GPT-Live-1.1 system card

What it claims

GPT-Live-1.1 succeeds GPT-Live-1, and GPT-Live-1.1 Quip succeeds GPT-Live-1 mini. GPT-Live-1.1 is the default voice model for Plus and higher tiers, including in Codex and Dots. Quip is the default for everyone else.

GPT-Live is described as a two-model system: the voice model delegates to an underlying "thinking" model. Much of the safety case rests on the voice model inheriting that model's alignment behaviour and safeguards.

How it works

• Production prompts: voice-native disallowed-content evals use real user audio that users opted to share. The audio passes permission, opt-out and PII-scrubbing checks, then is transcribed and the model's response is graded.
• Synthetic prompts: these are generated from policy text and converted to speech to target rare edge cases.
• Alignment evals: a subset of text alignment evals was converted to audio. The underlying model for these runs was GPT-5.6 Terra.

Evidence

The page's tables and figures did not come through in the fetched text, so only directional results are available. No numbers are given.

• Production prompts: both models are at parity with their predecessors, with no statistically significant regressions. The summary's regressions come only from the synthetic set.
• Synthetic prompts: the regressions are for GPT-Live-1.1 versus GPT-Live-1. Quip is not reported as regressing.
• Respecting Warnings: both 1.1 models regress slightly.
• Blocker Deception: 1.1 is slightly better and Quip slightly worse than their predecessors.
• Broken Search Tool: 1.1 is slightly worse and Quip slightly better. OpenAI calls the GPT-Live failure rate "relatively high," yet every GPT-Live model beats GPT-5.6 Terra on it, for reasons OpenAI does not yet understand.

Limits

• Disallowed-content evals: these are not prevalence-weighted and are deliberately built from cases where earlier voice models failed. The scores do not reflect production rates.
• Synthetic evals: these exclude system-level interventions such as Trusted Contact, localized crisis helplines and Parental Controls. OpenAI says more research is needed on the regressions.
• Alignment evals: these run without the system safeguard stack and without the standard first-party developer prompt. They measure baseline behaviour, not deployed behaviour.
• Score comparability: scores from earlier system cards are not directly comparable, because predecessor values are re-run on the latest model versions.
• Preparedness scope: the "not High" conclusion applies to the models "when operating without delegation."
• Cybersecurity: risk is limited because the Live models have no code execution and no broad tool access beyond what they delegate. OpenAI will reassess before enabling more tools.
• Bio/chem: this relies on inherited flagship-model safeguards plus automated monitors. The monitors can end calls or degrade the experience for repeated abuse, alongside actor-level enforcement.
• For builders: the model's safety profile depends on whichever model it delegates to and on these system-level controls.