ChatGPT Images 2.5 System Card

What it is

This is OpenAI's system card for GPT-Image-2.5-Sunburst and GPT-Image-2.5-Flare, the models behind ChatGPT Images 2.5 (published September 8, 2026). Beyond the safety stack already summarized, the page gives specifics on how the Preparedness Framework evaluation was adapted for an image-generation model and what precautionary bio-risk mitigations actually apply.

How it works

To test Cyber and Biological capability in an image model, OpenAI repurposed existing LLM capability evals: the model is instructed to generate an image containing both a visible reasoning scratchpad and a final answer, and only the rendered final answer is graded against the eval's existing criteria. This lets the same underlying question sets be reused while forcing elicitation through the image modality rather than text.

For live enforcement, a safety reasoning model screens both image inputs (edits) and outputs against an image-specific adaptation of the text-based biological-risk policy, and generation is stopped if either side trips it. Offline, the same advanced reasoning models used for text-based biorisk detection are applied to image conversations, combined with human review; accounts showing ongoing misuse patterns are suspended.

Preconditions / Affected

Applies to both GPT-Image-2.5-Sunburst and GPT-Image-2.5-Flare. Neither model crossed the Bio-High or Cyber-High threshold under this adapted evaluation, but OpenAI still treats both as High-capability in the biological domain and applies the full High-capability mitigation set anyway — the same precautionary stance taken with ChatGPT Images 2.0.

What to do

No user-facing action; this documents OpenAI's internal deployment safeguards. The practical takeaway for an engineer evaluating this model's risk posture: the Cyber/Bio capability claims rest on a novel elicitation method (scratchpad-in-image, grade-the-final-answer) rather than native-modality evals, and the live bio-risk blocking model is reported to have "comparable" — not identical — recall/precision to the text-based equivalent.

Caveats

The page states its own automated safety-evaluation numbers aren't representative of real production prompt distributions, since the test set was adversarially designed to probe every policy category. Statistical comparisons to ChatGPT Images 2.0 use an unadjusted two-sided McNemar test (no multiple-comparisons correction), and no unsafe-shown difference reached significance. Image/text classifiers can't independently verify "comparable" recall/precision for the bio-risk monitor — that claim is asserted, not quantified, in the card.