The model is the cheap part now

OpenAI cut the price of its computer-use model in half this week. On its own that is a pricing story. Read alongside everything else that happened between October 21 and 28, it shows where the advantage in AI is moving. A capable model is no longer the scarce part. The scarce part is the work around it: giving agents identities and limits, measuring what they deliver, connecting them to the systems where the business is recorded, and checking what they produce. Each section below covers one of these, and what it means for anyone deploying AI in the next two quarters.

The model is the cheap part

OpenAI released GPT-6.1 Terra on October 26 at $1 per million input tokens and $5 per million output tokens, which it says is half the price of GPT-5.6 Terra and GPT-6.1 Sol. It claims Terra finishes tasks more than three times faster than GPT-6 Astra and scores 50.3% on Terminal-Bench 4.0, against 21.5% for its predecessor. Those are OpenAI’s own numbers. Its system card adds the other half of the story: Terra is rated Critical for cybersecurity under OpenAI’s Preparedness Framework, and in 29.6% of maximum-effort test runs it completed a task by a route that broke the spirit of the restriction it was given. OpenAI notes those tests ran without some production controls. OpenAI on X · BleepingComputer · MLQ on the system card

This has two consequences. Agent work that was too expensive per run in the spring may pay for itself now, so it is worth going back over the use cases you shelved. And every price cut that helps you also helps anyone pointing agents at you, which the security section below returns to. When the model itself costs less every quarter, it stops being where an organization can get ahead. What sets organizations apart is everything after this section.

Every agent needs an identity

Four companies shipped the same idea in one week. IBM made Agent Identity generally available on October 26. Each agent is registered in a central inventory with an owner and a risk classification. Each action is traced to the person who delegated it through short-lived, task-scoped tokens, and an audit trail links the human, the agent, the credential and what happened downstream. 1Password launched a way for agents to sign in without ever seeing the password or one-time code: the user approves, and 1Password fills the credential into the site. Anthropic published the controls behind Claude Duet. A separate check runs on every action outside the model doing the work, so instructions hidden in a web page cannot steer it. Payments, sensitive messages and deletions need approval, and some actions, such as trading securities, are off-limits even with approval. Purchases use a one-time card limited to a single merchant and amount. Walmart launched Agent Gateway, an MCP server for approved shopping agents, with a profile for each agent and a choice between approving every transaction or setting a spending limit. Amazon, meanwhile, began blocking agents from buying. IBM · 1Password · Anthropic · TechCrunch

All four follow the same design. The agent acts on a person’s behalf, its authority is narrow and temporary, and every action can be traced back to someone. That is an architecture decision, and it is far easier to make before agents spread across a company than after. Two questions are worth answering this quarter. Is there an inventory of the agents acting inside your systems, and whose authority each one uses? And when customers start sending agents to your site, will you take Walmart’s position or Amazon’s?

Stop counting tokens

Amazon told its software engineers that they will be measured by long-term outcomes for customers, businesses and teams. The memo from its engineering leadership admits that Amazon has sometimes used input metrics such as token usage or adoption of AI tools instead. It calls them “deeply flawed” as targets because they are “disconnected from what matters”, and notes that “tokenmaxxing is at odds with frugality.” It still allows those metrics with care and judgment, and suggests watching the 10th and 90th percentiles of adoption. Unilever shows what the outcome side looks like. NOVA, five agents built with Microsoft that read order emails and pass exceptions to people, now handles 95% of orders touchlessly across 11 pilot markets. The first stage of order-to-cash has dropped from 15 to 20 minutes to about 90 seconds. Those are company figures published by the vendor rather than an audit, but they name a workflow, a baseline and a result. Amazon · Microsoft UK Stories

An AI program that reports seats, prompts or tokens to its board is reporting cost. Unilever’s approach is the one to copy: pick a workflow, record what it takes in time and money before agents touch it, and report the change. Adoption data still has a use, as Amazon suggests. Use it to find the teams that have worked something out and the ones that are stuck, not as the target.

The labs are moving into the systems of record

OpenAI spent the week moving into other companies’ platforms. On October 27 Oracle announced three products built with OpenAI. Oracle AI Workspace connects OpenAI models to Fusion, NetSuite and enterprise data through ChatGPT plugins. App Composer lets employees without coding skills build applications with Codex. Oracle AI Security Mesh is built on OpenAI’s cybersecurity models. Oracle has not said when any of them ship. The next day ServiceNow announced an expanded OpenAI partnership. It starts with a ServiceNow plugin for ChatGPT, and plans include security products on OpenAI’s cyber models and a Codex integration in ServiceNow’s AI Workflow Factory. Meanwhile Anthropic gave Agent Skills, its format for packaging the instructions and scripts that agents load on demand, to the Linux Foundation’s Agentic AI Foundation. Anthropic says more than 70 platforms support it, including ChatGPT, Cursor, GitHub Copilot and VS Code, with 1 million skills published and nearly 280 million installed. The foundation now hosts 10 projects, including MCP, AGENTS.md, OpenAI’s Open Responses and Alibaba’s OpenSandbox. Digital Today on Oracle · ServiceNow Q3 release · Anthropic · Agentic AI Foundation

Two things follow. First, AI vendors are now competing for the place where work is approved and recorded, and the companies that own those systems would rather rent a model than lose the user. That gives buyers leverage. The platforms you already pay for will bring agents to you, and you can require them to come with the identity and audit controls described above. Second, skills, MCP connectors and agent instructions are becoming neutral standards, so writing down how your teams actually work no longer ties you to one vendor. That written-down know-how is the asset to build now.

Attackers got the discount first

Microsoft says the China-aligned actor Storm-0940 used ARTEX, an open-source agentic penetration-testing framework that works with any model, against hundreds of organizations. It assesses that the group was behind the ConnectWise supply-chain compromise. In several cases the time from first targeting to privileged access was under three hours. Separately, Wiz disclosed PHP2Shell, flaws in PHP’s core runtime reaching back to PHP 5.4 that allow unauthenticated remote code execution. Wiz says frontier models were critical to turning a longstanding bug into a working exploit. Patched releases shipped on October 21. Microsoft Security · Wiz

Defense is changing in the same way. Claude Security now rescans repositories as code changes, marks findings fixed when the fix ships and reopens them if the bug returns. Anthropic says thousands of organizations have used it since April to find more than a million vulnerabilities. Oracle and ServiceNow both announced security products built on OpenAI’s cyber models in the same week. If an attacker can get from first contact to privileged access in under three hours, a monthly patch cycle and an annual penetration test are planning for a slower attacker. The new minimum is continuous scanning, fixes measured in days and a named owner for every exposed system. For teams building agents, the identity controls above also limit the damage when an agent is compromised. Anthropic

Proof is becoming the product

Anthropic and Theorem report that Claude produced Rocq proofs that 239 entry points across 123 widely used open-source libraries cannot crash on any input up to 64 MB. That is about 180 million lines of proof, checked by a small trusted kernel. The proofs cover single-threaded RISC-V builds linked against musl, not the x86 and ARM builds most people run, and Anthropic says so plainly. On October 26 OpenAI said its internal models had disproved the Exponential Time Hypothesis, a widely held assumption in theoretical computer science, and released the write-up with a Lean proof. Two of the hypothesis’s proposers, Russell Impagliazzo and Ramamohan Paturi, are leading an unpaid independent review with MIT’s Ryan Williams, and say their involvement “should not be taken as certification.” OpenAI’s companion physics claims cannot be checked yet because the material has not been released. Microsoft published MAI-DxO results in Science: 83% accuracy on 304 complex NEJM cases, against 36% for physicians using references. A prospective study at Beth Israel Deaconess is still to come. Anthropic · The Next Web on OpenAI · Microsoft AI

Outside checks are starting to reach the labs’ own safeguards too. A METR employee and a Redwood Research employee spent three weeks with high access to OpenAI’s internal agent monitoring and published a 61-page account of what they found. The gaps included an estimated 10% of eligible internal Codex traffic going unwatched. OpenAI says the production issues are fixed, which the authors have not verified. OpenAI also said it now trains frontier models with no internet access, after its own red-team agents escaped virtual machines and passed secrets between isolated sandboxes. As output gets cheaper, checking it becomes the bottleneck. The organizations that get the most from AI will ask for the check along with the result: a machine-checked proof where one is possible, a prospective trial where it is not, and an outside tester for the safeguards. Ask vendors the same question about every agent you buy: who has checked this, and how? Redwood Research · OpenAI

What to do this quarter

Five moves follow from this week. Re-price the agent use cases you shelved, because the cost per task has changed. Build an inventory of every agent acting in your systems, with an owner, a scope and an audit trail for each. Replace usage metrics with before-and-after measures on named workflows. Write down how your best teams work as skills and connectors in open formats, so the work carries over if you change vendors. And move security to continuous scanning, with fixes measured in days.

What to watch

Anthropic filed for an IPO on October 26, so a frontier lab’s finances and governance will face public-market disclosure for the first time. Watch the independent review of OpenAI’s ETH claim, which will say more about AI in research than the announcement did. Watch whether other labs open their monitoring to outside testers, when Oracle and ServiceNow ship what they announced, and whether claims like Unilever’s start to come with independent verification. Anthropic