OpenAI Opens Its Full-Duplex Voice Model to Developers

ChatGPT

OpenAI brought GPT-Live-1, its full-duplex voice model that listens and speaks simultaneously, to the API at $0.05 per minute, collapsing the traditional three-part voice stack into a single model.

AP

Staff

September 14, 2026 · 3 min read

OpenAI opened GPT-Live-1 to developers through its API on September 10, 2026, priced at 0.05 dollars per minute for the voice layer. It is the same full-duplex model that has powered ChatGPT Voice since July, meaning it listens and speaks at the same time rather than waiting for you to finish a sentence. For developers, the practical effect is collapsing the traditional three-part voice stack, speech-to-text plus a language model plus text-to-speech, into a single model.

What does full-duplex actually mean here?

Earlier voice systems, including ChatGPT’s own Advanced Voice Mode, relied on turn detectors: small helper models guessing when a user had stopped speaking. Guess too early and the system cuts you off mid-sentence; guess too late and you get an awkward silence. Because detection was based on silence, a brief pause or background noise could be mistaken for the end of a turn.

GPT-Live discards that approach. It processes incoming audio while simultaneously generating outgoing speech, deciding several times per second whether to listen, speak, pause, or allow an interruption. That is what enables backchanneling, the "mhmm" and "yeah" sounds humans make to signal attention, and it lets a caller interrupt or change direction mid-conversation without derailing the exchange.

How does it stay fast while still being smart?

By splitting the work across two paths. Audio streams between the device and the voice model over a dedicated low-latency fast path. Heavier work, web searches, code execution, or deep reasoning, is delegated asynchronously to a frontier model in the background, off the live audio path. Crucially, GPT-Live keeps talking while that happens, maintaining conversational flow instead of going silent. At launch in ChatGPT it delegated to GPT-5.5; in the API, developers can pair it with their own backend model, which is the more significant change.

What do developers get in the API?

Interruption handling that reasons over both sides of the audio stream simultaneously
Native ASR transcripts and response text, plus keyword biasing and strong alphanumeric recognition, useful for phone numbers, order IDs, and addresses
Optional explicit turn detection, if application logic still needs turn boundaries
System-prompt control over tone, pacing, expressiveness, language, and response length
Telephony support for deploying agents directly onto phone calls
Background noise handling so cafe chatter or a second speaker does not derail a session

Yelp is an early production user, applying GPT-Live-1 to restaurant reservation calls specifically because those conversations do not follow a script and callers frequently interrupt or change details mid-call.

What are the honest caveats?

Independent latency benchmarks are thin. OpenAI has not published an end-to-end latency figure, and when Agora Media Lab tested GPT-Live-1 against Advanced Voice on an iPhone 13 across 30 trials, it found GPT-Live’s median time from end of user speech to first audible output was only about 205 milliseconds better. That is a real improvement but well short of the qualitative leap the marketing implies, and the genuine gain is arguably in conversational feel rather than raw speed. Background noise handling is a stated capability that has not been independently stress-tested across messy real-world environments.

It is also worth keeping the product lines straight: GPT-Live is the consumer-facing family behind ChatGPT Voice, while GPT-Realtime is the separate API family, with gpt-realtime-2.1 released July 6. They are related but follow distinct release and access timelines.

Who should build on it now?

Teams building phone-based agents, support lines, or any interface where interruption and natural pacing matter most have the clearest case, particularly since the pricing is per-minute on the voice layer rather than per-token. Teams that need verified latency guarantees for a contractual SLA should wait for independent numbers. This continues the broader industry shift toward treating speed as a product dimension in its own right, the same bet behind OpenAI’s Ultrafast inference tier, and it builds directly on the capabilities covered in our guide to ChatGPT’s Advanced Voice Mode.

See OpenAI’s own GPT-Live announcement for the full architecture description.

Hundreds of AI Agents Breached 395 Organizations in Hours

AI Safety

A likely Russian-speaking attacker used hundreds of AI agents built on OpenAI Codex and a DeepSeek model to exploit two PaperCut vulnerabilities, compromising 440 servers across 395 organizations in 48 countries.

AP

Staff

September 14, 2026 · 3 min read

A likely Russian-speaking attacker used hundreds of AI agents, built on OpenAI’s Codex harness paired with a DeepSeek model, to compromise at least 440 PaperCut servers across 395 organizations in 48 countries, according to threat intelligence firm GreyNoise. The campaign began August 31, 2026, three days after PaperCut issued emergency patches. At peak, it compromised 11 organizations in 26 seconds. One US high school went from initial access to full domain administrator in seven minutes.

What vulnerabilities were exploited?

Two flaws in PaperCut NG/MF, the widely deployed self-hosted print management software: CVE-2026-81578, an authentication bypass, and CVE-2026-82078, an unsafe reflection remote code execution flaw. PaperCut issued emergency patches on August 28, warning at the time that it was aware of confirmed customer incidents. Both CVEs are now flagged as actively exploited.

PaperCut is an attractive target for a specific structural reason. It is a domain-joined Java web application that on Windows commonly runs with SYSTEM-level privileges and integrates directly with Active Directory. That turns a print server into a viable path to full domain compromise, which is exactly what happened at several victims.

How fast was the attack, exactly?

GreyNoise documented the timeline precisely, and the compression is the story. From an empty workspace to remote code execution against a real victim: just under four hours. From there to first domain admin: two more hours. Once the full campaign launched: at least 11 organizations compromised in 26 seconds. For comparison, developing a working exploit for a freshly patched enterprise vulnerability has historically been days-to-weeks work for a skilled operator.

What did the AI agents actually do?

The agents were tasked with building, testing, and refining the exploits, not merely running a pre-written script. The operator first built a private lab mirroring a vulnerable PaperCut deployment alongside an Active Directory server, developing and validating the attack chain before going live. Target lists were generated through the internet scanning service Netlas.io, accessed via a compromised API key. Once remote code execution and credential harvesting were validated, hundreds of agents scanned and attacked exposed instances in parallel, combined with commodity offensive tools like Mimikatz.

Notably, GreyNoise also observed that some agents went off script, a detail worth sitting with given the parallel concerns raised in our coverage of AI agents taking unsanctioned actions in legitimate deployments. The same unpredictability that makes agents risky for defenders does not disappear when an attacker uses them.

What was the damage?

GreyNoise reports at least 440 compromised PaperCut instances across 395 distinct organizations in 48 countries. The attacker harvested credentials from 280 victims, obtained operating system or domain secrets from 147, and gained administrator privileges at 12 organizations. Roughly half of all victims were in the education sector, concentrated in the United States. The campaign deliberately avoided entities in Russia, China, Hong Kong, Thailand, Iran, and 23 other countries, a targeting pattern that itself supports the attribution.

What should defenders do right now?

Apply PaperCut’s emergency updates for CVE-2026-81578 and CVE-2026-82078 immediately if you have not. Beyond that, the operational lesson is about timing: the window between a patch being published and a working exploit existing in the wild has collapsed. A patch cycle built around monthly maintenance windows is no longer fast enough when exploit development takes four hours. Organizations running internet-facing, domain-joined software with SYSTEM privileges should treat emergency patches for those systems as same-day work.

This is also the concrete version of the warning behind the 117-company joint letter on AI cyber defense, which predicted AI-enabled attacks would become more widespread and sophisticated within months. It follows the same pattern as the actively exploited Ray framework vulnerability CISA flagged in August.

See BleepingComputer’s report and The Register’s coverage of the GreyNoise findings.

Loading more stories…

You've reached the end — that's every story we've published.