ChatGPT Images 2.5 System Card

What it claims

OpenAI's system card (published September 8, 2026) for ChatGPT Images 2.5 says the GPT-Images-2.5 series (GPT-Image-2.5-Sunburst and GPT-Image-2.5-Flare) "generally performs on par with or better than" ChatGPT Images 2.0 on an adversarial safety evaluation. It says no difference in unsafe images shown to users reached p < 0.05. It also says neither model crosses the Bio High or Cyber High Preparedness thresholds. Even so, OpenAI applies High-capability biological mitigations as a precaution, as it did for 2.0.

The main new risk it names is heightened realism. Without safeguards, that realism would allow more convincing deepfakes of real people, places or events, including political and sexual ones. New product features are sketch-based generation, templates, shared prompts and faster generation.

How it works

The card describes the safety stack for Sunburst. It does not say whether Flare uses the identical stack.

flowchart TD
  R[Request + input images] --> U{LLM policy check}
  U -- violates --> X1[Refused]
  U -- ok --> I{Monitor: text + image inputs}
  I -- violates --> X2[Blocked]
  I -- ok --> G[Image generation]
  G --> O{Monitor: output image}
  O -- violates --> X3[Blocked]
  O -- ok --> S[Shown to user]

The monitor is a multimodal safety reasoning model trained to reason about prompt intent and content policy. The same model enforces an image-specific variant of the biological-risk policy on both edit inputs and outputs. Its signals also feed offline biorisk review. That review uses automated systems plus human reviewers and can end in account suspension.

To run the Preparedness evaluations, OpenAI adapted its text bio and cyber capability evals to images. The model renders an image containing a visible reasoning scratchpad and a final answer. Only the rendered final answer is graded, using each eval's existing criteria. OpenAI did not evaluate AI Self-Improvement, on the grounds that image models cannot create or execute code.

Evidence

• Adversarial safety eval: prompts were built to elicit violations across all tracked categories. Each output was scored as one of three outcomes:
• safe generated
• unsafe blocked
• unsafe presented
• Statistics: two-sided exact McNemar test against 2.0, with no adjustment for multiple comparisons. "Minor regressions" are described as not statistically significant.
• Missing numbers: Tables 1 and 2 (overall and per-policy results) did not render in the page text, so no figures are available here.
• "Other" category: covers religious figures and satire, fabricated or compromising depictions of real people, jailbreaks and image-based requests.
• Bio monitor: reported to have recall and precision "comparable" to OpenAI's live text-based biorisk systems. No numbers are given.

How to use it

Provenance applies to all outputs. C2PA metadata is covered under the C2PA Conformance Program. A SynthID invisible watermark from Google DeepMind is applied through ChatGPT, Codex and the OpenAI API. If you consume or redistribute API outputs, you can expect both markers.

Limits

• The adversarial rates do not represent production prompt frequencies.
• Policy labels are automated and may contain errors.
• Sample sizes differ by policy, which affects precision.
• Results apply only to the fixed test set and the model and safeguard configurations evaluated.
• Significance is unadjusted across many comparisons.
• OpenAI states that no single provenance solution exists.
• No quantitative capability scores are given for the Preparedness evaluations, only a pass or fail against each threshold.