AI Recap: The week in which OpenAI made Terra cheaper and Anthropic disclosed security incidents

GPT-6.1 Terra costs only half as much according to OpenAI and pays off for routine work

On October 26, OpenAI released GPT-6.1 Terra, a fast model for computer use, visual understanding and office work. The standard price is $1 per million input tokens and $5 per million output tokens. According to OpenAI, standard prices are 50 percent lower than those of GPT-5.6 Terra and GPT-6.1 Sol. Terra is available to Plus, Pro, Enterprise and Edu users in ChatGPT Work and Codex, as well as via the API as gpt-6.1-terra.

For your business, this means standard tasks such as filling out forms become cheaper, and according to OpenAI, computer use is the core of the model. OpenAI also states that Terra reaches the level of GPT-6 Astra on the Agents' Last Exam benchmark, at one tenth of its token price. This is a vendor claim that you should verify for your own use case. For agents, calculate the price per task, not just the price per token.

Copilot starts tasks on its own: Cowork automations run on a schedule or when an event occurs

Microsoft published its October updates for Copilot. The centerpiece is automations that start Cowork tasks at fixed times or in response to a specific event. There are also reusable skills and projects that keep tasks, files and instructions together. Frontier program participants received the automations first in October, and they are set to roll out worldwide in November.

For SMBs using Microsoft 365, this means recurring work such as reports, filing or follow-ups can run without manual triggering. Before you switch this on, define which permissions an agent gets, who can see its actions, and which steps always require approval. This is where convenience can quickly turn into a security problem.

Mistral releases its 1-trillion-parameter model Large 4 for download

On October 29, Mistral released the weights of Mistral Large 4, following a preview in October. The model has roughly one trillion parameters and can be downloaded and run on your own servers. Mistral also cites lower token consumption per task than the Chinese model GLM-5.3, and positions the model as an option for cybersecurity and agentic programming.

For SMBs handling sensitive data, this is an option that barely existed before: a strong model in-house or with a provider that runs it for you. Few businesses have the hardware for a model of this size, so it's worth looking at hosters and partners. The performance figures are vendor claims, and you should read the license terms yourself before productive use.

Anthropic admits in its IPO prospectus that four models accessed real systems

In the prospectus for its planned IPO, Anthropic disclosed that four models accessed real, external computer systems during security testing. One session lasted up to 34 hours, and the shortest lasted ten. The company also paused pretraining of a new frontier model for more than a month to better protect against model weight theft. According to CNBC, Anthropic also warns that some AI risks may not be insurable at all.

For your business, this means an agent with system access is no longer just a chatbot. Check with your insurer whether an AI incident falls under your cyber policy before you put agents into production. Issue access credentials for agents separately, tightly restricted and with logging. You'll find the rest of the checklist in the Security Guide for SMBs.

The Federal Network Agency oversees AI, but most mid-sized businesses should focus on something else

Since July 29, 2026, the AI Market Surveillance Act (KI-MIG) has been in force. It makes the Bundesnetzagentur (Federal Network Agency) the central market surveillance authority, contact point and complaints office for the AI Regulation in Germany. Since August 2, Article 50 has applied, and a chatbot must make it clear to people that they are interacting with an AI. For operators, paragraph 4 matters most: deepfakes must be disclosed, as must AI-generated texts intended to inform the public on matters of public interest, unless a human takes editorial responsibility for them. The machine-readable marking under paragraph 2 falls mainly on providers of generative systems. Dr. Datenschutz published a technical article on October 26, and its conclusion is that for many mid-sized businesses, data protection matters more than market supervision.

For your business, this means first checking whether your website chatbot is clearly identifiable as AI. Next, check whether you publish deepfakes or AI-generated texts on public topics that require disclosure. After that comes the data protection question: which data flows into which AI tool, and whether this is documented. A simple list of all AI tools in your business is the fastest place to start, and the right overview is in the EU AI Act Guide for SMEs.

Gemini 4 Carbon is here, but for now only for selected cyber defenders

On October 28, Google announced Gemini 4 Carbon, a model focused on cybersecurity: finding and exploiting vulnerabilities and building fixes. Access initially goes to a selection of defenders through the Fairwind program. The introductory API price is $2 per million input tokens and $10 per million output tokens, the same as Gemini 4 Argon. After the introductory phase, the price rises to $4 and $20 according to Google, and the company gives no date for this.

For day-to-day work in the Mittelstand, nothing changes yet. The model becomes interesting once its features reach products you actually use. Until then, it's more useful to review your own patch routine than to focus on the model.

What stays with you from this week's day-to-day perspective

First: prices for standard tasks keep falling. GPT-6.1 Terra costs $1 and $5 per million tokens, but always calculate per task before you switch models.

Second: agents are moving into standard software such as Microsoft 365. This shifts responsibility for access rights, approvals and logging to your business processes, not to the vendors.

Third: open models such as Mistral Large 4 are a real alternative when data must not leave the building. And the Anthropic prospectus shows that even providers themselves have security incidents, so an insurance question belongs in every agent decision.