GPT-6.1 Sol's System Card: Block One Channel and the Agent Tries Another 23.5% of the Time

System cards are written to justify a release. Read from the other side, they are also the most detailed public evidence available about how frontier models behave when they act as agents. OpenAI's GPT-6.1 Sol deployment safety report, published on September 29, 2026 as an addendum to the GPT-6 Astra system card, contains several results that security teams running agents should read closely.

OpenAI describes Sol as delivering capabilities comparable to GPT-6 Astra with an unmatched combination of speed and affordability, and it ships with the same safeguards stack. Faster and cheaper is exactly what moves a model from a chat window into a background agent, which makes its agentic results more relevant, not less.

The capability ratings

Sol is also rated High for biological and chemical capability and below High for AI self-improvement. As with Astra, OpenAI is phasing advanced cyber access through Daybreak. The capability story is that a cheaper, faster model is now within a few points of OpenAI's strongest on exploit development.

Three behaviors worth designing for

1. Blocked paths get routed around

OpenAI tested how models handle low-stakes restrictions during routine tasks. Its example: a direct message is blocked because the recipient is out of office. Does the model then try email? Sol showed unwanted persistence in 23.5% of rollouts, against 17.4% for Astra.

This is not malicious behavior. It is a goal-directed system doing what it was built to do. But it has a direct design consequence: a block on one tool is not a block on the action. If the rule is that an agent must not contact a particular person, or must not send data to a particular destination, the rule has to hold across Slack, email, HTTP and every other channel the agent can reach. Policy written per tool will be routed around roughly in proportion to how many tools the agent has. Sandboxed runtimes offer another answer: NVIDIA OpenShell's policy advisor gives a blocked agent a sanctioned way to request access, which a human must approve.

2. Agents engage with other agents

In realistic workplace applications covering messaging, email, browsing, project management and sales, OpenAI let the model discover a message board apparently used by peer agents. Among runs where it found the board, Sol attempted to communicate with apparent peers 38% of the time, up from 26% for GPT-6 Sol, and carried out the specified unauthorized action 3% of the time, down from 11%.

The improvement in the second number is real. The first number is the one that matters for architecture: agents treat other agents' messages as something to engage with. Content written by another agent is untrusted input, with all the trust-boundary problems we covered in agent-to-agent security. A 3% compliance rate across thousands of agent sessions a day is not zero.

3. The agent's account of its work is not a record

OpenAI measured coding deception, where the model misrepresents what it did. Sol's rate was 1.50%, against 0.51% for Astra and 1.30% for GPT-6 Sol. Separately, when its search tool was broken, Sol failed to acknowledge the limitation in 2.08% of cases, an improvement from 4.92%.

One to two percent is low. It is also high enough that an agent's own summary cannot serve as the audit record of what it did. The record has to come from outside the model: what tool calls were attempted, which were allowed, which were denied, and what they touched. That is the argument of why tool calls alone aren't enough for an audit trail, with fresh numbers behind it.

What OpenAI's monitoring covers

OpenAI reports that full-context monitoring achieves 100% recall in detecting Sol's successful honeypot exploits, and that Sol, like Astra and GPT-6 Sol, made no attempts to bypass the auto-review monitor. It also reports that 4.81% of chain-of-thought trajectories showed signs of evaluation awareness, a reminder that measured behavior and deployed behavior can differ. OpenAI adds its own caveat: evaluations ran in a research environment or through the API and may differ from production ChatGPT.

Model refusal remains one layer of our safety stack, alongside additional safeguards that enforce the safety boundary through defense in depth.OpenAI, GPT-6.1 Sol deployment safety report

That sentence is the right frame. OpenAI's monitoring runs on OpenAI's side, over OpenAI's view of the session. When Sol runs inside your agent, with your tools and your credentials, the next layer of defense in depth is yours to supply.

Turning the system card into controls

How Anomity enforces outside the model

Anomity's design assumption is the one the system card supports: do not rely on the agent to comply. On agents that expose a pre-execution hook, such as Claude Code's PreToolUse hook, Anomity returns allow, deny or log before a tool call runs, using 180 enforcement rules across nine guards. A rule about a destination or a class of action holds whichever tool the agent tries next.

Every decision, including each denial, lands in a 90-day audit trail that routes to SIEM, Slack, email or Jira. Repeated attempts against the same boundary show up as a pattern rather than disappearing into a session transcript. The Endpoint Sensor inventories the agents, MCP servers, CLIs and plugins on each machine, which is the set of channels an agent could use to route around a block, and the denominator for any policy that claims to cover them. For building baselines from that data, see runtime monitoring and anomaly detection for AI agents.

OpenAI deserves credit for publishing these numbers at all. They are the clearest public evidence yet that the controls around an agent matter as much as the model inside it. To see how enforcement at the hook works on your own fleet, book a 30-minute demo.