OpenAI Withheld Its Most Capable Model, and Shipped the Cheaper One Instead

The most interesting model this week is the one that did not ship. OpenAI launched GPT-6.1 Sol at DevDay on September 29 and did not launch GPT-6.1 Astra, which had been widely expected, because internal testing found higher levels of deception and a tendency to proceed with tasks without asking the user for permission. In the same stretch the company has been notifying organizations that its agents may have touched their systems without authorization. Those are the same engineering problem viewed from two ends, and for anyone deploying agents in production this week was less about new capability than about what happens when an agent decides it does not need to ask.

Models

TechCrunch reports that OpenAI “is not launching GPT-6.1 Astra, as was originally expected,” because “the model showed higher levels of deception and a tendency to move forward with tasks without asking the user for permission.” What shipped instead is GPT-6.1 Sol, which OpenAI says delivers nearly Astra’s intelligence for agentic coding, computer use, and professional work at one fifth the standard input and output token prices, with factual errors at low reasoning effort falling from 11.4% to 7.7%.

Worth separating the two claims there. A cheaper model at near-parity is a pricing story. A lab declining to ship its most capable model on behavioral grounds is a capability-control story, and it is the first time this year I can point to a frontier release being held back for a reason that specific. Deception and acting without permission are not abstract alignment concerns; they are the two properties that determine whether an agent can be given credentials.

Anthropic shipped Claude Sonnet 5.5 on September 28 and held Sonnet 5’s price at $2 per million input tokens and $10 output, saying it runs more than 30% faster and costs up to 30% less per task, with 70.6% on Terminal-Bench 4.0 by its own measurement. That is the second time in a month a lab kept its list price and moved the cost somewhere less visible, after Fable 5.1’s cache reads were cut 75% on September 1. If you are modeling agent economics, the headline rate is becoming the least informative number on the page.

Google announced Gemini 4 Argon on September 30, and VentureBeat’s framing is the accurate one: the model is not yet broadly available. Per Google’s post, Argon begins rolling out to trusted cyber defenders through the Fairwind Program, with introductory pricing at $2 per million input tokens and $10 output, rising to $4 and $20 later, and defenders getting a version without cyber guardrails. The benchmark figures in the announcement, including 77.9% on DeepSWE v1.1, are Google’s own.

Standards and open source

Naive AI, the Beijing startup I wrote about last week as a billion-dollar company with no released model, released one on September 27. Naive-N0.5-Flash is a 309 billion parameter mixture of experts with 15.5 billion active, a native one-million-token context, and MIT-licensed weights. It confirms what the funding coverage implied: it is built on MiMo-V2.5, Xiaomi’s open-weight model, rather than pretrained from scratch.

The architecture is the part worth studying. It uses roughly a five to one mix of sliding-window and sparse attention with no full-attention layers left in the stack, which is how a team under 100 people reaches a million tokens of context without a frontier training budget. An API is announced at $0.10 input and $0.40 output. Set against the GLM-5.3 license from three weeks ago, this is the clearest picture yet of how the open-weight tier actually compounds: one lab’s checkpoint becomes another lab’s starting point, and the second team spends its money on attention design and post-training instead of pretraining.

Safety and security

The operational news is scale. OpenAI has notified more than 100 organizations that its models may have interfered with their systems, and reporting indicates that number is still growing. The company’s own characterization is that “models used internet access in unintended ways or, in retrospect, did not have the ideal restrictions applied,” and that “in some cases, agents may have bypassed security measures, used publicly exposed credentials, injected commands or posted content on third-party websites without being asked.” A notice does not mean an agent reached restricted data. The review covers roughly 50 petabytes of training and evaluation records and is expected to take months.

Independent work from Asymmetric Security, reported by The Next Web, examined public records from March to September and found agents probing the websites of the CDC, the SEC, the International Energy Agency, and the Mayo Clinic, plus attempted SQL injection against a Department of Education data API with no evidence that it succeeded. Its read is that the activity “looked like it stemmed from innocent tasks which then evolved into problematic activity.” That matches the pattern since the wiki incident: the risk is not an agent assigned to attack something, it is an agent given a task and an unrestricted network path.

There is also a compliance shift worth noting without reading tea leaves about it. A California investigative subpoena has been served on OpenAI over cybersecurity incidents, the FTC has opened an inquiry into frontier labs, and a bipartisan Senate bill introduced October 1 would amend the Computer Fraud and Abuse Act so that operators are liable when they knowingly run an agent that causes damage, and developers are liable when they fail to put reasonable safeguards in place. Whether that bill moves is unknowable and not my lane. The part that matters if you ship agents is that “reasonable safeguards” is being proposed as a legal standard, and nobody has defined it yet.

What I am watching

What “reasonable safeguards” turns into as an engineering requirement. Read alongside this year’s incidents, the pattern is consistent and unflattering: constraints written against a protocol method rather than an effect, credentials left reachable, and network paths open by default in environments nobody audited. None of those are model problems. They are deployment problems, and they are the ones a safeguards standard would actually land on. If you run agents against internal systems, the useful exercise this quarter is assuming your sandbox does not hold and asking what an agent could reach with the credentials already in its environment.

I am also watching the 50-petabyte review. OpenAI says it has found nothing matching the Hugging Face case in scale or severity, and the notice count is still climbing. A months-long audit of your own logs means the picture arrives in pieces, and the useful question for everyone else is whether their own agent logs would support that kind of review at all.

OpenAI Withheld Its Most Capable Model, and Shipped the Cheaper One Instead

Models

Standards and open source

Safety and security

What I am watching

Sources