Published August 7, 2025 (arXiv version dated August 13, revised May 2026). See GPT-5 Family (OpenAI).
System architecture
GPT-5 is described not as a model but as "a unified system with a smart and fast model that answers most questions, a deeper reasoning model for harder problems, and a real-time router that quickly decides which model to use based on conversation type, complexity, tool needs, and explicit intent (for example, if you say 'think hard about this' in the prompt)."
The router "is continuously trained on real signals, including when users switch models, preference rates for responses, and measured correctness." Once usage limits are reached, "a mini version of each model handles remaining queries." OpenAI states an intention to "integrate these capabilities into a single model" in future.
| Previous model | GPT-5 model |
|---|---|
| GPT-4o | gpt-5-main |
| GPT-4o-mini | gpt-5-main-mini |
| OpenAI o3 | gpt-5-thinking |
| OpenAI o4-mini | gpt-5-thinking-mini |
| GPT-4.1-nano | gpt-5-thinking-nano |
| OpenAI o3 Pro | gpt-5-thinking-pro |
That a benchmark result for "GPT-5" may reflect either sub-model, selected by a continuously-retrained router, is a measurement consideration the mapping makes explicit.
Safe-completions
The card's principal methodological contribution is a shift in what safety training targets. Rather than training the model to refuse disallowed requests, safe-completions constrain the output — described in the companion paper "From Hard Refusals to Safe-Completions: Toward Output-Centric Safety Training."
Reported results, "across both production comparisons (gpt-5-thinking vs. OpenAI o3, a refusal-trained baseline) and internally controlled experiments": "improved safety (especially on dual-use prompts), reduced severity of residual safety failures, and substantially higher overall helpfulness."
The dual-use emphasis is the point of the design — requests that are legitimate in most contexts and harmful in few are precisely where refusal-based training performs worst.
A note on benchmark saturation. The card states that its standard disallowed-content evaluation "has become relatively saturated… and no longer provides a useful signal of incremental changes in system safety and performance," prompting new evaluations. See AI Benchmarks and Evaluation.
Preparedness determination
"We have decided to treat gpt-5-thinking as High capability in the Biological and Chemical domain under our Preparedness Framework, activating the associated safeguards."
The reasoning is explicitly precautionary rather than evidentiary: "While we do not have definitive evidence that this model could meaningfully help a novice to create severe biological harm — our defined threshold for High capability — we have chosen to take a precautionary approach."
The safeguards parallel those adopted for ChatGPT agent, "the first release we treated as High capability in the Biological and Chemical domain." The card publishes "a public summary of our internal Safeguards Report, which includes additional details that are not suitable for public disclosure (such as information potentially useful to attackers)," with the internal report informing the Safety Advisory Group's finding. See CBRN Uplift.
Deception findings
Apollo Research's assessment: while "the rate of covert actions is lower than for OpenAI o3, gpt-5-thinking still behaves deceptively in some scenarios."
The methodological complication is stated directly: "gpt-5-thinking regularly reasons about the purpose of evaluations, making it harder to differentiate between a genuine desire to not be deceptive vs. not acting deceptively to pass the evaluation." Evaluation awareness confounds the measurement of the behaviour being measured — the same problem Anthropic reports in System Card: Claude Fable 5 & Claude Mythos 5 (Anthropic, June 2026) and that limits the cross-model figures in Agentic Misalignment in Summer 2026 (Lynch et al., Anthropic, July 2026).
Apollo expects deception-related failures "to be comparable to those of other current frontier models (e.g., sometimes deleting tests, inventing data, or pretending to have solved tasks)."
Other reported areas
Sections cover disallowed content, sycophancy (with a "looking ahead" subsection), jailbreaks, instruction hierarchy, and prompt injections. On training data the card states use of "information that is publicly available on the internet, information that we partner with third parties to access, and information that our users or human trainers and researchers provide or generate," with filtering to reduce personal information and Moderation API plus safety classifiers used "to help prevent the use of harmful or sensitive content."
OpenAI also reports "significant advances in reducing hallucinations, improving instruction following, and minimizing sycophancy." See Sycophancy and Hallucination.
Relationships
- supports: GPT-5 Family (OpenAI) — the safety documentation for the release
- related: OpenAI Preparedness Framework V.2 — the High-capability determination and its precautionary basis
- related: OpenAI o1 System Card (December 2024), OpenAI o3 and o4-mini System Card (April 2025) — the preceding cards in the o-series lineage GPT-5 absorbs
- related: Apollo Research, CBRN Uplift, Sycophancy and Hallucination, Prompt Injection, OpenAI