Addendum to GPT-6 Luna System Card: October 28, 2026 Update

What it claims

OpenAI's addendum covers an update to GPT-6 Luna, labelled GPT-6 Luna (October 29), which gives more concise answers and less agreeable language than the October 7 version. It uses the same types of training data and the same safeguards stack as the October 7 model. OpenAI rates it High in Cybersecurity and in Biological and Chemical capability, and below the High threshold in AI Self-Improvement. The update trades safety gains for under-18 users and jailbreak resistance against losses in health, mental health and factuality scores.

Evidence

Under-18 safe completions (higher is better, October 7 to October 29). Emotional reliance shows the largest gain, from 0.734 to 0.870. Eating disorders rose from 0.776 to 0.817, sexual content from 0.904 to 0.933, and gore from 0.812 to 0.858. OpenAI marks these four as improvements. Self-harm (0.974 to 0.979) and age-restricted goods (0.814 to 0.824) moved little.

HealthBench scores are length-adjusted on a 0 to 100 scale. Mean response length fell on every subset, for example from 3,134 to 2,725 characters on HealthBench Hard. Scores still fell after length adjustment:

• HealthBench Hard: 27.2 to 22.8 (unadjusted 36.1 to 28.5), which matches GPT-5.5 Instant's 22.9.
• HealthBench: 50.4 to 48.2.
• Professional: 48.2 to 47.4.
• Consensus: 95.0 to 93.3.

MentalHealthBench overall fell from 51.73 to 48.68, with a standard error of about ±0.97. Non-acute fell from 51.68 to 46.39, and high acuity from 56.15 to 53.92. Emergent was flat (48.98 to 49.64). On dynamic adversarial-user benchmarks, self-harm improved and mental health regressed slightly.

Hallucinations. Factual-error rates rose on all six response-level and claim-level metrics compared with the October 7 version. They remain lower than GPT-5.6 Luna on every metric. The text gives no figures.

Jailbreaks. Multiturn defender success was higher than the October 7 version at every attacker budget tested.

Biology refusals. Severe-prompt safety rose from 0.945 to 0.976. Dual-use safety fell from 0.968 to 0.922.

Bio and chem capability, High thresholds (October 7, then October 29, then threshold):

Three of the four remain above threshold. No Critical-threshold evaluation was crossed. SHP2 scored 0.21 against a 0.60 threshold, Coronavirus-ACE2 scored 0.37 against 0.75, AAV capsid scored 0.53 against 0.60, and phage-plasmid NLL was 11.84 against a threshold of 9.40 or lower.

Cybersecurity. ExploitBench scored 46.19% at maximum reasoning effort. SEC-Bench Pro (vulnerability discovery in V8 and SpiderMonkey) scored 51.75%, against 85.4% for GPT-6 Astra. On cybersecurity safety evaluations the model is on par with the October 7 version, with no statistically significant regressions.

Vision safety is on par with the October 7 version. The harms-erotic regression is not statistically significant.

Limits

The jailbreak attacker run was cut short by infrastructure issues, so the robustness comparison covers only the budgets reached.

Several reported results have no numbers in the page text: the Production Benchmarks, vision, prompt-injection (GPT-Red), dynamic mental health and cybersecurity safety tables, and all the alignment figures. The alignment figures cover auto-review, warnings, blocker deception and the broken search tool.

Comparison values for previously launched models may come from later versions and can differ from the figures published at launch.

The URL dates the addendum October 28, 2026, while the body names the model October 29.