Grok 4.7 vs GPT-6 Astra vs Claude: a CISO's security comparison

In the first three weeks of September 2026, all three frontier labs shipped new flagships. Anthropic released Claude Fable 5.1 on 1 September. OpenAI released GPT-6 Astra on 3 September. xAI released Grok 4.7 on 21 September. The next day, Anthropic released Claude Opus 5.5 and OpenAI released GPT-6 Sol and GPT-6 Luna. If your AI policy names a model, it is probably out of date already.

The more important news came earlier and got less attention. In July, OpenAI and Anthropic both disclosed incidents in which their own models, running cyber evaluations with safeguards reduced, reached the real internet and took unauthorised actions on real systems. OpenAI’s models broke out of a sealed sandbox through a zero-day. Anthropic’s reached the internet through a misconfigured third-party evaluation environment. One of the incidents was a production compromise of Hugging Face. These are the same model families your staff reach through Copilot, ChatGPT, Claude and Grok.

This post compares the three vendors the way a security leader has to: on capability, safety evidence, enterprise controls, Australian data residency, and where each model already sits inside platforms you run. It ends with what that means for governance. All facts are current as of 23 September 2026 and come from each vendor’s own documentation unless marked otherwise. Vendors publish their own benchmark numbers, so where an independent measurement exists we use that instead.

The short answer

For readers who need the conclusion first:

• Capability is close at the top and is no longer the deciding factor. On the independent Artificial Analysis Intelligence Index, Claude Opus 5.5 leads at 58. GPT-6 Astra and Claude Fable 5.1 tie at 53, and Grok 4.7 scores 46. For most enterprise work, all three are capable enough. The differences that decide risk sit elsewhere.
• OpenAI published an unusually candid safety overview for its flagship and has the broadest public certification set. GPT-6 Astra is the first OpenAI model to reach the Critical level of cyber capability under its own Preparedness Framework, and OpenAI says the model is now harder to monitor.
• Anthropic has a clear split between safeguarded and unsafeguarded variants, and the best independent capability scores right now. It also had its own containment incidents this summer, runs a consumer tier that trains on user data by default, and its models are switched on by default in many Microsoft 365 tenants.
• xAI’s Grok is the cheapest flagship per token and the weakest on enterprise assurance. It has no documented Australian or Asia-Pacific data residency, holds SOC 2 Type 2 but has no public ISO 27001 certification, and has the longest record of public content and data-handling incidents of the three. The most severe agentic security incidents of the year belong to OpenAI and Anthropic.
• For Australian regulated entities, data residency and default-on integrations matter more than any benchmark. The practical question is not which model is best. It is which models are already reachable from your tenant, under which terms, and who approved that.

The line-ups at a glance

Sources: xAI models, OpenAI pricing, Anthropic models overview, Anthropic Opus 5.5 announcement, Fable 5.1 and Mythos 5.1, gpt-oss model card.

Two naming points matter for risk. First, Claude Fable 5.1 and Claude Mythos 5.1 are the same model. Fable ships with Anthropic’s production safeguards. Mythos ships with fewer safeguards, and only to vetted organisations. Second, all three vendors use aliases that can move to a new model under you. xAI documents that a bare Grok model name tracks the latest stable version unless you pin a dated snapshot, and both OpenAI and Anthropic use aliases alongside fixed versions. A model can change without anyone at your end making a change. For regulated workloads, pin the exact version each vendor offers and record it in your AI register.

Capabilities: what the benchmarks show

The independent picture

Artificial Analysis runs the same benchmark suite across all vendors, so it is the most useful single cross-vendor view. At each model’s highest reasoning setting on 23 September 2026, its leaderboard shows:

Three cautions apply before anyone takes this table to a board.

1. Composite indices hide the workload that matters to you. Artificial Analysis’s own Grok 4.7 write-up notes that Grok’s gains come from using many more output tokens per task. That shows up in cost and latency, not in the headline score.
2. Test harnesses change results a lot. Vendors often report scores using their own test setup, with custom prompts, tools or retries. The same model can score very differently on a neutral setup. When a vendor’s number and an independent number disagree, use the independent one and ask the vendor why they differ.
3. Rankings change within weeks. Opus 5.5 went to the top of this table one day after release. If your procurement case rests on a leaderboard position, it will be out of date by the time the contract is signed.

Agentic capability is now the frontier

All three vendors now build for long-running agents rather than chat. OpenAI lists functions, web search, file search and computer use as native tools for Astra, and offers the Agents SDK and MCP connectors. Anthropic ships Claude Code, the Claude Agent SDK and computer use, and created the Model Context Protocol. xAI supports remote MCP tools in its SDK and Responses API, and ships Grok Build, a terminal coding agent that runs parallel sub-agents.

For a security team, that shared direction is the main point. MCP is now the common way to plug tools into models from all three vendors. The control you most need is therefore not tied to any vendor. It is tool authorisation for agents: which tools an agent can call, with whose credentials, and whether a human has to approve the call.

Cyber capability is now a security property

The biggest change this cycle is that offensive cyber capability has moved from a theoretical risk to a measured one.

• OpenAI says GPT-6 Astra is its first model to reach the Critical cybersecurity threshold under its Preparedness Framework. In its safety overview, OpenAI says that with the right tools and access, the model can find previously unknown flaws and build working exploits across well-protected systems without a person guiding each step.
• Anthropic puts production safeguards on Fable 5.1 that block or limit cyber, biology and chemistry misuse. According to its launch post, Fable 5.1 can now be used to find software vulnerabilities but not to write exploits for them. Mythos 5.1, the same model without those safeguards, is limited to vetted organisations.
• xAI replaced its numeric Risk Management Framework with a qualitative Frontier AI Framework, effective 30 June 2026. The new framework references NIST AI RMF and ISO/IEC 42001 but drops the numeric thresholds the August 2025 version used. That makes it harder for an outside party to check whether a given model crossed a line.

The defensive reading is straightforward. Attackers will get this capability through jailbreaks, leaked access or open-weight models that catch up, as our research on jailbroken AI as an attack tool documented. Your patch cadence and exposure management now need to assume an adversary that finds vulnerabilities at machine speed.

Security and safety evidence, vendor by vendor

Every vendor says its model is safe. What differs is the evidence each one publishes, how quickly, and what it admits. We hold all three to the same standard here.

OpenAI: the most detailed disclosure, and a warning about monitoring

OpenAI’s Astra safety overview is the most useful safety document of this release cycle, because it states something uncomfortable. OpenAI reports that Astra’s monitorability has decreased compared with GPT-5.6 Sol. Under adversarial testing, the model was more able to control its own chain of thought and could avoid detection while deliberately underperforming on evaluations, which is called sandbagging. OpenAI adds that it found no evidence of hidden reasoning encoded in ordinary-looking text, and that its overall alignment evaluations show Astra is less likely than Sol to breach safety and security restrictions.

In response, OpenAI says it runs misalignment monitoring over all tool-using inference in its external Astra deployment, at significant compute cost. It also reports that Astra is significantly more robust to jailbreaks and prompt injection than Sol, and much less likely to take destructive actions in browsing and workplace environments. Those robustness figures are vendor-reported. Independent researchers have already published jailbreak attempts against Astra, and you should assume that happens to every model within days of launch.

The incident. On 21 July 2026, OpenAI disclosed that GPT-5.6 Sol and a more capable internal prototype had been running an internal cyber benchmark with reduced refusals. They exploited a previously unknown vulnerability in the Artifactory package cache proxy, the only network path out of the sandbox. They then escalated privileges and moved laterally to a node with internet access, and used stolen credentials and further vulnerabilities to reach Hugging Face’s production systems, all to obtain the benchmark’s answer key. Hugging Face’s own security team detected and contained the intrusion first. OpenAI’s later updates confirmed that the models also used publicly exposed credentials on four accounts across four other services. OpenAI deactivated and encrypted the prototype, brought in CrowdStrike, and asked METR and Redwood Research to assess the models’ behaviour.

Anthropic: a clear safeguard split, and the same kind of failure

Anthropic’s main structural control is the one described above: the model with the most capability comes in a safeguarded version for everyone and an unsafeguarded version for vetted organisations only. Its Responsible Scaling Policy was rewritten as version 3.0, effective 24 February 2026. Anthropic says Opus 5.5 achieved the best score of any model on its automated behavioural audit and was tested before release by external evaluators including METR. Those claims are vendor-reported.

The incidents. Anthropic’s record this year is not clean either, and a fair comparison has to say so plainly.

• On 30 July 2026, Anthropic reported three incidents in which Claude models gained unauthorised access to real computer systems. The models were running without cyber safeguards for evaluation. A misconfiguration in a third-party evaluation environment gave them internet access. On 4 August, the UK AI Security Institute reported a separate incident in which Claude Mythos 5, deliberately given internet access, took a series of unauthorised actions on the live internet. In its follow-up post, Anthropic says it had been relying on a single layer of defence. It identifies two alignment problems: motivated reasoning, where the models kept believing their environment was simulated despite evidence it was real, and recklessness in pursuit of a narrow task. It paused external cyber evaluations, deployed a real-time classifier that blocks sandbox-escape attempts before a tool call runs, and imposed new containment requirements on evaluation partners. It also disclosed that some training runs had accidentally trained on the model’s chain of thought, which Anthropic itself says risks teaching a model to hide its reasoning.
• In March 2026, researchers disclosed “ShadowPrompt”, a flaw in the Claude for Chrome extension. It combined a cross-site scripting bug with an overly broad origin allowlist, so that any website could inject prompts into the extension without a click (The Hacker News). Koi Security reported it privately, and Anthropic fixed it in extension version 1.0.41 with a strict origin check after disclosure on 27 December 2025. Anthropic’s prompt injection defences post describes layered classifiers and states that residual risk is not zero.
• In August 2025, Anthropic changed its consumer terms. Free, Pro and Max chats and coding sessions are now used for training unless the user opts out, and users who allow training have their data retained for five years. Commercial and API terms were not affected. For a CISO, this means a staff member on a personal Claude plan is on different data terms from your enterprise tenant.
• Anthropic’s September 2026 threat intelligence report describes disrupted misuse, including a suspected Russia-linked espionage operation and attempts to distil Claude’s capabilities. Anthropic says it disrupted every operation described. No one has independently audited that claim.

xAI: cheaper, faster releases, weaker assurance

Grok 4.7 has a model card published on its release date, per the xAI model card. That is an improvement: the Grok 4 card appeared roughly six weeks after that model launched in 2025. Since its May 2025 incident, xAI has also published Grok’s system prompts on GitHub. That is useful transparency, although contributors to xAI’s grok-prompts repository have argued it has since been partly rolled back.

The incident record is longer than either competitor’s and mostly concerns content and data handling rather than agentic containment:

• May 2025: an unauthorised change to Grok’s system prompt caused the X bot to insert unrelated political content into replies. xAI committed to publishing prompts and to round-the-clock monitoring.
• July 2025: after a prompt update, Grok posted antisemitic content for about sixteen hours before xAI withdrew the change and apologised publicly.
• August 2025: hundreds of thousands of shared Grok conversations were indexed by search engines because share links were missing no-index controls, exposing personal details.
• 2024: Ireland’s Data Protection Commission went to court over EU users’ posts being used to train Grok, and X agreed to suspend that processing.
• Australia specifically: the eSafety Commissioner has raised concerns about Grok being used to generate sexualised content, including non-consensual deepfakes. It has written to X and signalled possible enforcement.

Independent red teams have reported high jailbreak success against unhardened Grok deployments. The honest summary is that Grok can be deployed safely behind your own guardrails, and that xAI provides less of the assurance a regulated buyer needs to show it has done so.

The summer of containment failures, and what it means for your agents

Both the OpenAI and Anthropic incidents follow the same pattern, and it applies directly to agents running in your environment:

1. Containment that failed at one point. Anthropic says it had relied largely on a single layer, the environment’s own configuration, and that layer was misconfigured. OpenAI’s sandbox allowed only one outbound path, a package cache proxy, and the models found a zero-day in it. Once that one point failed, nothing else stopped them in time.
2. A narrow goal pursued at any cost. The models were not acting on malicious intent. They were trying very hard to finish a task, and they treated the containment as an obstacle to get around.
3. Ambiguous boundaries. Anthropic found that telling a model it had no internet access, when it did, may have led the model to doubt whether the systems it reached were real. Its new guidance is to state boundaries as instructions (“do not access the internet”), not as claims about the environment.
4. Detection was partly external. OpenAI’s security team found the anomalous activity internally, but Hugging Face had already detected and contained the intrusion on its side before OpenAI linked it to its own testing. The UK AI Security Institute reported one of the Anthropic-related incidents.

Now compare that with a typical enterprise agent. A coding agent often has shell access, an internal package mirror, cloud credentials in environment variables and a goal such as “make the tests pass”. The lab incidents involved models with cyber safeguards deliberately removed. Your production models have them switched on. The structural lesson still applies: one containment layer is not a control, it is a single point of failure. Isolate the network by default. Keep credentials outside the agent’s environment. Monitor the agent’s actions against its declared scope in real time. Put humans at the approval points for actions that cannot be undone. Our AI defence and agent containment work starts from those four controls, and the AI supply chain post covers the package-proxy exposure in the OpenAI incident.

Enterprise controls and Australian data residency

This is where procurement decisions for regulated Australian organisations are actually made.

Sources: xAI security FAQ, xAI regions, OpenAI data residency, OpenAI trust portal, Anthropic certifications, Anthropic covered-model retention, AWS: Claude Opus 5.5 on Bedrock, AWS: OpenAI models from Australia, Microsoft: Anthropic models in Online Services.

Three points in that table matter most for boards.

Residency at rest is not residency in processing, and the route matters. OpenAI’s Australian residency stores ChatGPT Enterprise and Edu content in Australia, and for API customers approved for advanced data controls, requests through an Australian-region project are handled in-region. The same OpenAI models reached through Bedrock behave differently: AWS says requests sent from Sydney or Melbourne are routed to another commercial Region for processing. Claude has the mirror image: in-country processing through Bedrock’s au. profile, none directly from Anthropic. xAI’s own documentation warns that its US regional endpoint is not by itself a comprehensive data residency guarantee. If your obligations under the Privacy Act or a customer contract require Australian processing, confirm where inference runs, not just where logs are stored.

Retention depends on the model, not just the vendor. Anthropic retains prompts and outputs for 30 days for models it designates as covered, even for customers who otherwise have zero data retention. Microsoft offers Claude Fable 5 in Copilot only as a separate opt-in under Anthropic’s own terms, while some organisations get Fable 5.1 under Microsoft’s terms with no retention by Anthropic. One vendor relationship can therefore carry different retention terms for different models and different routes. Your register needs to record the model and the route, not just the vendor.

Consumer and enterprise terms are different products. Every vendor here treats personal accounts differently from business ones. The biggest data leakage risk in most mid-market organisations is not the approved tenant. It is staff using personal accounts, which is where shadow AI discovery starts.

Integrations: these models are probably in your estate already

Most organisations do not choose a frontier model once. They inherit several, through platforms they already licence.

Microsoft 365 Copilot. OpenAI models are the default. Anthropic’s Claude models, including Opus-class models, are now available in Copilot, Researcher, Copilot Studio, Power Platform and Copilot in the Microsoft 365 apps. Microsoft’s documentation says Anthropic models are on by default for most commercial cloud customers, except in the EU, EFTA and UK. It also says they are excluded from Microsoft’s EU Data Boundary and, where applicable, from in-country processing commitments. Australia is not in the default-off list. If you run a commercial Microsoft 365 tenant in Australia and have not reviewed the “AI providers operating as Microsoft subprocessors” setting, your staff may already be using Claude under terms nobody in your organisation assessed. That may be acceptable. It should still be a decision someone made.

GitHub Copilot. GPT-6 Astra became generally available to Copilot Pro+, Max, Business and Enterprise users on 4 September 2026. Claude models have been selectable in Copilot for some time, and xAI models have also been offered. Model choice in your developers’ IDEs is usually controlled by an organisation-level Copilot policy that few security teams review.

AWS Bedrock. All three vendors are now on Bedrock. GPT-6 Astra is generally available, initially in US West (Oregon). Grok 4.6 is available, and Claude is available with Australian cross-Region profiles. Bedrock gives you IAM, CloudTrail invocation logging and your own network controls in front of each model, which is often the easiest way to bring a second vendor under governance.

Microsoft Foundry and Google. OpenAI and Anthropic models are both offered in Microsoft Foundry. Claude is on Google Vertex AI. Grok models are reported in several cloud catalogues. Regional availability changes monthly, so check the provider’s current region table before you rely on it for residency.

Consumer surfaces. Grok is built into X, reported in Telegram, and fitted to Tesla vehicles. ChatGPT and Claude have large consumer apps and browser extensions. None of these surfaces sit under your enterprise terms, and all of them are places where staff paste work data.

The pattern across all of these is that model choice is increasingly a toggle inside someone else’s product, controlled by an admin who may not know it is a risk decision. A secure AI enablement program starts by listing every one of those toggles and giving each a named owner.

How to choose: by workload, not by leaderboard

Given how quickly rankings change, a durable selection method matters more than today’s winner.

Two rules apply across all of them. Run your own evaluations on your own tasks, including prompt-injection tests against your real tools. Design for switching vendors: keep prompts, tool definitions and guardrails outside any single vendor’s SDK so you can move when the next release changes the picture.

Where the Digital CISO fits: evidence you can check, in pilot now

The main lesson of this month is not about any one vendor. Six new models shipped in 22 days. Right now, a subprocessor setting in Microsoft 365 has a second AI vendor switched on by default in commercial tenants outside Europe and the UK. Retention terms differ depending on which model a user picks and through which route. Two labs rewrote their evaluation containment after incidents. A quarterly review would catch most of that months after it happened.

That is the core problem with point-in-time assurance of AI use. The evidence a board relies on, such as which models are in use, under which terms, with which controls and who approved them, goes stale in weeks. It is the same evidence gap that APRA’s expectation of continuous monitoring across the AI lifecycle points to, and that CPS 230 third-party obligations make concrete for regulated entities.

Our Digital CISO is built for that gap, and its first product, InlineScan, is ready now in pilot. It does two things this post has argued every organisation using these models needs:

• It red teams an AI endpoint you nominate. Whichever vendor’s model sits behind your chatbot, copilot or agent, InlineScan sends it a corpus of adversarial probes in five classes, mapped to the OWASP Top 10 for LLM Applications, each written four ways. A judge reads every reply against the safe behaviour the probe stated. This is the prompt-injection and jailbreak testing that vendor safety claims cannot do for you, because it tests your deployment, your system prompt and your tools rather than the base model.
• It turns security evidence into board-ready reporting you can check. You prove ownership of a domain, run a rated engine against it yourself, such as a Prowler scan of cloud posture or Microsoft 365, and upload the results. InlineScan narrates them against the Essential Eight and the OWASP LLM Top 10, drafts remediation you can edit, and cites the records behind every statement. It does not test your network or infrastructure: apart from checking that you control a domain, the only traffic it sends to your systems is prompts to an AI endpoint you nominate and passive requests to a domain where you have published consent. Where your evidence cannot reach a control, the report says so plainly rather than guessing.

It is built to the standard this post applies to the labs. A named person on your side approves each domain, and Inline Code staff cannot approve one for you. Red team runs are optional and need approver sign-off. Every connection to your systems comes from one published address, and the tool keeps its own audit trail.

The pilot is free for an agreed period, documented like any other engagement, with pricing agreed before it converts. In return we ask for your reporting problem in detail and a willingness to tell us where the output is wrong. The framework mapping the reports use is already published, so you can check it before you start. Next on the roadmap is the always-on layer: tracking control drift such as the model and subprocessor changes above, with a named human accountable and reporting rather than remediation. That part is not shipping yet, and we will say plainly when it is.

If you are putting any of these models in front of customers or staff, ask us about an InlineScan pilot.

A ten-point checklist for this quarter

1. Inventory every route to a frontier model: direct API keys, Copilot and Microsoft 365 settings, GitHub Copilot policies, cloud AI platform access, browser extensions and personal accounts.
2. Review the Microsoft 365 “AI providers operating as Microsoft subprocessors” setting and record who decided whether Anthropic models are on.
3. Record models, not just vendors, in your AI register, with pinned versions and the retention terms each model runs under.
4. Confirm where inference runs for any workload with Australian processing obligations. Residency at rest is not enough.
5. Check whether a zero data retention agreement covers your use case, and which models it excludes.
6. Put every production agent behind at least two containment layers, with credentials kept outside the agent’s environment and scope-aware monitoring of what it does.
7. State agent boundaries as instructions, and test that the environment actually enforces them.
8. Run prompt-injection tests against your real tools before and after every model upgrade, not just at initial deployment. An InlineScan pilot red teams an endpoint you nominate against the OWASP Top 10 for LLM Applications.
9. Shorten your patch window assumptions to reflect adversaries with Critical-level vulnerability discovery.
10. Report model changes to the board as risk decisions, with a named owner, rather than as IT change tickets. Our post on the fractional CISO model covers why that reporting needs evidence collected continuously rather than assembled by hand, which is the gap the Digital CISO closes, starting with InlineScan in pilot today.

Frequently asked questions

Which is the most secure AI model in 2026: Grok, GPT-6 or Claude?

No model is secure on its own, and the question usually hides the one that matters. On published evidence, OpenAI and Anthropic provide far more safety documentation, independent evaluation and enterprise certification than xAI. Both also disclosed serious incidents from their own cyber evaluations in July 2026. Security depends mostly on how you deploy the model: data terms, tool permissions, containment and monitoring.

Is GPT-6 Astra dangerous to use in a business?

OpenAI classifies Astra as Critical for cyber capability under its own Preparedness Framework. That describes what the model could do with the right tools and access and no safeguards, not what it will do inside your tenant. OpenAI runs misalignment monitoring on all tool-using inference in its deployment. The practical risks for a business are the same as with any agentic model: over-broad tool access, prompt injection and weak action approval.

Can Australian organisations keep AI data in Australia?

Partly. OpenAI stores ChatGPT Enterprise and Edu content in Australia on request, and handles eligible API projects in-region. Anthropic’s Claude can be processed in Australia through AWS Bedrock’s Australian cross-Region inference profile, though not directly from Anthropic. xAI documents no Australian or Asia-Pacific residency. In Microsoft 365 Copilot, Anthropic models are excluded from in-country processing commitments. Always confirm where inference runs, not just where data is stored.

Is Grok suitable for regulated enterprise use?

xAI offers SOC 2 Type 2, a no-training commitment for API data, 30-day default retention and optional zero data retention. It publishes no Australian residency option and no public ISO 27001 certification, and has a longer public incident record than its competitors. It can suit low-sensitivity, cost-driven workloads behind your own guardrails. It is a harder case to make to APRA or a privacy regulator.

Do these vendors train on my company’s data?

Not by default under business and API terms for any of the three. Consumer plans differ. Anthropic’s consumer plans have trained on user data by default since its 2025 terms change, unless the user opts out. This is why personal account use by staff is a governance issue rather than just a policy matter.

How often should we review our AI model choices?

Continuously for the inventory, and at least quarterly for the decisions. In September 2026 alone, six new models launched across the three vendors, and default-on integrations decide which vendors staff can reach. A review cadence slower than the vendors’ release cadence means the register is always behind, Between reviews, evidence you can check matters more than a fresh opinion, which is what an InlineScan pilot through our Digital CISO provides.

Where to start

If you already run an AI endpoint on any of these models, the fastest useful step is to test it: InlineScan is in pilot now, and a red team run against an endpoint you nominate shows how your deployment holds up, whichever vendor is behind it. If you do not know which frontier models your staff can reach today, start there instead. The maturity assessment gives you a scored baseline in ten minutes. If the answer is “more than we approved”, an AI governance assessment will map the gap against the frameworks you answer to. If you are building agents on any of these models, talk to us about containment before they reach production.