligence Index, while Terra maximum retains the lower cost per index task. The release looks like a durable middle tier, with a capability gap that extra effort won't fully close. (Confidence: medium; Check by: 2026-11-27)

October 27, 2026 · 03:56 AM ET