GPT-6.1 Sol Benchmark Matches Astra on Secure Code, Costs Less

What happened

OpenAI's DevDay 2026 produced more than 20 announcements 2. One of the more consequential for developers has drawn less attention than the splashier demos: a cheaper mid-tier model that an independent security benchmark says now writes code about as securely as OpenAI's flagship.

The model is GPT-6.1 Sol, released September 29. That was one week after GPT-6 Sol 1. OpenAI describes it as an update aimed at coding, computer use, and professional work. The company says it approaches GPT-6 Astra on several evaluations while charging one-fifth of Astra's standard input and output prices 3.

Endor Labs ran the model through the same Codex harness and coding tasks it had used for GPT-6 Sol and GPT-6 Astra in its Agent Security League. Its headline verdict was "Astra-level security, a third faster, zero cheating" 1.

At the same event, OpenAI shipped Codex Security Cloud. This is a separate product that scans repositories and new commits, investigates findings, deduplicates them, and prepares fixes 3. The two announcements are easy to blur together, but they are different things. One is a model that Endor Labs measured on secure-coding tasks. The other is a security-scanning service inside Codex.

The benchmark story

The context explains why the Endor Labs result stands out. When GPT-6 Sol launched on September 22, OpenAI pitched it as Sol-tier pricing with reliability "approaching" Astra. On Endor Labs' benchmark it fell short, scoring 25.1% SecPass against Astra's 34.6% 1.

GPT-6.1 Sol arrived at the same price point with a stronger claim of near-Astra capability for coding and computer use 1. Endor Labs' testing appears to back that claim up on security specifically.

The efficiency numbers may matter just as much. GPT-6.1 Sol consumed roughly 235 million input tokens, about 94% of them cached reads, and 1.5 million output tokens 1. Both figures are below GPT-6 Sol (318M input, 2.05M output) and Astra (276M input, about 1.78M output) 1.

Pricing is unchanged at $2 per million input tokens, $2.50 for cache writes, and $10 for output. Cached input drops to $0.10, half of GPT-6 Sol's $0.20 13. In agentic coding loops that reread large amounts of context, the cached-input price often dominates the bill, so that halving is not trivial. ByteIota singled out Sol's cached pricing as one of four DevDay changes that should alter how developers build 2.

The "zero cheating" label is also significant. It suggests Endor Labs checks whether models game the tests rather than genuinely solve tasks securely, and that GPT-6.1 Sol did not. That said, the full methodology and GPT-6.1 Sol's exact SecPass figure deserve scrutiny before anyone treats "Astra-level" as settled.

Codex Security Cloud: the quiet launch

ByteIota called Codex Security Cloud "the announcement nobody covered." It argued that OpenAI quietly shipped the tool while attention went to Dots 2. ByteIota describes it as reading a repository and building a threat model from its architecture 2. InfoQ's recap lists its functions as scanning repos and commits, investigating and deduplicating findings, and preparing fixes 3.

It arrived alongside other Codex changes [3]:

• Cloud-based environments that let developers kick off remote tasks from other devices
• A CLI with voice input and an /agents interface for managing multiple delegated tasks
• A code-review workflow for GitHub pull requests and GitLab merge requests

The broader picture from InfoQ covers several more pieces. The Agents API now supports computer use and inherits multi-agent capabilities, tool search, and context compaction from Codex, with OpenAI managing execution infrastructure 3. A new Decisions API rounds out the list. ByteIota frames it as a lightweight routing and classification tool and a response to a competitor product, citing Simon Willison 2.

Where the sources diverge

The three accounts emphasize different things. InfoQ offers a neutral catalogue 3. ByteIota is openly opinionated. It recommends developers "watch, don't build for" Dots, citing a failed live demo, a voice feature that didn't work on day one, and Hacker News testers reporting that tasks taking Dots 20 to 30 minutes finished in five to six on Claude Sonnet 5.5 2. Endor Labs is the only source with independent measurement, and its focus is narrow: security outcomes and token efficiency 1.

None of them claims that Codex Security Cloud itself was benchmarked against Astra. Any framing that says the scanning product "matches Astra" conflates the model result with the tool.

The reading

The most durable takeaway from DevDay may be economic rather than flashy. If Endor Labs' results hold up, GPT-6.1 Sol closes most or all of the security gap that separated GPT-6 Sol from Astra. It does so while using fewer tokens and charging half as much for cached input.

For teams running agents over large codebases, that combination is attractive. It could push Astra toward a niche role for the hardest tasks rather than the default choice.

Codex Security Cloud is the more speculative bet. The idea of automated threat modeling and fix preparation is compelling. However, no independent evaluation of its output appears yet. Developers would be wise to trial it on real repositories before trusting its fixes.