ChatGPT Images 2.6 System Card

What it claims

GPT-Image-2.6 Sunburst and GPT-Image-2.6 Flare perform on par with their GPT-Image-2.5 baselines after moderation, according to OpenAI. The overall changes in unblocked unsafe outputs are not statistically significant. Flare is the faster model. Reasoning effort is configurable through the ChatGPT model picker and the API. GIFs use a GIF-specific moderation path. Neither model crosses the Bio High or Cyber High threshold, but OpenAI still applies its High-biological-capability mitigations as a precaution, as it did for Images 2.0 and 2.5.

How it works

The safety stack has three layers that can stop a request:

flowchart LR
  A[Request] --> B{LLM policy check}
  B -- violates --> R[Refused]
  B -- passes --> C{Monitor: text + image inputs}
  C -- violates --> X[Blocked]
  C -- passes --> G[Generate]
  G --> D{Monitor: output image}
  D -- violates --> X
  D -- passes --> U[Shown to user]

• An LLM-based policy check refuses requests before generation.
• A multimodal "safety reasoning model" checks all text and image inputs.
• The same model checks the output before it is shown.

ChatGPT also runs synchronous CSAM classification alongside this moderation. For GIFs, the monitor reads a grid of the generated frames together with the generation caption. Some content categories are blocked more broadly for GIFs than for still images, to account for inferred motion.

The Bio and Cyber assessments reuse language-model capability evaluations. The model renders an image that contains a visible scratchpad and a final answer, and only the rendered final answer is graded.

Evidence

The benchmark is 3,077 adversarial prompts, scored with automated reference grading.

Flare regressed before moderation. Its safe-generation rate fell from 78.36% to 75.04%, a statistically significant decline. Most of the drop came from the "Other" category (religious figures, real people, jailbreaks, image-based requests) and from the sexual category.

After moderation, Flare's change is not significant. Unblocked unsafe outputs rose from 46 to 66. Of the 20 net additional outputs, 14 were in "Other", where Flare's rate went from 1.24% to 2.81%.

Per-category unblocked rates differ between the models:

Self-harm and wrongdoing have the highest unblocked rates of any category. In the sexual category, Flare's block rate rose to 87.30%, a significant change. No category showed a significant rise in unblocked outputs.

The GIF test reached 77.66% recall on 310 GIFs labeled policy-violating. That means about 1 in 4 violating GIFs passed moderation on this set.

How to use it

• GIF generation and photo markup are available in both ChatGPT and the API.
• SVG output is available only through the API.
• Outputs carry C2PA metadata and a Google DeepMind SynthID watermark in ChatGPT, Codex and the API.
• OpenAI's public verification tool checks supported files for these provenance signals.
• Reasoning effort is configurable in both ChatGPT and the API, but the page gives no parameter names or API syntax.

Limits

• OpenAI states that the results do not reflect production frequency and do not measure the full deployed system.
• The page gives no per-category prompt counts, so small categories such as extremism may swing on a few prompts.
• OpenAI states that motion-related GIF violations remain hard to detect.
• The page reports no evaluation of SVG output or photo markup.
• OpenAI may suspend accounts that show ongoing patterns of biological misuse.