GPT-Rosalind-6 System Card Addendum

What it claims

GPT-Rosalind-6 is GPT-6 Astra's weights, unchanged, deployed under looser biology refusals and tighter access. OpenAI states it added no training data and did no extra post-training for this release. The differences from GPT-6 Astra are therefore in deployment: who gets access, how the model is configured, and how it is monitored. OpenAI rates the release High in Biological and Chemical (below Critical) and Critical in Cybersecurity. It rates AI Self-Improvement below High. The cyber and self-improvement ratings are inherited directly from GPT-6 Astra's assessment.

Evidence

All three benchmarks compare against GPT-Rosalind-5.5 rerun on the same benchmark versions and problem sets, at the highest reasoning budget tested:

• MedChemBench v7 (99 problems): 49.6% vs 28.9% mean rubric score.
• GeneBench Pro v13 (129 problems, seven responses each): 37.7% vs 16.7% single-attempt success. This ran in a benchmark-specific configuration that differs from production.
• LifeSciBench Gold (94 problems, after six flagged problems were excluded): 61.3% vs 44.0%.

On Preparedness, refusal-adjusted scores exceed the High thresholds on three of the four High evaluations. On TroubleshootingBench, GPT-Rosalind-6 scored 491/832 against a 36.4% threshold, with nine failed attempts counted as incorrect.

Biorisk knowledge is the one result below threshold:

None of the four Critical design evaluations met its threshold:

For SHP2, GPT-6 Astra's reported maximum was 0.40, and a separate helpful-only run scored 0.35. OpenAI describes the comparison with GPT-Rosalind-5.5 on these four evaluations as "mixed." The hard-negative protein binding and DNA sequence design evaluations have been retired.

Cyber jailbreak regression replayed nine known attacks across ten ExploitBench tasks with real-time blocking disabled. Mean task success was 14.3% for GPT-Rosalind-6 vs 15.7% for GPT-6 Astra, averaged over seven attacks. The other two attacks were excluded because every attempt errored or hit turn limits.

On alignment, GPT-Rosalind-6 does better than GPT-6 Astra on some measures and worse on others:

Chain-of-thought controllability is 71.8% on GPQA, 59.3% on HLE and 83.1% on MMLU, against 69.2%, 53.8% and 81.6% for GPT-6 Astra. Lower is better on this measure. The page calls all of these "descriptive comparisons" because evaluation versions, settings and coverage differ between runs.

How to use it

Access is through a trusted-access application only. OpenAI reviews the applicant's mission, use case, governance and ability to control access. Eligibility is the same as for GPT-Rosalind-5.5, including the Rosalind Academic Plan, and has not been broadened.

• Non-government applicants also pass business verification and compliance screening.
• Government entities have a separate pathway for biosecurity, biosafety, public-health and biodefense work.

Approved customers take on these obligations:

• Restrict access to authorized users with a legitimate need.
• Apply least-privilege controls, onboarding and insider-risk controls.
• Remove access when a user no longer needs it.
• Apply qualified human review before outputs inform experiments, publications or consequential decisions.

Data retention is approved separately. GPT-6 Astra's real-time cyber blocking stays on, and the cyber refusal boundary is more conservative than Astra's.

Limits

• The fetched text is missing the numeric rows for Tables 2, 3 and 5 through 9. Per-model scores on ProtocolQA, Virology Troubleshooting and the four Critical evaluations are therefore not available here.
• Table 10's model column labels are also missing. Its Biosecurity - Severe pass rates range from 88.6% to 99.8% across the three unlabeled columns.
• Critical thresholds are, in OpenAI's words, "preliminary estimates informed by expert judgment."
• The post-deployment biosecurity red-team for GPT-Rosalind-6 is still in progress, and its details will not be published.
• Biology refusals are deliberately reduced relative to GPT-6 Astra in General Access.