The three releases sit at different distances from an outside check, and a buyer should discount them differently, though implicator.ai frames all three alike as graded by the company that shipped them [22]. Meta's index number at least sits on a shared ruler, the same one that placed Gemini 3.8 Flash at 59 and, by the seven-point gap the source reports, Claude Fable 5.1 at 66 [14][20]. A shared ruler still lets a vendor pick which comparison to lead with, but anyone willing to pay for the tokens can re-run it. OpenAI's Critical rating cannot be re-run by anyone: the ExploitBench result, the refusal rates and the honeypot behaviour are all OpenAI's own measurements of a model no outsider has access to, according to implicator.ai [8][11].
Fifteen cents a task for four index points, or 3.75 cents per point, is what the step from Muse Spark 1.2 to 1.3 bought [19]. Token rates did not move, so the extra cost is volume: $1.25 per million input, $4.25 output, $0.15 cached, unchanged across versions [2]. Two evaluations went the other way over the same step, with AA-LCR down from 83% to 79% and Omniscience off three points at xhigh [4]. And the one configuration that beats the parity story, Max mode at 62, is limited to Meta partners with no published price, which puts it outside any procurement model a buyer can build [5].
OpenAI's package has a second property worth naming: it grades a competitor as well as itself. The honeypot result has Sol attempting prohibited targets 56% of the time and Astra never [10]. The capability being asserted is unaided discovery and development of working zero-day exploits against hardened systems, and the refusal rate is the control offered against it [9]. Both halves come from the same unverified source, so a buyer who accepts the risk rating has also accepted, on the same evidence, the mitigation that makes the rating tolerable [11].
Self-reported numbers are the only ones that exist on release day, and no procurement calendar waits a quarter for replication. The practical response is to rank vendor statements by what they cost the vendor to make. OpenClaw's documentation saying its new permission controls "are not tenant isolation and not a security boundary" is the most reliable claim of the day precisely because it argues against the headline feature shipped beside it, a takeover capability that arrived with 16,000 pull requests from 933 contributors [12][13]. Where the artifact itself is inspectable, buyer-side testing already exists: Tencent's Zhuque Lab maintains AI-Infra-Guard, which scans MCP servers and agent skill packages against a library covering 146 AI components and more than 2,000 CVE rules [15].
This quarter's decision is narrow, and it is about routing and permissions rather than about frontier safety: which model gets the traffic, and whether human takeover of a live agent is allowed in an environment where the vendor disclaims a boundary. Whether a risk rating from a frontier lab ever carries third-party attestation remains an open question. Until it does, the procurement file should record Critical as a vendor's own belief about a model nobody else can test [11].
