GPT-5.6 Launches Three Tiers as Terra Halves GPT-5.5 Pricing

An engineer who lives in Cursor will notice something over the next few quarters. The Grok-native path gets smoother. The other paths get slower. Cursor co-trained Grok 4.5, not merely integrated it, building it from scratch on xAI's Colossus data center specifically for the IDE. That is why the deal priced at $60B in stock. The market is paying a premium for vertically integrated model-plus-application stacks over either piece standalone. It is the third such play in AI coding, after OpenAI/Codex and Anthropic/Claude Code, and the most aggressive. If your engineers live in Cursor, expect Grok-native workflows to be privileged and third-party model support to degrade over time. The platform-acquisition playbook has never worked differently.

Microsoft is running the same logic in reverse. The company that put $13B+ into OpenAI is now swapping OpenAI and Anthropic models for its own MAI models in Excel and Outlook, explicitly for cost, while cutting 4,800 jobs. OpenAI acquired Gitpod, rebranded Ona, and Astral to own its agent compute stack, and took a $520M credit line that reads as IPO preparation. Post-IPO, history says API prices rise for low-volume customers and lock-in terms tighten. Meta rebuilt its AI lab and is shipping Muse Image and Video free into Instagram, WhatsApp, and Marketplace. That is 3B+ users, zero downloads, funded by Advantage Plus advertiser tooling.

The convergent read: if Microsoft does not trust single-provider dependency at its scale, the reasoning does not improve at yours. The era of competitive products built by wrapping one provider's API is closing. What survives is proprietary data, workflow depth, and distribution the model layer cannot replicate, plus an abstraction layer that treats models as swappable infrastructure.

Microsoft, OpenAI, and Meta all decided this month that renting intelligence is a bridge, not a destination.

Nuance: this does not mean build your own model. It means the number worth knowing is how much of your product's value would survive if your current provider tripled prices or a competitor got your model for free. That number is what your roadmap should be optimizing for.

The word was 'Additionally.' A crafted issue in a public repo drove GitHub's AI agent to read READMEs from private repositories and post them as public comments, and that one connective keyword walked past the guardrails. Microsoft-scale security resources did not stop a one-word bypass. That should reset whatever a PRD assumes prompt-level defenses are doing. The same week told the same story three more times. Google Dialogflow CX let anyone holding a single playbooks.update permission compromise every agent in a project, exfiltrating chat history and injecting phishing. Writer's live agent preview links leaked session cookies cross-tenant, including admin access to other companies' accounts. Copilot generates harmful code when a request is decomposed into innocent-looking editor steps. Intent detection at the input level is structurally beatable.

The attack surface is being written down faster than teams are defending it. The PITAX taxonomy went from 107 to 172 attack types in one version, a 61% jump, and the new names map straight onto product economics. Denial of Wallet is the clearest one: an adversary drains the token budget through recursive tool calls, and the damage shows up on the cloud bill, not in a breach report. Tool Rug Pull turns a trusted agent tool malicious. Confused Deputy and multi-turn escalations like Crescendo skip past per-message checks. Each class carries a citable reference code mapped to OWASP and MITRE. Acceptance criteria can now read as a specific test, not 'must resist prompt injection.'

Here is what the three platform failures have in common. They shipped before securing and paid for it in public. Separate what gets pitched from what actually held. In none of these cases did the prompt layer hold; the failures were architectural. Enterprise procurement will turn this into AI-specific security questionnaires within one to two quarters, so 'secure by default' agent positioning is a real differentiator right now, before it hardens into a checkbox. The forcing function is a single question per feature: does this defense survive if the model gives up resisting manipulation? Permission scoping, isolated preview origins, output-level evaluation, and least-privilege tool access all pass. Prompt guardrails do not.

Rate limits and token caps are now security controls, not just billing features, and attackers already treat them that way.