Leaky memory pools and machine-checked proofs · Morning Gist
Tuesday, October 275 stories · 16 min
Leaky memory pools and machine-checked proofs
Today: a silent data leak at Cloudflare, Netflix adding a language model to its rule-based debugging, a cheaper OpenAI model for agents, AI-claimed proofs and Meta's network for AI.
Picked from 57 new articles across 23 sources · arrow keys for other days
Today in 30 seconds
30s left
Cloudflare's GLM-5.3 model put other customers' prompt data into 155 long-prompt responses over 13 days. The cause was a too-small memory pool plus an SGLang bug. story 1 ↓
Netflix's Pensive AI uses a language model to pull out errors for every failed job, including the roughly half its hand-written rules marked "unknown." story 2 ↓
OpenAI's GPT-6.1 Terra costs $1/$5 per million tokens, half as much as GPT-5.6 Terra, and claims 50.3% on command-line coding, up from 21.5%. story 3 ↓
OpenAI says AI proved three major open problems, each machine-checked in Lean. One could overturn a standard assumption behind many "no fast algorithm" results. story 4 ↓
Meta showed 102.4-terabit switches and flatter network designs at the Open Compute Project summit, and open-sourced a software version of its MetaRoCE RDMA transport. story 5 ↓
1/5Cloudflare· Kevin Flansburg· Oct 26
Cloudflare's GLM-5.3 model leaked other users' prompt data for 13 days
A memory pool sized too small, combined with a bug in the open-source engine SGLang, made Cloudflare's hosted GLM-5.3 model put fragments of other customers' requests into 155 responses. Cloudflare fixed both and patched SGLang upstream.
Why it matters · Any team serving language models with reused GPU memory across two kinds of machines can hit this class of silent data leak, and success codes alone won't show it.
Know this first
Context from the editor, not the article · 37 sec
1 · What a KV cache is
When a language model writes text, each new token looks back at all earlier tokens. To avoid recomputing that work, engines store intermediate values called keys and values (the KV cache) in GPU memory. Long prompts need a lot of it, so engines split it into fixed-size pages handed out to requests.
2 · Prefill and decode split
Serving a request has two phases: prefill reads the whole prompt at once and builds its KV cache; decode generates the reply one token at a time. Large deployments run these on separate GPU pools (disaggregation) and copy the cache between them over the network.
3 · Why pages aren't wiped
2/5Netflix Tech Blog· Netflix Technology Blog· Oct 26
Netflix adds a language model to its rule-based job-failure diagnosis system
Netflix built a large language model into Pensive, its tool for diagnosing failed data jobs. The old rules still run. The model fills their gaps, and evaluation checks block bad changes before release.
Why it matters · This is a detailed production example of adding an AI model to existing deterministic tooling, covering the hard parts: deadlines, schema migration, caching, evaluations and release gates.
Know this first
Context from the editor, not the article · 43 sec
1 · Why failed jobs are costly
Data platforms run scheduled jobs, such as Spark computations and SQL queries, that feed reports and models. When a job fails, an engineer has to read several long logs, work out whether the bug is theirs or the platform's, and decide whether to retry, change settings or escalate. Across thousands of failures a day, that adds up to a lot of time.
2 · Rules versus models
Classic log triage uses regular expressions (text patterns) written by hand for known errors. These rules are precise and cheap, but they only catch failures someone has already seen. Large language models (LLMs) can read unfamiliar logs, but they are slower, cost money for every call, and can make up details.
3 · Evaluating LLM systems
3/5OpenAI· Oct 26
OpenAI releases GPT-6.1 Terra, a cheaper model for agents and coding
OpenAI released GPT-6.1 Terra, its fast, low-cost model tier. OpenAI says it roughly matches the company's pricier models on computer-use and vision tests, makes far fewer factual errors, and costs half as much per token.
Why it matters · If the claims hold, agent and coding workloads that only made sense on expensive models could run on a model priced at $1 and $5 per million tokens.
Know this first
Context from the editor, not the article · 41 sec
1 · OpenAI's model tiers
OpenAI sells several model families at different price points. In this release, Astra is described as its most capable frontier model. Sol is another high-end family. Terra is the fast, cheap tier meant for high-volume work. A new Terra is judged mainly on how close it gets to the expensive tiers for much less money.
2 · Tokens and reasoning effort
Models read and write text in chunks called tokens, roughly three-quarters of a word each. APIs charge per million tokens, and output costs more than input. Reasoning models can be set to different 'effort' levels. Higher effort lets the model think longer, which spends more tokens and raises accuracy and cost.
3 · Computer-use agents
4/5OpenAI· Oct 26
OpenAI claims AI proofs of three major open problems, hands them to experts
OpenAI says its internal models proved the local smoothing conjecture in mathematics, disproved the Exponential Time Hypothesis in computer science, and proved Yang–Mills and QCD exist in physics. Outside experts will now check and explain the results.
Why it matters · If the computer-science result holds, a standard assumption behind hundreds of "no fast algorithm exists" results falls, and AI becomes a source of proofs that people then have to verify.
Know this first
Context from the editor, not the article · 43 sec
1 · Conjectures and machine-checked proofs
A conjecture is a statement experts believe but nobody has proven. Lean is a proof assistant, software that checks every logical step of a proof mechanically. A Lean proof is very hard to fake, but it only proves the statement exactly as it was typed in. Humans still have to confirm that the typed statement matches the real conjecture.
2 · Exponential Time Hypothesis
Boolean satisfiability (SAT) asks whether some true/false assignment to variables makes a logic formula true. Trying every assignment of n variables takes about 2^n steps. The Exponential Time Hypothesis, proposed by Impagliazzo and Paturi around 1999, says 3-SAT, a common restricted form, cannot be solved in time that grows slower than exponentially in n. Many hardness proofs assume it.
5/5Engineering at Meta· Oct 26
Meta details AI network stack: 102.4-terabit switches, flatter fabrics, open RDMA transport
At the 2026 Open Compute Project summit, Meta described how it networks huge AI clusters. Highlights: liquid-cooled 102.4-terabit switches, an eight-plane two-tier GPU fabric, open Ethernet standards, and open-source RDMA software.
Why it matters · For large-model training, the network now limits speed as much as the GPUs do, and Meta is pushing the industry toward open Ethernet rather than proprietary interconnects.
Know this first
Context from the editor, not the article · 35 sec
1 · Why AI training stresses networks
Training a large model splits work across thousands of GPUs, which must keep swapping results through collective operations such as all-reduce, where every GPU sums its numbers with everyone else's. Each step waits for the slowest exchange, so a single congested or broken link can stall the whole cluster.
2 · Scale-up, out, and across
Scale-up links a few dozen accelerators in one rack through very fast switches, so they act almost like one big chip. Scale-out connects many racks in a data center. Scale-across connects data centers, campuses and regions over long distances. Each layer needs different hardware and protocols.
For speed, inference engines reuse memory pages without zeroing them; the next request simply overwrites them. That is safe only if the engine tracks exactly which request owns each page and what it has actually written. Any bookkeeping mistake means one request can read another's leftovers.
Diagram of how a rejected request's one-page transfer left decode reading other users' stale cache pages.
Cloudflare has disclosed that for 13 days its hosted GLM-5.3 model sometimes answered one customer with pieces of other customers' prompts. Between August 27 and September 9, 2026, 155 responses were affected, all to prompts longer than 681,280 tokens. Security researcher Gadi Evron of Knostic reported the problem on September 8. Cloudflare took the model offline the next day and brought it back, patched, that evening. It found no sign that anyone exploited the bug on purpose.
The setup
1, Cloudflare's hosted model service, runs GLM-5.3 (a coding-focused model from Z.ai) on 2, an open-source inference engine. The engine runs in a "3" setup, meaning the work is split across two groups of GPUs. Prefill GPUs read the whole prompt and compute its 4: the stored intermediate attention data the model checks as it writes each new token. They copy that cache over 5, a network transfer straight from one machine's memory into another's, to decode GPUs, which generate the reply.
The KV cache sits in a pool of fixed-size memory pages. Pages are reused without being wiped, so the engine has to track which request owns which page.
Two mistakes that combined
The first was a misconfiguration. The model advertised a 1,048,576-token 6, the longest prompt it accepts. But SGLang sizes the memory pool automatically from whatever GPU memory is left over, and on the prefill machines that came to only 681,280 tokens. Cloudflare knew about the gap but assumed the engine would reject prompts that didn't fit. Its tests checked that requests came back with success codes. They never checked whether the replies made sense.
The second was an SGLang bug. The engine marked an oversize prompt as rejected and swapped it for a one-token placeholder. On a single machine that works fine. In split mode, though, the queues checked whether a request was "finished," not whether it was "rejected," so the request kept going. Decode had already reserved pages for the full prompt, say 8 of them. Prefill computed one page for the placeholder, sent it, and signaled "transfer complete." Decode then read all 8 pages, and 7 of them still held earlier users' data. The client got HTTP 200 (success) and a coherent answer that contained someone else's content.
The fix
Cloudflare enlarged the pool to about 2.04 million tokens, roughly double the context window. It also patched the engine to fail rejected requests before any memory is reserved or transferred. SGLang has since merged equivalent fixes, along with related hardening: checksums that verify the transferred cache, and "7," which keeps pages reserved until network writes still in progress are confirmed finished. Cloudflare recommends that operators upgrade to v0.5.22 or later and compare pool size against context length on every machine.
What's still open
Cloudflare argues these fixes reduce this class of bug but can't eliminate it. Over the summer it built a prototype that tags every page with its owner and checks the tag on every read. The overhead was under 1%, but Cloudflare turned it off because of reliability problems. It now plans to use 8, mathematical proof, on the transfer protocol.
Cloudflare has published a postmortem, coordinated with the 1 maintainers, on a data leak in its hosted GLM-5.3 model. From launch on August 27, 2026 until September 9, some responses contained data from other customers' requests made shortly before. In total 155 responses were affected, all to prompts longer than 681,280 tokens. After excluding its own testing and the researcher's, Cloudflare says the affected requests match ordinary long-context use in timing and volume, with no evidence of deliberate exploitation. No other model on the platform was affected.
How the model is served
2 is Cloudflare's hosted model service. GLM-5.3 is a text model from Z.ai built for agentic coding. Cloudflare runs it on SGLang, an open-source inference engine (the software that loads a model onto GPUs and serves requests), in 3 prefill/decode mode. A pool of prefill GPUs reads the prompt and builds its 4, the stored keys and values the model's attention mechanism looks back at for every token it generates. That cache is then copied via 5, a transfer library, over 6 (remote direct memory access: one machine writes straight into another's memory with no CPU involved) to a pool of decode GPUs that generate the response.
The KV cache is a shared pool of fixed-size pages. A request gets pages when admitted and gives them back when done. Pages are not zeroed between requests, a common choice made for speed. So the engine alone is responsible for knowing who owns each page, and that ownership is spread across tasks on one machine and across the network: the prefill node holds a live, writable reference to pages on the decode node.
Two details matter here. The pool size is not something you configure: SGLang computes it at startup from whatever GPU memory remains after loading the model weights. The context length the model advertises is a separate setting. Nothing forces the two to agree.
Issue one: a mismatch Cloudflare knew about
On GLM-5.3's prefill nodes the pool came to 681,280 tokens, while the advertised 7 was 1,048,576 tokens. SGLang logs the pool size at startup and exposes it as a metric, and Cloudflare saw the gap before launch. Its long-context benchmarks returned success codes and streamed without error frames, so the team assumed the engine handled the difference gracefully. Cloudflare calls this the critical gap in its testing: it checked status codes and performance, not whether the output was coherent.
Issue two: rejected, but not finished
When a prompt exceeded the pool, SGLang's scheduler rejected it. The rejection path recorded an error for the client and swapped the prompt for a one-token placeholder, so the request could drain through normal batching without taking real memory. On a single node this worked: the placeholder ran and the client got an error.
In disaggregated mode, the admission queues on both sides asked whether a request was finished, not whether it was rejected. The rejection was stored in a different field (to_finish rather than finished_reason), so finished() returned False and the request looked alive. Cloudflare's worked example uses an 8-page prompt:
Bootstrap. The router tells decode the prompt length; decode reserves 8 pages.
Prefill admission. The rejected request passes the finished() check.
Prefill forward pass. It runs on the one-token placeholder.
Transfer. Prefill sends one page and signals "complete."
Decode admission. Same check, so the handoff is accepted.
Decode attention. Generation reads all 8 reserved pages. Only page 0 was written by this request; pages 1–7 still hold earlier users' prompts and partial outputs.
Response. HTTP 200 instead of 400. The reported prompt token count matches the long prompt, and the reply is coherent. It just arrives suspiciously fast.
This was not a timing race. Every request over the threshold leaked. Another user had reported the bug to SGLang as issue #30233 on July 6, which Cloudflare found only during the investigation.
Response and fixes
The report arrived via HackerOne, a bug-bounty platform, at 23:11 UTC on September 8. Cloudflare declared an incident at 13:22 on September 9. Its security team reproduced the leak across two accounts within 25 minutes, and the model was made private by 14:00. A test node with a larger pool proved immune by 14:35. By 19:04 a rebuilt deployment was ready, and service was restored at 19:40.
There were two fixes. First, Cloudflare matched GLM-5.3's configuration to GLM-5.2's, which freed enough memory for a prefill pool of about 2.04 million tokens, roughly double the context window, so a valid request never reaches the rejection path. Second, because the pool size shifts with any change to quantization, parallelism or model version, Cloudflare patched the engine to retire a rejected request at admission, with its original error, before any memory is reserved or transferred. It proposed this upstream as #38704, which also had decode check that the number of tokens received matches the number reserved. SGLang merged #38935, which follows this approach. A related fix, #36988, had already landed on September 6 but was not yet released.
A broader class of bugs
Cloudflare places this in a family of KV-cache memory-safety bugs it has chased for months: a page freed, reused or read while something else still has a claim on it. The first kind is lifetime trouble within one node, where generation, offload to host memory and abort paths all share pages. The second is a cross-node race: if a request is aborted mid-transfer, writes already sent over RDMA can't be recalled, so if decode frees those pages immediately, late writes land in another request's cache. Since the incident Cloudflare has:
extended "8" (holding pages until in-flight writes are confirmed finished) to prefill's pages and to every failure type
capped Mooncake transfer batch sizes so no single call outlasts the release timeout
changed its load balancer so a client disconnect doesn't abort a request mid-transfer
added a pre-deployment check covering pool size versus context length, deferred release, batch bounds and required patches
Upstream, SGLang has merged more than a dozen related changes. They include an optional checksum that decode verifies on the transferred cache (--disaggregation-enable-kv-checksum), fixes to a KV "canary" corruption detector, and deferred release on by default. Cloudflare urges operators to run v0.5.22 or later, measure pool size on every node after every change, and not rely on a proxy to enforce limits. It notes that the checksum and canary don't yet cover every model architecture, including GLM-5.3 itself.
What remains open
Cloudflare argues that config checks and lifecycle fixes shrink the attack surface but can't rule out the next bug. Over the summer it prototyped per-page ownership tags: each page's tag changes on reallocation, each request records the tags it expects, and decode checks them before reading. Overhead was under 1% in throughput and tail latency. But Cloudflare disabled it shortly after testing on GLM-5.2 because of reliability problems, and it was tied to specific models. The ironic part is that this was weeks before the incident. A production version is being built with SGLang.
Further out, Cloudflare plans to apply 9, as it has for DNS and consensus systems, to model the RDMA transfer protocol and prove as much as it can that prefill and decode can't disagree about what was written. It concedes the proofs will leave gaps.
Remember
Success codes hid the leak; Cloudflare's tests never checked whether long-context output was actually coherent.
Engine-computed memory pools and configured context lengths can silently disagree; check them on every node after every change.
Reusing unzeroed GPU memory makes page-ownership bookkeeping a security boundary between customers.
Because model output varies from run to run, teams build "evals": fixed datasets of inputs paired with expected answers, scored by scripts or by another LLM acting as a judge. Re-running evals after each change shows whether quality went up or down. This is the model-era version of a regression test suite.
Overall design: always-on extraction and on-demand debugging share log sources, the model gateway, tracing and the cache.1 / 4
Netflix's data platform runs millions of workloads a day, and about 100,000 of them fail on peak days. Its diagnosis tool, Pensive, matched logs against hand-written rules built from regular expressions (text patterns). That made about half of failures self-service. But over one three-month stretch, roughly half of seven million classifications came back "unknown." Netflix's new Pensive AI adds a 1 on top of those rules without replacing them.
Two paths
Error extraction runs on every failed step in 2, Netflix's workflow orchestrator. The model is not asked to copy out the error text, since generating output is slow and costly. Instead, Pensive numbers each log line, and the model returns only the first and last line numbers of the error. Pensive then cuts that range out of its own copy of the log. The output is always two numbers, and the text shown to the user cannot be invented by the model. Maestro allows 90 seconds for this step, so the AI calls share a deadline, and late ones are dropped while the old rules still run.
On-demand debugging writes a root-cause analysis with suggested fixes. It is available in the UI and through 3 (Model Context Protocol, a standard way for AI agents to call tools). Each answer takes up to a minute, so it runs only when someone asks. Results are cached per failed step attempt, so everyone sees the same answer and repeat requests skip the model. A 4, which succeeds only if no record exists yet, makes sure only one request generates the answer. Answers stream to the browser, and generation keeps going even if the user closes the page.
Measuring quality
Wherever an old rule fires, its output becomes a reference answer. An 5 checks that the AI still finds that error ("inclusion"). A second judge rates whether each extracted error is useful ("precision"). A script flags boilerplate lines that show up in more than 30% of workflows. Logs normally expire within 7–30 days, so they are archived to S3 storage, which lets experiments rerun on identical inputs. Every pull request is tested against these evals in a preview environment, and the precision and inclusion scores must clear thresholds before merging.
Results and caveats
AI extraction now covers 100% of failures. Failures where nobody used Pensive AI saw 321% more manual log-digging. The authors stress that this is observational, not proof the tool caused the difference. Every thumbs-down sends a Slack alert to the team.
The AI does not yet decide whether Maestro retries a job. The authors say that needs a higher bar, because wrongly marking a recoverable failure as permanent turns it into a hard failure.
Netflix's data platform runs millions of workloads a day on engines such as 1 (distributed data processing), Trino (SQL queries), Druid (an analytics database) and Titus (Netflix's container platform). On peak days about 100,000 of them fail. The Netflix Tech Blog describes Pensive AI, which adds a 2 to Pensive, the platform's existing failure-diagnosis system. The authors' main argument is that the reliability comes from the engineering around the model calls, not from the model itself.
The problem with rules
The original Pensive collected logs from failed jobs and ran regular expressions and hand-written Java rules over them. A rule named SparkContainerOOM, for example, matches "Container…is running beyond physical memory limits…Killing container" and marks the failure as not worth retrying. Pensive passed its verdicts to 3, Netflix's workflow orchestrator, which uses them to decide whether to retry. This made about 50% of failures self-service, and some were fixed automatically.
Rules only grow when someone notices a new failure mode, writes a rule for it, and keeps it current as log formats change. Over one three-month period, Pensive classified about seven million job failures, and roughly half landed in "unknown."
Two paths
Pensive AI has two paths that share log sources, an LLM gateway, tracing and a cache.
Always-on error extraction runs on every failed step attempt (one execution of one step in a Maestro workflow). Asking a model to copy out a long stack trace would be slow and expensive, because generating output tokens costs far more time than reading input. So Pensive numbers every log line and sends {lineNumber, text} records. The model returns just two integers: the first and last line of the error. Pensive then cuts that range out of its own copy of the log. Output cost stays the same whether the error is three lines or three hundred, and the displayed text cannot be hallucinated, since it comes straight from the log. The model can still pick the wrong range, which is why evaluation matters.
Maestro allows 90 seconds for this post-processing. The legacy rules always run. The per-log AI calls run in parallel under one shared deadline set well inside that limit, and any call that misses it is dropped so the response still returns on time.
The data format changed too. The old output was one flattened error string. The new output is a list of errors, one per log source, each with a link back to the original log. Netflix added the new field alongside the old one rather than replacing it. Data Portal, the pipeline UI, uses the AI errors when they exist and falls back to the legacy string otherwise. Old failures were not backfilled because their logs had already expired. The migration is still under way: the query editor, the Workbench notebooks and some Slack integrations still read only the legacy field.
On-demand debugging produces a root-cause analysis and suggested fixes. It is available through APIs, through 4 (Model Context Protocol, a standard way for AI agents to call tools) and in Data Portal. A response takes tens of seconds to a minute, so it runs only when someone asks. Most failed steps are never opened.
Caching and streaming
The unit of work is the failed step attempt, not the person asking, so everyone sees the same diagnosis. Responses are cached by step attempt. A second request, from the UI or from MCP, becomes a key-value lookup instead of another model call. When several requests arrive at once, a 5 (a write that succeeds only if no record exists yet) creates an "in progress" record. Whoever wins the write generates the answer and the others wait for it. If a record stays in progress past an abandonment timeout, it is reclaimed. Entries expire after 90 days. Callers can read the cached answer, generate one if none exists, or force a regeneration.
Answers stream as they are produced. The service sends 6 (a one-way HTTP stream), and a 7 layer passes them to the browser over a 8. Each event carries the full text so far, not just the newest piece. That repeats some text, but the client needs no reassembly logic, and a dropped event is corrected by the next one. Generation is not tied to the connection: if the user disconnects, the answer still finishes and lands in the cache.
Evaluating the extraction
Labelling data is usually the expensive part, so the team reuses the legacy rules. Wherever a rule fires, its extracted error serves as a reference label. The authors admit some rules may be stale, so this is a regression floor rather than ground truth. Production logs expire after 7–30 days, so Pensive copies fetched logs to S3 in the background and never overwrites a snapshot. Experiments can then be rerun on identical inputs without loading the source systems.
They track four signals:
Inclusion: an 9 checks that the legacy error still appears among the AI's extracted errors, even if worded differently.
Precision: a second judge, shown only the AI's output, rates whether each error is meaningful and actionable.
Repeated noise: a script flags lines that appear in more than about 30% of workflows. The resulting exclusion list has just three lines, each of which had shown up in nearly every extraction.
Latency: recorded per call, because a quality gain that adds a lot of work also adds cost.
For debugging, an LLM searches internal support Slack threads for resolved problems tied to a workflow. A second model writes a reference answer from each thread, which is paired with that failure's archived logs. Tracing through 10 puts the prompt, completion, tool calls and latency in one view. The team says this helped them fix weak answers even before the evals were comprehensive.
Gating releases
Every pull request is deployed to an isolated preview environment, where a 11 (continuous integration) job runs the evals. Precision and inclusion thresholds must pass before merge. The evals run again after a build is promoted, and a miss pages the on-call engineer. A scheduled run against production catches gradual drift.
Results and limits
AI extraction now covers 100% of failures. Failed attempts where nobody used Pensive AI averaged 321% more manual log-exploration actions than attempts where someone did. The authors call this observational, not causal, and make no claim about time to resolution. Users who already prefer the tool may also simply be different users. Every thumbs-down is linked to its exact trace through a shared logId and sends a Slack alert during business hours.
What the AI does not yet do is make retry decisions. The authors plan "Pensive AI Error Classification" to replace the rules that label failures as restartable or not, and as platform- or user-caused. That carries a higher bar: wrongly marking a recoverable failure as non-restartable turns it into a hard failure, while wrongly retrying a permanent failure wastes compute. They are also exploring "Deepthink," an opt-in agent that routes each investigation to a specialised skill and draws on documentation, source code and read-only queries. The post does not name the models it uses or give per-call costs.
Remember
Having the model return line numbers rather than copied text keeps output cost fixed and stops it from inventing error text.
The old rules became free reference labels and a minimum quality bar for evaluating the model's output.
Archiving logs before they expire keeps evals repeatable; precision and inclusion thresholds then gate every pull request.
A computer-use agent is a model that runs software for you. It looks at screenshots, then clicks, types and runs commands to finish a multistep task. Benchmarks for agents hand the model realistic jobs, such as filling in forms or editing files, and check whether the end result is correct.
Image: OpenAI
OpenAI has released GPT-6.1 Terra, the newest model in its fast, low-cost tier. It sits below Sol and Astra, which OpenAI calls its most capable model. API prices are half those of the previous Terra (GPT-5.6) and of GPT-6.1 Sol. OpenAI says capability goes up anyway.
Why a cheap model matters
1 are models that complete tasks by taking screenshots, clicking, typing and running commands. One agent task can use a huge number of 2, the roughly word-sized chunks of text that models are billed by. At volume, price per token decides whether automation pays off. OpenAI's example is reading invoices and entering them into accounting software. Smaller, faster models usually give up accuracy, so the real question is how much capability survives the cut.
What OpenAI reports
Results are given at different 3 levels, a setting that lets the model think longer, spending more tokens for better answers.
Computer use: On Agents' Last Exam, a set of professional computer tasks such as turning architectural drawings into 3D models, Terra at medium effort scores 15 points higher than GPT-5.6 Terra at about a third of the cost. OpenAI says it matches GPT-6 Astra at a tenth of the per-token price. At maximum effort, OpenAI puts its cost per task at about 9x lower than Anthropic's Claude Opus 5.5. It also says Terra runs over three times faster than Astra and Sol.
Price and availability
The API model is gpt-6.1-terra. It costs $1 per million input tokens, $5 per million output tokens, and $0.05 per million 6 (recently reused text, billed at a 95% discount). As an illustration, a call that sends 3,000 tokens and gets 500 back costs about half a cent. Terra is also available in ChatGPT Work and 7, OpenAI's coding agent, on paid plans.
Safety and caveats
Under OpenAI's 8, its system for rating dangerous capabilities, Terra reaches the "Critical" cybersecurity level. OpenAI says it carries Astra's safeguards and resists 9, where hidden instructions in a document or webpage try to hijack the agent. All the figures are OpenAI's own. Many are relative claims without absolute scores, and the factuality test is internal.
OpenAI has released GPT-6.1 Terra, the newest model in its low-cost, high-speed tier. The company pitches it at everyday office and engineering work: drafting documents, reading technical drawings, filling out forms, editing video and writing code. Its headline claim is that Terra now gets close to OpenAI's expensive models on several agent and vision benchmarks at a fraction of the price. Standard API prices are 50% lower than both its predecessor, GPT-5.6 Terra, and the higher-tier GPT-6.1 Sol.
The problem Terra is aimed at
The models that score best on hard tasks are also the slowest and most expensive to run. That matters most for agents: models that work through a task step by step, taking screenshots, clicking, typing and running commands. One agent task can use tens or hundreds of thousands of 1 (a token is a chunk of text, about three-quarters of a word). Multiply that across thousands of tasks a day and per-token price decides whether automation pays for itself. OpenAI's example is reading incoming invoices and typing their details into accounting software. The job is boring and high-volume, and it is only worth automating if each run is cheap.
Making a smaller or faster model usually costs accuracy. So the question for any release like this is how much capability survives the price cut.
What OpenAI reports
Most results are given at different "2" settings. This is a dial that lets the model think longer before answering, using more tokens for better accuracy.
Computer use.3' Last Exam is a benchmark of professional tasks done on a computer. Examples include turning architectural drawings into a 3D model, and reviewing an animated film shot by shot to produce a time-coded log for a restoration team. At medium effort, Terra scores 15 percentage points higher than GPT-5.6 Terra at about one-third the cost. OpenAI says it performs on par with GPT-6 Astra, its most capable model, at one-tenth the price per token. At maximum effort, OpenAI says Terra uses about a third as many tokens per task as Anthropic's Claude Opus 5.5 and costs a quarter as much per token, which works out to about 9x lower cost per task. Multiplying those two ratios would give 12x, and the article doesn't say why its figure is lower. Terra also finishes tasks more than three times faster than GPT-6 Astra and GPT-6.1 Sol. On OSWorld 2.1, a benchmark of multistep tasks in desktop applications, Terra at medium effort beats GPT-5.6 Terra's best score at a fraction of the cost per task. Absolute scores aren't given in the text.
Vision.4 tests reasoning over images such as diagrams, charts and figures across many academic subjects. Terra beats GPT-5.6 Terra at every effort setting and nearly matches Astra and Sol. Again, the text gives no exact numbers.
Factuality. A 5 is when a model confidently states something false. OpenAI tested Terra on an internal set of prompts built to provoke errors. At low effort, the error rate fell from 53.6% with GPT-5.6 Terra to 16.7%. At maximum effort, it fell by 18 points to 4.3%, close to Astra and Sol. Because the benchmark is internal, outsiders can't check what the prompts look like or how hard they are.
Coding.6 measures how well coding agents solve problems from a command line. One example is fixing a webpage whose layout shifts as it loads. At maximum effort, Terra solves 50.3% of tasks, more than double GPT-5.6 Terra's published 21.5%. OpenAI still recommends Sol and Astra for the hardest coding work. On Terminal-Bench-Science 0.1, an early benchmark of research tasks done through code (such as tracking cell divisions in a time-lapse video), Terra at maximum effort beats Sol at lower cost. It comes within five points of Claude Opus 5.5 at under a fifth of the estimated cost.
Pricing, with a worked example
The API model name is gpt-6.1-terra. Prices are $1 per million input tokens, $5 per million output tokens, and $0.05 per million 7. Cached input is text the model has seen recently, such as a long system prompt reused on every call, and it is billed at a 95% discount.
As an illustration, with made-up but plausible sizes: say an invoice-extraction call sends 3,000 input tokens and gets back 500 output tokens. That is $0.003 for input plus $0.0025 for output, about half a cent per invoice, or roughly $5,500 per million invoices. If 2,000 of those input tokens are a fixed instruction prompt that hits the cache, input cost falls to about $0.0011. The cache discount matters a lot for agents, which resend the same long context on every step.
In ChatGPT Work and 8 (OpenAI's coding agent), subscription allowances stretch further with Terra. OpenAI says the same allowance covers more tasks than with GPT-5.6 Terra and substantially more than with Sol or Astra. It is available today on Plus, Pro, Enterprise and Edu plans.
Safety
OpenAI's 9 is its internal process for rating models on dangerous capabilities and deciding what safeguards each level needs. Under it, Terra meets the "Critical" threshold for cybersecurity, meaning it is rated as highly capable at offensive cyber tasks. OpenAI says Terra keeps the protections built for GPT-6 Astra, but the article doesn't describe what those are. OpenAI also says Terra is better than its predecessor at staying within the scope of a task and at telling users about its limitations and blockers. It also reports strong resistance to 10, where malicious text inside a webpage or document tries to hijack the agent. Details are in a separate 11, the document that describes a model's safety testing.
What to keep in mind
All the numbers come from OpenAI, and the post gives few absolute scores. Most claims are relative ("on par," "nearly matches," "a fraction of the cost"). The factuality result rests on an internal benchmark. Cost-per-task comparisons depend on how many tokens each model chooses to spend, so results on your own workload may differ. The clearest takeaways are the 50.3% Terminal-Bench score, the error-rate drop, and the price.
Remember
The command-line coding score more than doubled to 50.3%, but OpenAI still recommends its pricier models for the hardest coding.
At $1 input and $5 output per million tokens, with 95% off cached input, cheap agent loops look viable.
Most claims are relative and come from OpenAI itself, and the factuality result uses an internal benchmark.
Quantum field theories such as quantum chromodynamics (QCD) predict experiments with great accuracy. Nobody has proven that they exist as well-defined mathematical objects in four-dimensional spacetime. The Clay Mathematics Institute offers a $1 million Millennium Prize for proving that Yang–Mills theory exists and also has a "mass gap".
quantum chromodynamics
QCD: the theory of the strong force, describing how quarks and gluons interact.
Image: OpenAI
OpenAI says its internal models have solved three long-open problems, one each in mathematics, computer science and physics. It isn't writing papers about them. It calls the AI output "raw research data" and is handing it to outside experts to check and explain.
The three claims
Mathematics. In 1991 Christopher Sogge proposed the 1: when a wave focuses, the extreme focusing is brief, so at a typical moment the wave is far milder than at its worst. It had been proven only in two spatial dimensions, in 2019. OpenAI says its model proved it in every dimension. That would also settle two famous problems that follow from it, the 2 and Stein's restriction conjecture. The only detail given about the method is that it uses a new auxiliary partial differential equation.
Computer science.3 (SAT) asks whether some true/false assignment makes a logic formula true. The 4 (ETH) assumes SAT cannot be solved meaningfully faster than exponential time. Hundreds of papers rely on ETH to argue that problems in graphs, databases and biology have no fast algorithms. OpenAI says its model disproved ETH.
Physics. Quantum chromodynamics (QCD) is the theory of quarks and gluons. Physicists use it constantly, but no one has proven it exists as a rigorous mathematical object in four dimensions. OpenAI claims proofs for QCD, for pure 5 (its gluon-only core) and for a simple grand unified theory that includes the Standard Model.
OpenAI says each proof was checked in 6, a proof assistant that verifies every logical step. The article doesn't say whether the QCD proof was formalized, only the Yang–Mills one.
Three ways to release
Math: the AI writeup and Lean proof are on GitHub, and anyone can work on them.
Computer science: also public, with a group led by Russell Impagliazzo and Ramamohan Paturi (who proposed ETH) and Ryan Williams. OpenAI will fund a conference.
Physics: Nobel laureate David Gross leads a group that chose to withhold the AI artifacts while it writes its own account.
There are no non-disclosure agreements. OpenAI claims no academic credit, and participants are unpaid and speak for themselves. OpenAI admits that picking the first experts creates an imbalance in who learns what first.
Caveats
No outside checks yet. No one outside OpenAI has verified any of the three claims.
Lean has limits. It confirms the proof matches the formal statement. Humans still have to confirm that statement is the real conjecture.
ETH is not P vs NP. Disproving ETH means faster than exponential time, not polynomial time. The article gives no algorithm and claims nothing about P vs NP.
No Millennium Prize claim. The prize problem also requires a "7", which the article doesn't claim.
OpenAI says its internal models have produced three results that experts would rank among the major open problems in their fields: a proof in mathematics, a refutation in computer science, and an existence proof in mathematical physics. OpenAI is not writing papers about them. It calls the AI-generated manuscripts "raw research data" and is asking outside experts to turn them into human understanding, using a different release strategy in each field.
The math result: waves, Kakeya and restriction
Harmonic analysis is the branch of mathematics that breaks functions into waves. In 1991 Christopher Sogge proposed the 1 about how waves behave when they focus. It says extreme focusing can only last a short time: at a typical moment, a wave is far less concentrated than at its worst moment. OpenAI notes this "worst case versus average" pattern shows up throughout mathematics.
The conjecture has strong consequences. It implies the 2, roughly that a set containing a unit line segment pointing in every direction cannot be "small" in a precise dimensional sense. It also implies Stein's restriction conjecture, about the Fourier transform (the tool that splits a function into frequencies) restricted to curved surfaces. Guth, Wang and Zhang proved local smoothing in two spatial dimensions in 2019. Wang and Zahl proved Kakeya in three dimensions in 2025. OpenAI says its model proved local smoothing in every dimension, which would settle Kakeya and restriction in all dimensions as well. The only detail given about the method is that it rests on "a novel auxiliary partial differential equation."
The model produced the proof on October 18, 2026, and it was formalized in 3, a proof assistant that checks every step mechanically, the next day.
The computer science result: the 4 is false
5 (SAT) asks whether some true/false assignment to a formula's variables makes it true. It is the classic "NP-complete" problem at the centre of the P vs NP question: whether every problem whose answer can be checked quickly can also be solved quickly. The Exponential Time Hypothesis (ETH) makes a stronger claim than P ≠ NP. It says 3-SAT needs genuinely exponential time, so no algorithm runs in time like 2^√n.
Researchers use ETH as a shared assumption. "If ETH holds, this graph, database or computational-biology problem has no algorithm faster than X." OpenAI says hundreds of papers depend on it. Its model found a disproof on October 16, 2026, and Lean confirmed it on October 17. Both the natural-language writeup and the Lean proof are on OpenAI's GitHub.
The shepherds are Russell Impagliazzo and Ramamohan Paturi of UC San Diego, the researchers who originally proposed ETH, together with Ryan Williams of MIT. At their request, all raw data is public, and OpenAI will fund a conference on what the result means for the field.
Some care is needed about what follows. Disproving ETH means 3-SAT can be solved faster than exponential time. It does not mean polynomial time, so the article does not claim P = NP. It also gives no runtime and no practical algorithm. OpenAI itself says that turning this into real speedups "will require significant further research." Every result conditioned on ETH now loses its justification, but that does not make its conclusion false.
The physics result: existence of QCD and Yang–Mills
Quantum chromodynamics (QCD) is the theory of quarks and gluons and the strong force that binds them. Pure 6 is its gluon-only core: the force carriers interacting with themselves, without matter. Physicists compute with these theories routinely, but nobody has shown they exist as rigorous mathematical objects in four dimensions. 7, the field that tries to build such theories with full rigour, has stalled on this point for decades.
OpenAI claims a rigorous existence proof for QCD, for pure Yang–Mills, and for "the simplest grand unified theory" that contains the Standard Model's force fields and matter particles. It needed a unified theory because the Standard Model on its own breaks down at very short distances. The work builds on Tadeusz Balaban's earlier constructive approach. The model wrote the Yang–Mills proof on September 9 and the QCD proof on September 18. Release waited until the Yang–Mills Lean formalization finished on October 16. The article does not say whether the QCD proof has been formalized.
One caveat matters here. OpenAI says Yang–Mills existence is "part of" the Clay Millennium Prize problem. That problem also requires proving a 8, meaning the lightest particle has strictly positive mass. The article does not claim the mass gap.
The physics group is led by David Gross, who shared the 2004 Nobel Prize for asymptotic freedom (the strong force weakening at short distances), which OpenAI calls the key mechanism behind these existence proofs. The other members are Michael Douglas, Arthur Jaffe (co-author of the Millennium problem statement), Igor Klebanov and Nikita Nekrasov. This group chose to withhold the AI-produced artifacts while they write the result up themselves.
Three release experiments
OpenAI is trying three approaches:
Math: publish everything and let researchers organize themselves. This matches an earlier October 6 release, which the article does not describe.
Computer science: publish everything, with a named expert group leading the explanation.
Physics: let the expert group decide what is released and when.
The collaborations follow four stated principles. Participants sign no non-disclosure agreements and can publish freely. OpenAI claims no academic credit for the discoveries. The groups get credit for the explanations they write. Members are unpaid volunteers who do not speak for OpenAI. Separately, OpenAI has given $5 million to the Simons Foundation for workshops on AI-produced results.
OpenAI admits the main tradeoff. Picking the first shepherds decides who gets access first and creates an "asymmetry of information." The physics choice, where outsiders cannot see the proof, shows this most clearly.
What remains open
None of the three claims has been checked independently yet. That checking is the purpose of the collaborations. Lean reduces the risk of a broken argument, but reviewers still have to confirm that each formal statement really expresses the conjecture and doesn't contain a quietly weakened definition. For the long physics proofs, that confirmation is a major job in its own right. The article also says nothing about the models that produced the proofs, how much compute they used, or how many attempts failed along the way.
Remember
Lean confirms a proof follows from its formal statement. Experts must still confirm that statement is the real conjecture.
Disproving ETH weakens hundreds of conditional hardness results but gives no practical algorithm and leaves P vs NP open.
The physics claim covers Yang–Mills existence, not the mass gap the Millennium Prize also requires.
The Open Compute Project (OCP) is an industry group Facebook started in 2011. Members publish open hardware designs and specifications for servers, racks and switches, so many vendors can build interchangeable parts and buyers avoid being locked into one supplier.
Image: Engineering at Meta
Meta has published a roundup of about two dozen networking talks its engineers gave at the 2026 1 Global Summit. OCP is an industry group that publishes open hardware designs. Meta says the work supports its newest AI models and Prometheus, a training cluster it describes as gigawatt-scale. The post is mostly an index of talk videos, so it is light on numbers, but it shows the whole design.
Why the network matters
Training splits a model across thousands of GPUs, which constantly exchange results. Each step waits for the slowest exchange. Meta says this makes the network as important to AI progress as the GPUs themselves. Its executives argue the network should be built on open standards, not proprietary ones.
Inside one data center
IceCube is a new switch with 102.4 terabits per second of capacity, split into 128 ports at 800 gigabits each. It comes in two versions, built on either Broadcom's or NVIDIA's switch chip. It runs 2, Meta's own switch operating system, and sits in IcePack, Meta's first liquid-cooled network rack.
The Flattened Planar Fabric connects every GPU to eight parallel networks, called "planes." This cuts the switch hierarchy from three layers to two. It also uses 3: one data flow is spread across many paths instead of being pinned to a single path, where it could collide with other large flows.
Inside a rack, and between sites
Tahan is an Ethernet switch that links Meta's in-house 4 accelerators within a rack. This "scale-up" job usually goes to proprietary links such as NVIDIA's NVLink. Version 1.0 of 5, an open Ethernet scale-up standard Meta helped launch, came out this year. Version 1.1 is coming.
BAG is a petabit-scale top layer of switches that ties together the buildings, campuses and regions inside Prometheus.
A copper rack has thousands of links. Even at 99.9% per-link yield, that leaves about 10 bad links per rack. The links can't be repaired one at a time, so Meta manages failures statistically.
Open software
OSPA is a common design for the low-level switch layer that handles fans, power and sensors. Meta says that layer currently costs months of duplicated work for every new switch. OSPA is led by Meta, Microsoft and Alibaba, and its 1.0 spec has been submitted to OCP.
MetaRoCE is Meta's transport for 6, which lets machines read each other's memory directly, over Ethernet. Meta is releasing it as open source, starting with a user-space library called libsoftmetaroce.
The roundup gives no measured results for any of this; the details are in the linked talks.
At the 2026 1 Global Summit, the yearly meeting of an industry group that publishes open data-center hardware designs, Meta's network and hardware teams gave around two dozen talks. Meta has now published the videos and slides in one roundup. Meta says this work supports its latest AI models, Muse Wonder and Muse Spark, and Prometheus, a training cluster Meta describes as gigawatt-scale. The post is mostly a list of talks with one-paragraph summaries, so it gives few numbers or mechanisms. The useful parts are below, grouped by layer of the network.
The problem: the network now sets the pace
Meta's MetaRoCE talk states the core issue. In AI clusters, collective operations such as all-reduce (every GPU combines its numbers with everyone else's) and all-to-all (every GPU sends a different piece of data to every other GPU) are "gated by the slowest node across hundreds of thousands of accelerators." One congested path, one bad cable or one slow switch holds up a training step for the whole cluster. Omar Baldonado, Meta's senior director of data center and AI networking, argues that AI progress now depends on the network as much as on compute, and that the network should be built on open standards rather than behind "proprietary walls."
Switch hardware: IceCube and IcePack
IceCube is Meta's new switch. It has 102.4 terabits per second of capacity, split into 128 ports at 800 gigabits per second each. It is "non-blocking," meaning every port can run at full speed at the same moment. There are two versions: one built on Broadcom's Tomahawk 6C switching chip, and one (N-IceCube) on NVIDIA's Spectrum-6. Both run 2, Meta's in-house network operating system for switches. IceCube is cooled partly by liquid and partly by air, and it is "PHY-less," meaning it leaves out the separate physical-layer chips that usually sit between the switch chip and the ports. The switches go into IcePack, Meta's first liquid-cooled network rack.
Other talks covered the optics and cables that carry signals between switches. Co-packaged optics (CPO) put the optical engines on the same package as the switch chip. Meta has tested CPO at 51.2T and says the lessons may carry over to 102.4T. Linear pluggable optics (LPO) remove the retimer DSP, a signal-cleaning chip inside each optical module. Meta calls that chip a "repeated tax" in power, heat and cost across millions of links. Removing it shifts the work of signal correction, and of diagnosing faults, onto the host switch. The talk asks whether LPO can match the reliability of retimed modules across a whole fleet. The roundup doesn't give the answer. Meta also reported a large deployment of 800G active electrical cables (AECs), copper cables with built-in signal boosters for short runs, and talked about building a supply chain for near-package optics (NPO).
Scale-out: the Flattened Planar Fabric
Inside a data center, Meta's Flattened Planar Fabric (FPF) connects each GPU to eight separate network "planes," which are parallel, independent networks. This cuts the fabric from a three-tier 3 network to two tiers. A Clos network is the standard layered design of leaf, spine and super-spine switches. The roundup doesn't spell out why the planes allow fewer tiers. The usual reasoning, as general background: each plane carries only one-eighth of each GPU's traffic, so one plane can reach every GPU with fewer layers. Fewer layers mean fewer hops, fewer switches and fewer optical links.
FPF also uses 4 at the network card. Traditional routing (ECMP) hashes each data flow onto a single path. AI training produces a few very large flows, and when two land on the same path they collide. Spraying spreads the packets of one flow across many paths instead. The trade-off, again from general knowledge, is that packets can arrive out of order and the receiver has to handle that. Meta also merged the control logic on the hosts and on the switches into one combined control plane. FPF was built with NVIDIA and shared with Meta's cloud partners.
Scale-across: BAG and 5
Backend Aggregation (BAG) is a petabit-scale "super-spine," a top layer of switches that links buildings, campuses and regions inside Prometheus. The talk covered fitting hardware to the job, coping with distance, reliability and capacity planning. Meta also built new regional backbones on SRv6, a routing method in which the sender writes the packet's path into the IPv6 header as a list of segments. These backbones run FBOSS on top of 6, the Switch Abstraction Interface, a standard software interface to switch chips. Meta says it got from concept to deployment in months, and that it uses switches with small packet buffers even over wide-area distances.
Scale-up: Tahan and 7
Tahan is Meta's Ethernet-based scale-up switch for 8, Meta's in-house AI accelerator, in a rack-scale system. Tahan is built on Broadcom's Tomahawk 5 chip. Meta also previewed a design with 72 accelerators per rack on 102.4T silicon. Both are meant to show that ordinary Ethernet can do scale-up work, which is often handled by proprietary links such as NVIDIA's NVLink. ESUN (Ethernet for Scale-Up Networking) is the community specification Meta helped launch the year before. Version 1.0 came out earlier this year, and version 1.1 is on the way.
One talk gave a concrete number on reliability. A copper scale-up rack has thousands of connections. At 99.9% per-link yield, that means about 10 bad links per rack: for illustration, 10,000 links × 0.1% = 10. The connections sit in blind-mate cartridges that plug in as one unit, so a technician can't fix a single link. Meta therefore treats bad links as a statistical problem to manage, not a series of one-off bugs.
Open software: OSPA and MetaRoCE
SAI made the switch chip's data-plane software portable across vendors. The platform layer underneath is a different story: fans, power, sensors and board support are still proprietary and fragmented, and Meta says this adds months of duplicated bring-up work for every new switch. OSPA (Open Switch Platform Architecture) is a common reference design for that layer, led by Meta, Microsoft and Alibaba. Its 1.0 specification has been submitted to OCP.
MetaRoCE is Meta's transport for 9 (remote direct memory access, which lets one machine read and write another's memory without involving its CPU) over Ethernet. Meta is open-sourcing software versions of it. The first is a user-space library, libsoftmetaroce, on GitHub. A version built on 10, a toolkit for fast packet processing in user space, is coming. The transport spec was co-presented with AMD. The roundup doesn't explain how MetaRoCE differs from standard RoCE.
What's left open
This is an index of talks, so the details are in the videos. The roundup gives no measured gains from FPF, no reliability results for LPO, no latency numbers for Tahan and no performance data for MetaRoCE. What it does show is direction: Meta wants open Ethernet and open specifications at every layer, from one rack up to links between regions.
Remember
Connecting each GPU to eight parallel network planes lets Meta drop one whole layer of switching.
At thousands of links per rack, 99.9% yield still means about 10 bad links, so failures must be managed statistically.
Meta is pushing open Ethernet at every layer: inside the rack, across the data center, and between regions.
Vision: On 4, an image-reasoning benchmark, Terra nearly matches Astra and Sol.
Factual errors: On an internal set of prompts designed to cause mistakes, the error rate at low effort fell from 53.6% to 16.7%. At maximum effort it fell to 4.3%.
Coding: On 5, which tests coding agents working from a command line, Terra solves 50.3% of tasks, up from 21.5%. OpenAI still recommends Sol and Astra for the hardest coding work.
