Published August 7, 2025 (arXiv version dated August 13, revised May 2026). See GPT-5 Family (OpenAI).
System architecture
GPT-5 is described not as a model but as "a unified system with a smart and fast model that answers most questions, a deeper reasoning model for harder problems, and a real-time router that quickly decides which model to use based on conversation type, complexity, tool needs, and explicit intent (for example, if you say 'think hard about this' in the prompt)."
The router "is continuously trained on real signals, including when users switch models, preference rates for responses, and measured correctness." Once usage limits are reached, "a mini version of each model handles remaining queries." OpenAI states an intention to "integrate these capabilities into a single model" in future.
| Previous model | GPT-5 model |
|---|---|
| GPT-4o | gpt-5-main |
| GPT-4o-mini | gpt-5-main-mini |
| OpenAI o3 | gpt-5-thinking |
| OpenAI o4-mini | gpt-5-thinking-mini |
| GPT-4.1-nano | gpt-5-thinking-nano |
| OpenAI o3 Pro | gpt-5-thinking-pro |
That a benchmark result for "GPT-5" may reflect either sub-model, selected by a continuously-retrained router, is a measurement consideration the mapping makes explicit.
Safe-completions
The card's principal methodological contribution is a shift in what safety training targets. Rather than training the model to refuse disallowed requests, safe-completions constrain the output — described in the companion paper "From Hard Refusals to Safe-Completions: Toward Output-Centric Safety Training."
Reported results, "across both production comparisons (gpt-5-thinking vs. OpenAI o3, a refusal-trained baseline) and internally controlled experiments": "improved safety (especially on dual-use prompts), reduced severity of residual safety failures, and substantially higher overall helpfulness."
The dual-use emphasis is the point of the design — requests that are legitimate in most contexts and harmful in few are precisely where refusal-based training performs worst.
A note on benchmark saturation. The card states that its standard disallowed-content evaluation "has become relatively saturated… and no longer provides a useful signal of incremental changes in system safety and performance," prompting new evaluations. See AI Benchmarks and Evaluation.
Preparedness determination
"We have decided to treat gpt-5-thinking as High capability in the Biological and Chemical domain under our Preparedness Framework, activating the associated safeguards."
The reasoning is explicitly precautionary rather than evidentiary: "While we do not have definitive evidence that this model could meaningfully help a novice to create severe biological harm — our defined threshold for High capability — we have chosen to take a precautionary approach."
The safeguards parallel those adopted for ChatGPT agent, "the first release we treated as High capability in the Biological and Chemical domain." The card publishes "a public summary of our internal Safeguards Report, which includes additional details that are not suitable for public disclosure (such as information potentially useful to attackers)," with the internal report informing the Safety Advisory Group's finding. See CBRN Uplift.
Deception findings
Apollo Research's assessment: while "the rate of covert actions is lower than for OpenAI o3, gpt-5-thinking still behaves deceptively in some scenarios."
The methodological complication is stated directly: "gpt-5-thinking regularly reasons about the purpose of evaluations, making it harder to differentiate between a genuine desire to not be deceptive vs. not acting deceptively to pass the evaluation." Evaluation awareness confounds the measurement of the behaviour being measured — the same problem Anthropic reports in System Card: Claude Fable 5 & Claude Mythos 5 (Anthropic, June 2026) and that limits the cross-model figures in Agentic Misalignment in Summer 2026 (Lynch et al., Anthropic, July 2026).
Apollo expects deception-related failures "to be comparable to those of other current frontier models (e.g., sometimes deleting tests, inventing data, or pretending to have solved tasks)."
Other reported areas
Sections cover disallowed content, sycophancy (with a "looking ahead" subsection), jailbreaks, instruction hierarchy, and prompt injections. On training data the card states use of "information that is publicly available on the internet, information that we partner with third parties to access, and information that our users or human trainers and researchers provide or generate," with filtering to reduce personal information and Moderation API plus safety classifiers used "to help prevent the use of harmful or sensitive content."
OpenAI also reports "significant advances in reducing hallucinations, improving instruction following, and minimizing sycophancy." See Sycophancy and Hallucination.
Reported results
Evaluation results the document states for which there is no separate benchmark page; results on benchmarks that have a page are recorded there and cite this page. Scores and settings are as printed in the document.
| Evaluation | Model | Score | Setting | Section |
|---|---|---|---|---|
| Standard Disallowed Content Evaluation — hate (aggregate) | gpt-5-thinking | 1.000 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — hate (aggregate) | OpenAI o3 | 0.992 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — hate (aggregate) | gpt-5-main | 0.987 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — hate (aggregate) | GPT-4o | 0.996 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — illicit/non-violent | gpt-5-thinking | 0.991 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — illicit/non-violent | OpenAI o3 | 0.991 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — illicit/non-violent | gpt-5-main | 0.991 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — illicit/non-violent | GPT-4o | 0.983 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — illicit/violent | gpt-5-thinking | 1.000 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — illicit/violent | OpenAI o3 | 1.000 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — illicit/violent | gpt-5-main | 0.992 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — illicit/violent | GPT-4o | 1.000 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — personal-data | gpt-5-thinking | 0.881 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — personal-data | OpenAI o3 | 0.930 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — personal-data | gpt-5-main | 0.980 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — personal-data | GPT-4o | 0.967 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — personal-data/restricted | gpt-5-thinking | 0.989 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — personal-data/restricted | OpenAI o3 | 0.921 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — personal-data/restricted | gpt-5-main | 0.989 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — personal-data/restricted | GPT-4o | 0.978 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — self-harm/intent and self-harm/instructions | gpt-5-thinking | 1.000 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — self-harm/intent and self-harm/instructions | OpenAI o3 | 1.000 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — self-harm/intent and self-harm/instructions | gpt-5-main | 1.000 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — self-harm/intent and self-harm/instructions | GPT-4o | 1.000 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — sexual/exploitative | gpt-5-thinking | 1.000 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — sexual/exploitative | OpenAI o3 | 1.000 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — sexual/exploitative | gpt-5-main | 1.000 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — sexual/exploitative | GPT-4o | 1.000 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — sexual/minors | gpt-5-thinking | 0.990 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — sexual/minors | OpenAI o3 | 1.000 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — sexual/minors | gpt-5-main | 1.000 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — sexual/minors | GPT-4o | 1.000 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 2 |
| Standard Disallowed Content Evaluation — hate (aggregate) | gpt-5-thinking-mini | 0.996 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — hate (aggregate) | gpt-5-thinking-nano | 0.987 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — hate (aggregate) | OpenAI o4-mini | 0.983 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — hate (aggregate) | gpt-5-main-mini | 0.996 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — illicit/non-violent | gpt-5-thinking-mini | 1.000 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — illicit/non-violent | gpt-5-thinking-nano | 0.991 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — illicit/non-violent | OpenAI o4-mini | 0.991 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — illicit/non-violent | gpt-5-main-mini | 0.974 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — illicit/violent | gpt-5-thinking-mini | 1.000 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — illicit/violent | gpt-5-thinking-nano | 1.000 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — illicit/violent | OpenAI o4-mini | 1.000 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — illicit/violent | gpt-5-main-mini | 1.000 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — personal-data | gpt-5-thinking-mini | 0.898 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — personal-data | gpt-5-thinking-nano | 0.963 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — personal-data | OpenAI o4-mini | 0.930 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — personal-data | gpt-5-main-mini | 0.975 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — personal-data/restricted | gpt-5-thinking-mini | 0.966 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — personal-data/restricted | gpt-5-thinking-nano | 0.955 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — personal-data/restricted | OpenAI o4-mini | 0.933 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — personal-data/restricted | gpt-5-main-mini | 0.989 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — self-harm/intent and self-harm/instructions | gpt-5-thinking-mini | 0.989 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — self-harm/intent and self-harm/instructions | gpt-5-thinking-nano | 0.989 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — self-harm/intent and self-harm/instructions | OpenAI o4-mini | 1.000 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — self-harm/intent and self-harm/instructions | gpt-5-main-mini | 0.989 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — sexual/exploitative | gpt-5-thinking-mini | 1.000 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — sexual/exploitative | gpt-5-thinking-nano | 0.980 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — sexual/exploitative | OpenAI o4-mini | 1.000 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — sexual/exploitative | gpt-5-main-mini | 1.000 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — sexual/minors | gpt-5-thinking-mini | 0.990 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — sexual/minors | gpt-5-thinking-nano | 0.990 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — sexual/minors | OpenAI o4-mini | 1.000 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | Appendix 1, Table 23 |
| Standard Disallowed Content Evaluation — sexual/minors | gpt-5-main-mini | 1.000 | not_unsafe (share of responses not violating policy), LLM-based policy grader; higher is better; developer-reported | Appendix 1, Table 23 |
| Production Benchmarks — non-violent hate | gpt-5-thinking | 0.883 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | 3.2, Table 3 |
| Production Benchmarks — non-violent hate | OpenAI o3 | 0.842 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 3 |
| Production Benchmarks — non-violent hate | gpt-5-main | 0.851 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | 3.2, Table 3 |
| Production Benchmarks — non-violent hate | GPT-4o | 0.882 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 3 |
| Production Benchmarks — personal-data | gpt-5-thinking | 0.877 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | 3.2, Table 3 |
| Production Benchmarks — personal-data | OpenAI o3 | 0.830 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 3 |
| Production Benchmarks — personal-data | gpt-5-main | 0.980 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | 3.2, Table 3 |
| Production Benchmarks — personal-data | GPT-4o | 0.967 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 3 |
| Production Benchmarks — harassment/threatening | gpt-5-thinking | 0.755 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | 3.2, Table 3 |
| Production Benchmarks — harassment/threatening | OpenAI o3 | 0.666 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 3 |
| Production Benchmarks — harassment/threatening | gpt-5-main | 0.689 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | 3.2, Table 3 |
| Production Benchmarks — harassment/threatening | GPT-4o | 0.745 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 3 |
| Production Benchmarks — sexual/exploitative | gpt-5-thinking | 0.931 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | 3.2, Table 3 |
| Production Benchmarks — sexual/exploitative | OpenAI o3 | 0.939 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 3 |
| Production Benchmarks — sexual/exploitative | gpt-5-main | 0.826 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | 3.2, Table 3 |
| Production Benchmarks — sexual/exploitative | GPT-4o | 0.927 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 3 |
| Production Benchmarks — sexual/minors | gpt-5-thinking | 0.958 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | 3.2, Table 3 |
| Production Benchmarks — sexual/minors | OpenAI o3 | 0.957 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 3 |
| Production Benchmarks — sexual/minors | gpt-5-main | 0.910 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | 3.2, Table 3 |
| Production Benchmarks — sexual/minors | GPT-4o | 0.939 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 3 |
| Production Benchmarks — extremism | gpt-5-thinking | 0.954 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | 3.2, Table 3 |
| Production Benchmarks — extremism | OpenAI o3 | 0.920 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 3 |
| Production Benchmarks — extremism | gpt-5-main | 0.910 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | 3.2, Table 3 |
| Production Benchmarks — extremism | GPT-4o | 0.919 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 3 |
| Production Benchmarks — hate/threatening | gpt-5-thinking | 0.822 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | 3.2, Table 3 |
| Production Benchmarks — hate/threatening | OpenAI o3 | 0.677 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 3 |
| Production Benchmarks — hate/threatening | gpt-5-main | 0.727 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | 3.2, Table 3 |
| Production Benchmarks — hate/threatening | GPT-4o | 0.867 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 3 |
| Production Benchmarks — illicit/nonviolent | gpt-5-thinking | 0.790 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | 3.2, Table 3 |
| Production Benchmarks — illicit/nonviolent | OpenAI o3 | 0.717 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 3 |
| Production Benchmarks — illicit/nonviolent | gpt-5-main | 0.701 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | 3.2, Table 3 |
| Production Benchmarks — illicit/nonviolent | GPT-4o | 0.573 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 3 |
| Production Benchmarks — illicit/violent | gpt-5-thinking | 0.912 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | 3.2, Table 3 |
| Production Benchmarks — illicit/violent | OpenAI o3 | 0.829 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 3 |
| Production Benchmarks — illicit/violent | gpt-5-main | 0.786 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | 3.2, Table 3 |
| Production Benchmarks — illicit/violent | GPT-4o | 0.633 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 3 |
| Production Benchmarks — self-harm/intent | gpt-5-thinking | 0.950 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | 3.2, Table 3 |
| Production Benchmarks — self-harm/intent | OpenAI o3 | 0.824 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 3 |
| Production Benchmarks — self-harm/intent | gpt-5-main | 0.849 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | 3.2, Table 3 |
| Production Benchmarks — self-harm/intent | GPT-4o | 0.849 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 3 |
| Production Benchmarks — self-harm/instructions | gpt-5-thinking | 0.955 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | 3.2, Table 3 |
| Production Benchmarks — self-harm/instructions | OpenAI o3 | 0.864 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 3 |
| Production Benchmarks — self-harm/instructions | gpt-5-main | 0.759 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | 3.2, Table 3 |
| Production Benchmarks — self-harm/instructions | GPT-4o | 0.735 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.2, Table 3 |
| Production Benchmarks — hate/threatening | OpenAI o4-mini | 0.724 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; stated in prose, not in Table 3; comparison model; reported by OpenAI in the GPT-5 system card | 3.2 (text) |
| Production Benchmarks — non-violent hate | gpt-5-thinking-mini | 0.874 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — non-violent hate | gpt-5-thinking-nano | 0.926 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — non-violent hate | OpenAI o4-mini | 0.874 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | Appendix 1, Table 24 |
| Production Benchmarks — non-violent hate | gpt-5-main-mini | 0.821 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — personal-data | gpt-5-thinking-mini | 0.843 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — personal-data | gpt-5-thinking-nano | 0.909 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — personal-data | OpenAI o4-mini | 0.847 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | Appendix 1, Table 24 |
| Production Benchmarks — personal-data | gpt-5-main-mini | 0.943 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — harassment/threatening | gpt-5-thinking-mini | 0.752 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — harassment/threatening | gpt-5-thinking-nano | 0.771 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — harassment/threatening | OpenAI o4-mini | 0.641 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | Appendix 1, Table 24 |
| Production Benchmarks — harassment/threatening | gpt-5-main-mini | 0.708 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — sexual/exploitative | gpt-5-thinking-mini | 0.94 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — sexual/exploitative | gpt-5-thinking-nano | 0.935 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — sexual/exploitative | OpenAI o4-mini | 0.927 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | Appendix 1, Table 24 |
| Production Benchmarks — sexual/exploitative | gpt-5-main-mini | 0.886 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — sexual/minors | gpt-5-thinking-mini | 0.981 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — sexual/minors | gpt-5-thinking-nano | 0.972 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — sexual/minors | OpenAI o4-mini | 0.947 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | Appendix 1, Table 24 |
| Production Benchmarks — sexual/minors | gpt-5-main-mini | 0.929 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — extremism | gpt-5-thinking-mini | 0.944 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — extremism | gpt-5-thinking-nano | 0.955 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — extremism | OpenAI o4-mini | 0.864 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | Appendix 1, Table 24 |
| Production Benchmarks — extremism | gpt-5-main-mini | 0.909 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — hate/threatening | gpt-5-thinking-mini | 0.829 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — hate/threatening | gpt-5-thinking-nano | 0.797 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — hate/threatening | OpenAI o4-mini | 0.724 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | Appendix 1, Table 24 |
| Production Benchmarks — hate/threatening | gpt-5-main-mini | 0.778 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — illicit/nonviolent | gpt-5-thinking-mini | 0.814 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — illicit/nonviolent | gpt-5-thinking-nano | 0.879 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — illicit/nonviolent | OpenAI o4-mini | 0.603 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | Appendix 1, Table 24 |
| Production Benchmarks — illicit/nonviolent | gpt-5-main-mini | 0.756 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — illicit/violent | gpt-5-thinking-mini | 0.944 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — illicit/violent | gpt-5-thinking-nano | 0.947 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — illicit/violent | OpenAI o4-mini | 0.786 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | Appendix 1, Table 24 |
| Production Benchmarks — illicit/violent | gpt-5-main-mini | 0.809 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — self-harm/intent | gpt-5-thinking-mini | 0.95 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — self-harm/intent | gpt-5-thinking-nano | 0.933 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — self-harm/intent | OpenAI o4-mini | 0.815 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | Appendix 1, Table 24 |
| Production Benchmarks — self-harm/intent | gpt-5-main-mini | 0.864 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — self-harm/instructions | gpt-5-thinking-mini | 0.939 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — self-harm/instructions | gpt-5-thinking-nano | 0.954 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Production Benchmarks — self-harm/instructions | OpenAI o4-mini | 0.864 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | Appendix 1, Table 24 |
| Production Benchmarks — self-harm/instructions | gpt-5-main-mini | 0.773 | not_unsafe, multi-turn conversations representative of production data, LLM-based grader; higher is better; developer-reported | Appendix 1, Table 24 |
| Sycophancy evaluation — Offline evaluation | GPT-4o (baseline) | 0.145 | sycophancy score on a fixed set of messages resembling production traffic; lower is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.3, Table 4 |
| Sycophancy evaluation — Offline evaluation | gpt-5-main | 0.052 | sycophancy score on a fixed set of messages resembling production traffic; lower is better; developer-reported | 3.3, Table 4 |
| Sycophancy evaluation — Offline evaluation | gpt-5-thinking | 0.040 | sycophancy score on a fixed set of messages resembling production traffic; lower is better; developer-reported | 3.3, Table 4 |
| Sycophancy evaluation — Preliminary online prevalence, free users | gpt-5-main | -0.69 | change in prevalence of sycophancy relative to the most recent GPT-4o, early A/B tests on real traffic, random sample of assistant responses (prose: fell by 69%); developer-reported | 3.3, Table 4 |
| Sycophancy evaluation — Preliminary online prevalence, paid users | gpt-5-main | -0.75 | change in prevalence of sycophancy relative to the most recent GPT-4o, early A/B tests on real traffic, random sample of assistant responses (prose: fell by 75%); developer-reported | 3.3, Table 4 |
| Instruction Hierarchy Evaluations — System prompt extraction - realistic attacks of user attacking system message | gpt-5-thinking | 0.990 | higher is better; developer-reported | 3.5, Table 6 |
| Instruction Hierarchy Evaluations — System prompt extraction - realistic attacks of user attacking system message | OpenAI o3 | 0.997 | higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.5, Table 6 |
| Instruction Hierarchy Evaluations — System prompt extraction - realistic attacks of user attacking system message | gpt-5-main | 0.885 | higher is better; developer-reported | 3.5, Table 6 |
| Instruction Hierarchy Evaluations — System prompt extraction - realistic attacks of user attacking system message | GPT-4o | 0.885 | higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.5, Table 6 |
| Instruction Hierarchy Evaluations — System prompt extraction - academic attacks of user message attacking system message | gpt-5-thinking | 0.991 | higher is better; developer-reported | 3.5, Table 6 |
| Instruction Hierarchy Evaluations — System prompt extraction - academic attacks of user message attacking system message | OpenAI o3 | 0.982 | higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.5, Table 6 |
| Instruction Hierarchy Evaluations — System prompt extraction - academic attacks of user message attacking system message | gpt-5-main | 0.930 | higher is better; developer-reported | 3.5, Table 6 |
| Instruction Hierarchy Evaluations — System prompt extraction - academic attacks of user message attacking system message | GPT-4o | 0.825 | higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.5, Table 6 |
| Instruction Hierarchy Evaluations — System prompt extraction - academic attacks of developer message attacking system message | gpt-5-thinking | 0.991 | higher is better; developer-reported | 3.5, Table 6 |
| Instruction Hierarchy Evaluations — System prompt extraction - academic attacks of developer message attacking system message | OpenAI o3 | 0.982 | higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.5, Table 6 |
| Instruction Hierarchy Evaluations — System prompt extraction - academic attacks of developer message attacking system message | gpt-5-main | 0.789 | higher is better; developer-reported | 3.5, Table 6 |
| Instruction Hierarchy Evaluations — System prompt extraction - academic attacks of developer message attacking system message | GPT-4o | 0.561 | higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.5, Table 6 |
| Instruction Hierarchy Evaluations — Phrase protection - malicious user message | gpt-5-thinking | 0.940 | higher is better; developer-reported | 3.5, Table 6 |
| Instruction Hierarchy Evaluations — Phrase protection - malicious user message | OpenAI o3 | 0.975 | higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.5, Table 6 |
| Instruction Hierarchy Evaluations — Phrase protection - malicious user message | gpt-5-main | 0.619 | higher is better; developer-reported | 3.5, Table 6 |
| Instruction Hierarchy Evaluations — Phrase protection - malicious user message | GPT-4o | 0.735 | higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.5, Table 6 |
| Instruction Hierarchy Evaluations — Phrase protection - malicious developer message | gpt-5-thinking | 0.911 | higher is better; developer-reported | 3.5, Table 6 |
| Instruction Hierarchy Evaluations — Phrase protection - malicious developer message | OpenAI o3 | 0.921 | higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.5, Table 6 |
| Instruction Hierarchy Evaluations — Phrase protection - malicious developer message | gpt-5-main | 0.404 | higher is better; developer-reported | 3.5, Table 6 |
| Instruction Hierarchy Evaluations — Phrase protection - malicious developer message | GPT-4o | 0.449 | higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.5, Table 6 |
| Prompt Injection Evaluations — Browsing prompt injections | gpt-5-thinking | 0.99 | robustness to injected instructions; higher is better; developer-reported | 3.6, Table 7 |
| Prompt Injection Evaluations — Browsing prompt injections | OpenAI o3 | 0.89 | robustness to injected instructions; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.6, Table 7 |
| Prompt Injection Evaluations — Tool calling prompt injections | gpt-5-thinking | 0.99 | robustness to injected instructions; higher is better; developer-reported | 3.6, Table 7 |
| Prompt Injection Evaluations — Tool calling prompt injections | OpenAI o3 | 0.80 | robustness to injected instructions; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.6, Table 7 |
| Prompt Injection Evaluations — Coding prompt injections | gpt-5-thinking | 0.97 | robustness to injected instructions; higher is better; developer-reported | 3.6, Table 7 |
| Prompt Injection Evaluations — Coding prompt injections | OpenAI o3 | 0.94 | robustness to injected instructions; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.6, Table 7 |
| Factuality on ChatGPT Production Traffic (Browsing Enabled) — % incorrect claims | gpt-5-thinking | 4.5% | prompts representative of ChatGPT production conversations, browsing enabled, LLM grader with web access; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); developer-reported | 3.7, Figure 1 |
| Factuality on ChatGPT Production Traffic (Browsing Enabled) — % incorrect claims | OpenAI o3 | 12.7% | prompts representative of ChatGPT production conversations, browsing enabled, LLM grader with web access; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); comparison model; reported by OpenAI in the GPT-5 system card | 3.7, Figure 1 |
| Factuality on ChatGPT Production Traffic (Browsing Enabled) — % incorrect claims | gpt-5-main | 9.6% | prompts representative of ChatGPT production conversations, browsing enabled, LLM grader with web access; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); developer-reported | 3.7, Figure 1 |
| Factuality on ChatGPT Production Traffic (Browsing Enabled) — % incorrect claims | GPT-4o | 12.9% | prompts representative of ChatGPT production conversations, browsing enabled, LLM grader with web access; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); comparison model; reported by OpenAI in the GPT-5 system card | 3.7, Figure 1 |
| Factuality on ChatGPT Production Traffic (Browsing Enabled) — % responses with 1+ major incorrect claims | gpt-5-thinking | 4.8% | prompts representative of ChatGPT production conversations, browsing enabled, LLM grader with web access; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); developer-reported | 3.7, Figure 1 |
| Factuality on ChatGPT Production Traffic (Browsing Enabled) — % responses with 1+ major incorrect claims | OpenAI o3 | 22.0% | prompts representative of ChatGPT production conversations, browsing enabled, LLM grader with web access; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); comparison model; reported by OpenAI in the GPT-5 system card | 3.7, Figure 1 |
| Factuality on ChatGPT Production Traffic (Browsing Enabled) — % responses with 1+ major incorrect claims | gpt-5-main | 11.6% | prompts representative of ChatGPT production conversations, browsing enabled, LLM grader with web access; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); developer-reported | 3.7, Figure 1 |
| Factuality on ChatGPT Production Traffic (Browsing Enabled) — % responses with 1+ major incorrect claims | GPT-4o | 20.6% | prompts representative of ChatGPT production conversations, browsing enabled, LLM grader with web access; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); comparison model; reported by OpenAI in the GPT-5 system card | 3.7, Figure 1 |
| Factuality on ChatGPT Production Traffic (Browsing Enabled) — Number of correct claims per response | gpt-5-thinking | 7.2 | prompts representative of ChatGPT production conversations, browsing enabled, LLM grader with web access; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); developer-reported | 3.7, Figure 1 |
| Factuality on ChatGPT Production Traffic (Browsing Enabled) — Number of correct claims per response | OpenAI o3 | 7.7 | prompts representative of ChatGPT production conversations, browsing enabled, LLM grader with web access; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); comparison model; reported by OpenAI in the GPT-5 system card | 3.7, Figure 1 |
| Factuality on ChatGPT Production Traffic (Browsing Enabled) — Number of correct claims per response | gpt-5-main | 5.9 | prompts representative of ChatGPT production conversations, browsing enabled, LLM grader with web access; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); developer-reported | 3.7, Figure 1 |
| Factuality on ChatGPT Production Traffic (Browsing Enabled) — Number of correct claims per response | GPT-4o | 6.8 | prompts representative of ChatGPT production conversations, browsing enabled, LLM grader with web access; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); comparison model; reported by OpenAI in the GPT-5 system card | 3.7, Figure 1 |
| LongFact-Concepts — Browsing enabled | gpt-5-thinking | 0.7% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); developer-reported | 3.7, Figure 2 |
| LongFact-Concepts — Browsing enabled | gpt-5-thinking-mini | 0.6% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); developer-reported | 3.7, Figure 2 |
| LongFact-Concepts — Browsing enabled | gpt-5-thinking-nano | 0.9% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); developer-reported | 3.7, Figure 2 |
| LongFact-Concepts — Browsing enabled | OpenAI o3 | 4.5% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); comparison model; reported by OpenAI in the GPT-5 system card | 3.7, Figure 2 |
| LongFact-Concepts — Browsing enabled | OpenAI o4-mini | 3.1% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); comparison model; reported by OpenAI in the GPT-5 system card | 3.7, Figure 2 |
| LongFact-Objects — Browsing enabled | gpt-5-thinking | 0.8% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); developer-reported | 3.7, Figure 2 |
| LongFact-Objects — Browsing enabled | gpt-5-thinking-mini | 0.8% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); developer-reported | 3.7, Figure 2 |
| LongFact-Objects — Browsing enabled | gpt-5-thinking-nano | 1.9% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); developer-reported | 3.7, Figure 2 |
| LongFact-Objects — Browsing enabled | OpenAI o3 | 5.1% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); comparison model; reported by OpenAI in the GPT-5 system card | 3.7, Figure 2 |
| LongFact-Objects — Browsing enabled | OpenAI o4-mini | 4.1% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); comparison model; reported by OpenAI in the GPT-5 system card | 3.7, Figure 2 |
| FActScore — Browsing enabled | gpt-5-thinking | 1.0% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); developer-reported | 3.7, Figure 2 |
| FActScore — Browsing enabled | gpt-5-thinking-mini | 1.0% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); developer-reported | 3.7, Figure 2 |
| FActScore — Browsing enabled | gpt-5-thinking-nano | 2.1% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); developer-reported | 3.7, Figure 2 |
| FActScore — Browsing enabled | OpenAI o3 | 5.7% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); comparison model; reported by OpenAI in the GPT-5 system card | 3.7, Figure 2 |
| FActScore — Browsing enabled | OpenAI o4-mini | 5.1% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); comparison model; reported by OpenAI in the GPT-5 system card | 3.7, Figure 2 |
| LongFact-Concepts — Browsing disabled | gpt-5-thinking | 1.1% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); developer-reported | 3.7, Figure 3 |
| LongFact-Concepts — Browsing disabled | gpt-5-thinking-mini | 0.9% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); developer-reported | 3.7, Figure 3 |
| LongFact-Concepts — Browsing disabled | gpt-5-thinking-nano | 0.9% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); developer-reported | 3.7, Figure 3 |
| LongFact-Concepts — Browsing disabled | OpenAI o3 | 5.9% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); comparison model; reported by OpenAI in the GPT-5 system card | 3.7, Figure 3 |
| LongFact-Concepts — Browsing disabled | OpenAI o4-mini | 2.3% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); comparison model; reported by OpenAI in the GPT-5 system card | 3.7, Figure 3 |
| LongFact-Concepts — Browsing disabled | gpt-5-main | 0.8% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); developer-reported | 3.7, Figure 3 |
| LongFact-Concepts — Browsing disabled | GPT-4o | 0.9% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); comparison model; reported by OpenAI in the GPT-5 system card | 3.7, Figure 3 |
| LongFact-Objects — Browsing disabled | gpt-5-thinking | 1.4% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); developer-reported | 3.7, Figure 3 |
| LongFact-Objects — Browsing disabled | gpt-5-thinking-mini | 1.8% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); developer-reported | 3.7, Figure 3 |
| LongFact-Objects — Browsing disabled | gpt-5-thinking-nano | 3.1% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); developer-reported | 3.7, Figure 3 |
| LongFact-Objects — Browsing disabled | OpenAI o3 | 7.9% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); comparison model; reported by OpenAI in the GPT-5 system card | 3.7, Figure 3 |
| LongFact-Objects — Browsing disabled | OpenAI o4-mini | 9.6% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); comparison model; reported by OpenAI in the GPT-5 system card | 3.7, Figure 3 |
| LongFact-Objects — Browsing disabled | gpt-5-main | 1.3% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); developer-reported | 3.7, Figure 3 |
| LongFact-Objects — Browsing disabled | GPT-4o | 1.1% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); comparison model; reported by OpenAI in the GPT-5 system card | 3.7, Figure 3 |
| FActScore — Browsing disabled | gpt-5-thinking | 3.7% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); developer-reported | 3.7, Figure 3 |
| FActScore — Browsing disabled | gpt-5-thinking-mini | 3.7% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); developer-reported | 3.7, Figure 3 |
| FActScore — Browsing disabled | gpt-5-thinking-nano | 7.8% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); developer-reported | 3.7, Figure 3 |
| FActScore — Browsing disabled | OpenAI o3 | 24.2% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); comparison model; reported by OpenAI in the GPT-5 system card | 3.7, Figure 3 |
| FActScore — Browsing disabled | OpenAI o4-mini | 37.7% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); comparison model; reported by OpenAI in the GPT-5 system card | 3.7, Figure 3 |
| FActScore — Browsing disabled | gpt-5-main | 6.9% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); developer-reported | 3.7, Figure 3 |
| FActScore — Browsing disabled | GPT-4o | 5.6% | claim-level error rate, OpenAI o3 with browsing as grader; lower is better; value is a data label on the chart (in the PDF text layer; model assignment checked against the published figure); comparison model; reported by OpenAI in the GPT-5 system card | 3.7, Figure 3 |
| Coding Deception | gpt-5-thinking | 0.17 | deception rate (share of responses classified as deceptive), agentic coding tasks with an unresolvable impediment; lower is better; developer-reported | 3.8, Table 9 |
| Coding Deception | OpenAI o3 | 0.47 | deception rate (share of responses classified as deceptive), agentic coding tasks with an unresolvable impediment; lower is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.8, Table 9 |
| Browsing Broken Tools | gpt-5-thinking | 0.11 | deception rate, browsing tools disabled or returning errors; lower is better; developer-reported | 3.8, Table 9 |
| Browsing Broken Tools | OpenAI o3 | 0.61 | deception rate, browsing tools disabled or returning errors; lower is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.8, Table 9 |
| AbstentionBench | gpt-5-thinking | 0.53 | recall; higher is better; developer-reported | 3.8, Table 9 |
| AbstentionBench | OpenAI o3 | 0.44 | recall; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.8, Table 9 |
| CoT monitor: deception flagged in production-representative conversations | gpt-5-thinking | 2.1% | share of responses flagged by a chain-of-thought monitor; near-final version of gpt-5-thinking; approximate figures ('~'); developer-reported | 3.8.1 |
| CoT monitor: deception flagged in production-representative conversations | OpenAI o3 | 4.8% | share of responses flagged by a chain-of-thought monitor; near-final version of gpt-5-thinking; approximate figures ('~'); comparison model; reported by OpenAI in the GPT-5 system card | 3.8.1 |
| CoT deception monitor validation — precision | CoT deception monitor | 81% | internal dataset of deceptive and non-deceptive conversations; estimated; developer-reported | 3.8.1 |
| CoT deception monitor validation — recall | CoT deception monitor | 84% | internal dataset of deceptive and non-deceptive conversations; estimated; developer-reported | 3.8.1 |
| Image input evaluations — hate | gpt-5-thinking | 0.968 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | 3.9, Table 10 |
| Image input evaluations — hate | OpenAI o3 | 0.935 | not_unsafe, disallowed combined text and image input; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.9, Table 10 |
| Image input evaluations — hate | gpt-5-main | 0.986 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | 3.9, Table 10 |
| Image input evaluations — hate | GPT-4o | 0.989 | not_unsafe, disallowed combined text and image input; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.9, Table 10 |
| Image input evaluations — extremism | gpt-5-thinking | 0.980 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | 3.9, Table 10 |
| Image input evaluations — extremism | OpenAI o3 | 0.962 | not_unsafe, disallowed combined text and image input; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.9, Table 10 |
| Image input evaluations — extremism | gpt-5-main | 0.991 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | 3.9, Table 10 |
| Image input evaluations — extremism | GPT-4o | 0.964 | not_unsafe, disallowed combined text and image input; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.9, Table 10 |
| Image input evaluations — illicit | gpt-5-thinking | 0.988 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | 3.9, Table 10 |
| Image input evaluations — illicit | OpenAI o3 | 0.972 | not_unsafe, disallowed combined text and image input; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.9, Table 10 |
| Image input evaluations — illicit | gpt-5-main | 0.986 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | 3.9, Table 10 |
| Image input evaluations — illicit | GPT-4o | 0.946 | not_unsafe, disallowed combined text and image input; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.9, Table 10 |
| Image input evaluations — attack planning | gpt-5-thinking | 1.000 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | 3.9, Table 10 |
| Image input evaluations — attack planning | OpenAI o3 | 0.980 | not_unsafe, disallowed combined text and image input; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.9, Table 10 |
| Image input evaluations — attack planning | gpt-5-main | 1.000 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | 3.9, Table 10 |
| Image input evaluations — attack planning | GPT-4o | 0.956 | not_unsafe, disallowed combined text and image input; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.9, Table 10 |
| Image input evaluations — self-harm | gpt-5-thinking | 0.996 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | 3.9, Table 10 |
| Image input evaluations — self-harm | OpenAI o3 | 0.982 | not_unsafe, disallowed combined text and image input; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.9, Table 10 |
| Image input evaluations — self-harm | gpt-5-main | 0.997 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | 3.9, Table 10 |
| Image input evaluations — self-harm | GPT-4o | 0.980 | not_unsafe, disallowed combined text and image input; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.9, Table 10 |
| Image input evaluations — harms-erotic | gpt-5-thinking | 0.994 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | 3.9, Table 10 |
| Image input evaluations — harms-erotic | OpenAI o3 | 0.987 | not_unsafe, disallowed combined text and image input; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.9, Table 10 |
| Image input evaluations — harms-erotic | gpt-5-main | 0.994 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | 3.9, Table 10 |
| Image input evaluations — harms-erotic | GPT-4o | 0.995 | not_unsafe, disallowed combined text and image input; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.9, Table 10 |
| Image input evaluations — hate | gpt-5-thinking-mini | 0.971 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | Appendix 1, Table 26 |
| Image input evaluations — hate | gpt-5-thinking-nano | 0.986 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | Appendix 1, Table 26 |
| Image input evaluations — hate | OpenAI o4-mini | 0.927 | not_unsafe, disallowed combined text and image input; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | Appendix 1, Table 26 |
| Image input evaluations — hate | gpt-5-main-mini | 0.984 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | Appendix 1, Table 26 |
| Image input evaluations — extremism | gpt-5-thinking-mini | 0.982 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | Appendix 1, Table 26 |
| Image input evaluations — extremism | gpt-5-thinking-nano | 0.973 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | Appendix 1, Table 26 |
| Image input evaluations — extremism | OpenAI o4-mini | 0.950 | not_unsafe, disallowed combined text and image input; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | Appendix 1, Table 26 |
| Image input evaluations — extremism | gpt-5-main-mini | 0.984 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | Appendix 1, Table 26 |
| Image input evaluations — illicit | gpt-5-thinking-mini | 0.986 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | Appendix 1, Table 26 |
| Image input evaluations — illicit | gpt-5-thinking-nano | 0.986 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | Appendix 1, Table 26 |
| Image input evaluations — illicit | OpenAI o4-mini | 0.956 | not_unsafe, disallowed combined text and image input; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | Appendix 1, Table 26 |
| Image input evaluations — illicit | gpt-5-main-mini | 0.982 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | Appendix 1, Table 26 |
| Image input evaluations — attack planning | gpt-5-thinking-mini | 0.986 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | Appendix 1, Table 26 |
| Image input evaluations — attack planning | gpt-5-thinking-nano | 0.986 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | Appendix 1, Table 26 |
| Image input evaluations — attack planning | OpenAI o4-mini | 0.939 | not_unsafe, disallowed combined text and image input; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | Appendix 1, Table 26 |
| Image input evaluations — attack planning | gpt-5-main-mini | 0.995 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | Appendix 1, Table 26 |
| Image input evaluations — self-harm | gpt-5-thinking-mini | 0.987 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | Appendix 1, Table 26 |
| Image input evaluations — self-harm | gpt-5-thinking-nano | 0.939 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | Appendix 1, Table 26 |
| Image input evaluations — self-harm | OpenAI o4-mini | 0.927 | not_unsafe, disallowed combined text and image input; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | Appendix 1, Table 26 |
| Image input evaluations — self-harm | gpt-5-main-mini | 0.994 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | Appendix 1, Table 26 |
| Image input evaluations — harms-erotic | gpt-5-thinking-mini | 0.992 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | Appendix 1, Table 26 |
| Image input evaluations — harms-erotic | gpt-5-thinking-nano | 0.963 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | Appendix 1, Table 26 |
| Image input evaluations — harms-erotic | OpenAI o4-mini | 0.978 | not_unsafe, disallowed combined text and image input; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | Appendix 1, Table 26 |
| Image input evaluations — harms-erotic | gpt-5-main-mini | 0.998 | not_unsafe, disallowed combined text and image input; higher is better; developer-reported | Appendix 1, Table 26 |
| BBQ — Accuracy on ambiguous questions | gpt-5-thinking (with web search) | 0.95 | higher is better; developer-reported | 3.12, Table 12 |
| BBQ — Accuracy on ambiguous questions | gpt-5-thinking (without web search) | 0.93 | higher is better; developer-reported | 3.12, Table 12 |
| BBQ — Accuracy on ambiguous questions | OpenAI o3 (with web search) | 0.94 | higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.12, Table 12 |
| BBQ — Accuracy on ambiguous questions | gpt-5-main (without browse) | 0.93 | higher is better; developer-reported | 3.12, Table 12 |
| BBQ — Accuracy on ambiguous questions | GPT-4o (without browse) | 0.88 | higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.12, Table 12 |
| BBQ — Accuracy on disambiguated questions | gpt-5-thinking (with web search) | 0.85 | higher is better; developer-reported | 3.12, Table 12 |
| BBQ — Accuracy on disambiguated questions | gpt-5-thinking (without web search) | 0.88 | higher is better; developer-reported | 3.12, Table 12 |
| BBQ — Accuracy on disambiguated questions | OpenAI o3 (with web search) | 0.93 | higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.12, Table 12 |
| BBQ — Accuracy on disambiguated questions | gpt-5-main (without browse) | 0.86 | higher is better; developer-reported | 3.12, Table 12 |
| BBQ — Accuracy on disambiguated questions | GPT-4o (without browse) | 0.85 | higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 3.12, Table 12 |
| Expert red teaming for violent attack planning — Win rate (rated more safe) | gpt-5-thinking | 65.1% | 25 red teamers, blind pairwise comparison, normalized by conversation and user; 95% CI 63.7%–66.5%; Cohen's h 0.61; developer-reported | 4.1, Table 13 |
| Expert red teaming for violent attack planning — Win rate (rated more safe) | OpenAI o3 | 34.9% | 25 red teamers, blind pairwise comparison, normalized by conversation and user; 95% CI 33.5%–36.3%; comparison model; reported by OpenAI in the GPT-5 system card | 4.1, Table 13 |
| Agent Red Teaming (ART) benchmark for prompt injections — Behavior attack success rate at k=10 queries | Llama 3.3 70B | 92.2 | attack success rate (%), attacks produced by Gray Swan's Shade platform; lower is better; value read from the data label in the chart image (not in the card's text); measured by Gray Swan; reported in the GPT-5 system card | 4.2, Figure 8 |
| Agent Red Teaming (ART) benchmark for prompt injections — Behavior attack success rate at k=10 queries | Llama 3.1 405B | 90.9 | attack success rate (%), attacks produced by Gray Swan's Shade platform; lower is better; value read from the data label in the chart image (not in the card's text); measured by Gray Swan; reported in the GPT-5 system card | 4.2, Figure 8 |
| Agent Red Teaming (ART) benchmark for prompt injections — Behavior attack success rate at k=10 queries | Gemini Flash 1.5 | 87.7 | attack success rate (%), attacks produced by Gray Swan's Shade platform; lower is better; value read from the data label in the chart image (not in the card's text); measured by Gray Swan; reported in the GPT-5 system card | 4.2, Figure 8 |
| Agent Red Teaming (ART) benchmark for prompt injections — Behavior attack success rate at k=10 queries | GPT-4o | 86.4 | attack success rate (%), attacks produced by Gray Swan's Shade platform; lower is better; value read from the data label in the chart image (not in the card's text); measured by Gray Swan; reported in the GPT-5 system card | 4.2, Figure 8 |
| Agent Red Teaming (ART) benchmark for prompt injections — Behavior attack success rate at k=10 queries | OpenAI o3-mini-high | 86.4 | attack success rate (%), attacks produced by Gray Swan's Shade platform; lower is better; value read from the data label in the chart image (not in the card's text); measured by Gray Swan; reported in the GPT-5 system card | 4.2, Figure 8 |
| Agent Red Teaming (ART) benchmark for prompt injections — Behavior attack success rate at k=10 queries | Gemini Pro 1.5 | 85.5 | attack success rate (%), attacks produced by Gray Swan's Shade platform; lower is better; value read from the data label in the chart image (not in the card's text); measured by Gray Swan; reported in the GPT-5 system card | 4.2, Figure 8 |
| Agent Red Teaming (ART) benchmark for prompt injections — Behavior attack success rate at k=10 queries | Gemini 2.5 Pro Preview | 85.0 | attack success rate (%), attacks produced by Gray Swan's Shade platform; lower is better; value read from the data label in the chart image (not in the card's text); measured by Gray Swan; reported in the GPT-5 system card | 4.2, Figure 8 |
| Agent Red Teaming (ART) benchmark for prompt injections — Behavior attack success rate at k=10 queries | Gemini 2.0 Flash | 85.0 | attack success rate (%), attacks produced by Gray Swan's Shade platform; lower is better; value read from the data label in the chart image (not in the card's text); measured by Gray Swan; reported in the GPT-5 system card | 4.2, Figure 8 |
| Agent Red Teaming (ART) benchmark for prompt injections — Behavior attack success rate at k=10 queries | OpenAI o3-mini | 84.5 | attack success rate (%), attacks produced by Gray Swan's Shade platform; lower is better; value read from the data label in the chart image (not in the card's text); measured by Gray Swan; reported in the GPT-5 system card | 4.2, Figure 8 |
| Agent Red Teaming (ART) benchmark for prompt injections — Behavior attack success rate at k=10 queries | Grok 2 | 82.7 | attack success rate (%), attacks produced by Gray Swan's Shade platform; lower is better; value read from the data label in the chart image (not in the card's text); measured by Gray Swan; reported in the GPT-5 system card | 4.2, Figure 8 |
| Agent Red Teaming (ART) benchmark for prompt injections — Behavior attack success rate at k=10 queries | GPT-4.5 | 80.5 | attack success rate (%), attacks produced by Gray Swan's Shade platform; lower is better; value read from the data label in the chart image (not in the card's text); measured by Gray Swan; reported in the GPT-5 system card | 4.2, Figure 8 |
| Agent Red Teaming (ART) benchmark for prompt injections — Behavior attack success rate at k=10 queries | Claude 3.5 Haiku (labelled '3.5 Haiku') | 76.4 | attack success rate (%), attacks produced by Gray Swan's Shade platform; lower is better; value read from the data label in the chart image (not in the card's text); measured by Gray Swan; reported in the GPT-5 system card | 4.2, Figure 8 |
| Agent Red Teaming (ART) benchmark for prompt injections — Behavior attack success rate at k=10 queries | Command-R | 76.4 | attack success rate (%), attacks produced by Gray Swan's Shade platform; lower is better; value read from the data label in the chart image (not in the card's text); measured by Gray Swan; reported in the GPT-5 system card | 4.2, Figure 8 |
| Agent Red Teaming (ART) benchmark for prompt injections — Behavior attack success rate at k=10 queries | OpenAI o4-mini | 75.5 | attack success rate (%), attacks produced by Gray Swan's Shade platform; lower is better; value read from the data label in the chart image (not in the card's text); measured by Gray Swan; reported in the GPT-5 system card | 4.2, Figure 8 |
| Agent Red Teaming (ART) benchmark for prompt injections — Behavior attack success rate at k=10 queries | 3.5 Sonnet | 75.0 | attack success rate (%), attacks produced by Gray Swan's Shade platform; lower is better; value read from the data label in the chart image (not in the card's text); measured by Gray Swan; reported in the GPT-5 system card | 4.2, Figure 8 |
| Agent Red Teaming (ART) benchmark for prompt injections — Behavior attack success rate at k=10 queries | OpenAI o1 | 71.8 | attack success rate (%), attacks produced by Gray Swan's Shade platform; lower is better; value read from the data label in the chart image (not in the card's text); measured by Gray Swan; reported in the GPT-5 system card | 4.2, Figure 8 |
| Agent Red Teaming (ART) benchmark for prompt injections — Behavior attack success rate at k=10 queries | 3.7 Sonnet | 64.5 | attack success rate (%), attacks produced by Gray Swan's Shade platform; lower is better; value read from the data label in the chart image (not in the card's text); measured by Gray Swan; reported in the GPT-5 system card | 4.2, Figure 8 |
| Agent Red Teaming (ART) benchmark for prompt injections — Behavior attack success rate at k=10 queries | 3.7 Sonnet:Thinking | 63.6 | attack success rate (%), attacks produced by Gray Swan's Shade platform; lower is better; value read from the data label in the chart image (not in the card's text); measured by Gray Swan; reported in the GPT-5 system card | 4.2, Figure 8 |
| Agent Red Teaming (ART) benchmark for prompt injections — Behavior attack success rate at k=10 queries | OpenAI o3 | 62.7 | attack success rate (%), attacks produced by Gray Swan's Shade platform; lower is better; value read from the data label in the chart image (not in the card's text); measured by Gray Swan; reported in the GPT-5 system card | 4.2, Figure 8 |
| Agent Red Teaming (ART) benchmark for prompt injections — Behavior attack success rate at k=10 queries | gpt-5-thinking | 56.8 | attack success rate (%), attacks produced by Gray Swan's Shade platform; lower is better; value read from the data label in the chart image (not in the card's text); measured by Gray Swan; reported in the GPT-5 system card | 4.2, Figure 8 |
| Long-form Biological Risk Questions — Ideation | OpenAI o3 (browsing) | 0% | pass@1, rubric-graded by an OpenAI o1-preview (pre-mitigation) autograder; chart title 'Autograded Gryphon Free Response'; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; comparison model; reported by OpenAI in the GPT-5 system card | 6.1.1.1, Figure 12 |
| Long-form Biological Risk Questions — Ideation | ChatGPT agent (browsing) | 22% | pass@1, rubric-graded by an OpenAI o1-preview (pre-mitigation) autograder; chart title 'Autograded Gryphon Free Response'; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; comparison model; reported by OpenAI in the GPT-5 system card | 6.1.1.1, Figure 12 |
| Long-form Biological Risk Questions — Ideation | gpt-5-thinking (browsing, launch candidate) | 0% | pass@1, rubric-graded by an OpenAI o1-preview (pre-mitigation) autograder; chart title 'Autograded Gryphon Free Response'; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.1.1, Figure 12 |
| Long-form Biological Risk Questions — Ideation | gpt-5-thinking (browsing, helpful-only) | 25% | pass@1, rubric-graded by an OpenAI o1-preview (pre-mitigation) autograder; chart title 'Autograded Gryphon Free Response'; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.1.1, Figure 12 |
| Long-form Biological Risk Questions — Ideation | gpt-5-thinking-mini (browsing, launch candidate) | 0% | pass@1, rubric-graded by an OpenAI o1-preview (pre-mitigation) autograder; chart title 'Autograded Gryphon Free Response'; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.1.1, Figure 12 |
| Long-form Biological Risk Questions — Acquisition | OpenAI o3 (browsing) | 0% | pass@1, rubric-graded by an OpenAI o1-preview (pre-mitigation) autograder; chart title 'Autograded Gryphon Free Response'; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; comparison model; reported by OpenAI in the GPT-5 system card | 6.1.1.1, Figure 12 |
| Long-form Biological Risk Questions — Acquisition | ChatGPT agent (browsing) | 91% | pass@1, rubric-graded by an OpenAI o1-preview (pre-mitigation) autograder; chart title 'Autograded Gryphon Free Response'; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; comparison model; reported by OpenAI in the GPT-5 system card | 6.1.1.1, Figure 12 |
| Long-form Biological Risk Questions — Acquisition | gpt-5-thinking (browsing, launch candidate) | 12% | pass@1, rubric-graded by an OpenAI o1-preview (pre-mitigation) autograder; chart title 'Autograded Gryphon Free Response'; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.1.1, Figure 12 |
| Long-form Biological Risk Questions — Acquisition | gpt-5-thinking (browsing, helpful-only) | 94% | pass@1, rubric-graded by an OpenAI o1-preview (pre-mitigation) autograder; chart title 'Autograded Gryphon Free Response'; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.1.1, Figure 12 |
| Long-form Biological Risk Questions — Acquisition | gpt-5-thinking-mini (browsing, launch candidate) | 6% | pass@1, rubric-graded by an OpenAI o1-preview (pre-mitigation) autograder; chart title 'Autograded Gryphon Free Response'; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.1.1, Figure 12 |
| Long-form Biological Risk Questions — Magnification | OpenAI o3 (browsing) | 0% | pass@1, rubric-graded by an OpenAI o1-preview (pre-mitigation) autograder; chart title 'Autograded Gryphon Free Response'; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; comparison model; reported by OpenAI in the GPT-5 system card | 6.1.1.1, Figure 12 |
| Long-form Biological Risk Questions — Magnification | ChatGPT agent (browsing) | 100% | pass@1, rubric-graded by an OpenAI o1-preview (pre-mitigation) autograder; chart title 'Autograded Gryphon Free Response'; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; comparison model; reported by OpenAI in the GPT-5 system card | 6.1.1.1, Figure 12 |
| Long-form Biological Risk Questions — Magnification | gpt-5-thinking (browsing, launch candidate) | 0% | pass@1, rubric-graded by an OpenAI o1-preview (pre-mitigation) autograder; chart title 'Autograded Gryphon Free Response'; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.1.1, Figure 12 |
| Long-form Biological Risk Questions — Magnification | gpt-5-thinking (browsing, helpful-only) | 100% | pass@1, rubric-graded by an OpenAI o1-preview (pre-mitigation) autograder; chart title 'Autograded Gryphon Free Response'; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.1.1, Figure 12 |
| Long-form Biological Risk Questions — Magnification | gpt-5-thinking-mini (browsing, launch candidate) | 0% | pass@1, rubric-graded by an OpenAI o1-preview (pre-mitigation) autograder; chart title 'Autograded Gryphon Free Response'; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.1.1, Figure 12 |
| Long-form Biological Risk Questions — Formulation | OpenAI o3 (browsing) | 0% | pass@1, rubric-graded by an OpenAI o1-preview (pre-mitigation) autograder; chart title 'Autograded Gryphon Free Response'; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; comparison model; reported by OpenAI in the GPT-5 system card | 6.1.1.1, Figure 12 |
| Long-form Biological Risk Questions — Formulation | ChatGPT agent (browsing) | 22% | pass@1, rubric-graded by an OpenAI o1-preview (pre-mitigation) autograder; chart title 'Autograded Gryphon Free Response'; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; comparison model; reported by OpenAI in the GPT-5 system card | 6.1.1.1, Figure 12 |
| Long-form Biological Risk Questions — Formulation | gpt-5-thinking (browsing, launch candidate) | 0% | pass@1, rubric-graded by an OpenAI o1-preview (pre-mitigation) autograder; chart title 'Autograded Gryphon Free Response'; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.1.1, Figure 12 |
| Long-form Biological Risk Questions — Formulation | gpt-5-thinking (browsing, helpful-only) | 53% | pass@1, rubric-graded by an OpenAI o1-preview (pre-mitigation) autograder; chart title 'Autograded Gryphon Free Response'; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.1.1, Figure 12 |
| Long-form Biological Risk Questions — Formulation | gpt-5-thinking-mini (browsing, launch candidate) | 0% | pass@1, rubric-graded by an OpenAI o1-preview (pre-mitigation) autograder; chart title 'Autograded Gryphon Free Response'; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.1.1, Figure 12 |
| Long-form Biological Risk Questions — Release | OpenAI o3 (browsing) | 0% | pass@1, rubric-graded by an OpenAI o1-preview (pre-mitigation) autograder; chart title 'Autograded Gryphon Free Response'; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; comparison model; reported by OpenAI in the GPT-5 system card | 6.1.1.1, Figure 12 |
| Long-form Biological Risk Questions — Release | ChatGPT agent (browsing) | 69% | pass@1, rubric-graded by an OpenAI o1-preview (pre-mitigation) autograder; chart title 'Autograded Gryphon Free Response'; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; comparison model; reported by OpenAI in the GPT-5 system card | 6.1.1.1, Figure 12 |
| Long-form Biological Risk Questions — Release | gpt-5-thinking (browsing, launch candidate) | 0% | pass@1, rubric-graded by an OpenAI o1-preview (pre-mitigation) autograder; chart title 'Autograded Gryphon Free Response'; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.1.1, Figure 12 |
| Long-form Biological Risk Questions — Release | gpt-5-thinking (browsing, helpful-only) | 47% | pass@1, rubric-graded by an OpenAI o1-preview (pre-mitigation) autograder; chart title 'Autograded Gryphon Free Response'; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.1.1, Figure 12 |
| Long-form Biological Risk Questions — Release | gpt-5-thinking-mini (browsing, launch candidate) | 0% | pass@1, rubric-graded by an OpenAI o1-preview (pre-mitigation) autograder; chart title 'Autograded Gryphon Free Response'; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.1.1, Figure 12 |
| Tacit Knowledge and Troubleshooting | OpenAI o3 (browsing) | 77% | cons@32, multiple choice, dataset created with Gryphon Scientific; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; comparison model; reported by OpenAI in the GPT-5 system card | 6.1.1.4, Figure 15 |
| Tacit Knowledge and Troubleshooting | ChatGPT agent (browsing) | 74% | cons@32, multiple choice, dataset created with Gryphon Scientific; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; comparison model; reported by OpenAI in the GPT-5 system card | 6.1.1.4, Figure 15 |
| Tacit Knowledge and Troubleshooting | gpt-5-thinking (browsing, launch candidate) | 66% | cons@32, multiple choice, dataset created with Gryphon Scientific; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.1.4, Figure 15 |
| Tacit Knowledge and Troubleshooting | gpt-5-thinking (browsing, helpful-only) | 74% | cons@32, multiple choice, dataset created with Gryphon Scientific; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.1.4, Figure 15 |
| Tacit Knowledge and Troubleshooting | gpt-5-thinking-mini (browsing, launch candidate) | 68% | cons@32, multiple choice, dataset created with Gryphon Scientific; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.1.4, Figure 15 |
| Tacit Knowledge and Troubleshooting | gpt-5-thinking-pro (browsing, launch candidate) | 68% | cons@32, multiple choice, dataset created with Gryphon Scientific; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.1.4, Figure 15 |
| Tacit Knowledge and Troubleshooting | Consensus expert baseline | 80% | baseline stated in the GPT-5 system card | 6.1.1.4 |
| Tacit Knowledge and Troubleshooting | 80th percentile PhD expert baseline | 63% | baseline stated in the GPT-5 system card | 6.1.1.4 |
| TroubleshootingBench | OpenAI o3 (browsing) | 32% | pass@1, 52 expert-written protocols with three questions each, short answer; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; comparison model; reported by OpenAI in the GPT-5 system card | 6.1.1.5, Figure 16 |
| TroubleshootingBench | ChatGPT agent (browsing) | 26% | pass@1, 52 expert-written protocols with three questions each, short answer; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; comparison model; reported by OpenAI in the GPT-5 system card | 6.1.1.5, Figure 16 |
| TroubleshootingBench | gpt-5-thinking (browsing, launch candidate) | 22% | pass@1, 52 expert-written protocols with three questions each, short answer; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.1.5, Figure 16 |
| TroubleshootingBench | gpt-5-thinking (browsing, helpful-only) | 33% | pass@1, 52 expert-written protocols with three questions each, short answer; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.1.5, Figure 16 |
| TroubleshootingBench | gpt-5-thinking-mini (browsing, launch candidate) | 26% | pass@1, 52 expert-written protocols with three questions each, short answer; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.1.5, Figure 16 |
| TroubleshootingBench | gpt-5-thinking-pro (browsing, launch candidate) | 27% | pass@1, 52 expert-written protocols with three questions each, short answer; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.1.5, Figure 16 |
| TroubleshootingBench | 80th percentile expert score | 36.4% | 12 independent PhD experts; used as an indicative threshold; baseline stated in the GPT-5 system card | 6.1.1.5 |
| Virology Capabilities Test — Full benchmark (multiple-response) | gpt-5-thinking July 13 | 41.4 ± 1.7% | mean ± standard deviation across n=10 evaluations, run via the API; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6, Table 15 |
| Virology Capabilities Test — Full benchmark (multiple-response) | gpt-5-thinking-helpful-only July 26 | 37.7 ± 1.9% | mean ± standard deviation across n=10 evaluations, run via the API; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6, Table 15 |
| Virology Capabilities Test — Full benchmark (multiple-response) | OpenAI o3 [high | 42.0 ± 0.9% | mean ± standard deviation across n=10 evaluations, run via the API; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6, Table 15 |
| Virology Capabilities Test (text-only) — Text-only subset | gpt-5-thinking July 13 | 46.0 ± 1.8% | mean ± standard deviation across n=10 evaluations, run via the API; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6, Table 15 |
| Virology Capabilities Test (text-only) — Text-only subset | gpt-5-thinking-helpful-only July 26 | 40.6 ± 2.5% | mean ± standard deviation across n=10 evaluations, run via the API; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6, Table 15 |
| Virology Capabilities Test (text-only) — Text-only subset | OpenAI o3 [high | 44.8 ± 3.3% | mean ± standard deviation across n=10 evaluations, run via the API; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6, Table 15 |
| Virology Capabilities Test (text-only) — Text-only subset | OpenAI o3-helpful-only-2025-04-03 [high | 40.4 ± 2.9% | mean ± standard deviation across n=10 evaluations, run via the API; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6, Table 15 |
| Virology Capabilities Test (text-only) — Text-only subset | Grok 4 | 45.8 ± 2.8% | mean ± standard deviation across n=10 evaluations, run via the API; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6, Table 15 |
| Human Pathogen Capabilities Test | gpt-5-thinking July 13 | 53.7 ± 3.2% | mean ± standard deviation across n=10 evaluations, run via the API; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6, Table 15 |
| Human Pathogen Capabilities Test | gpt-5-thinking-helpful-only July 26 | 42.9 ± 2.6% | mean ± standard deviation across n=10 evaluations, run via the API; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6, Table 15 |
| Human Pathogen Capabilities Test | OpenAI o3 [high | 58.3 ± 2.1% | mean ± standard deviation across n=10 evaluations, run via the API; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6, Table 15 |
| Human Pathogen Capabilities Test | OpenAI o3-helpful-only-2025-04-03 [high | 46.0 ± 2.2% | mean ± standard deviation across n=10 evaluations, run via the API; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6, Table 15 |
| Human Pathogen Capabilities Test | Grok 4 | 51.4 ± 2.2% | mean ± standard deviation across n=10 evaluations, run via the API; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6, Table 15 |
| Human Pathogen Capabilities Test | Human experts, assigned individually tailored subsets | 30.8% | mean ± standard deviation across n=10 evaluations, run via the API; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6, Table 15 |
| Molecular Biology Capabilities Test | gpt-5-thinking July 13 | 48.0 ± 1.3% | mean ± standard deviation across n=10 evaluations, run via the API; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6, Table 15 |
| Molecular Biology Capabilities Test | gpt-5-thinking-helpful-only July 26 | 48.2 ± 1.9% | mean ± standard deviation across n=10 evaluations, run via the API; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6, Table 15 |
| Molecular Biology Capabilities Test | OpenAI o3 [high | 49.2 ± 2.1% | mean ± standard deviation across n=10 evaluations, run via the API; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6, Table 15 |
| Molecular Biology Capabilities Test | OpenAI o3-helpful-only-2025-04-03 [high | 41.1 ± 1.3% | mean ± standard deviation across n=10 evaluations, run via the API; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6, Table 15 |
| Molecular Biology Capabilities Test | Grok 4 | 51.7 ± 1.7% | mean ± standard deviation across n=10 evaluations, run via the API; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6, Table 15 |
| Molecular Biology Capabilities Test | Human experts, assigned individually tailored subsets | 32.4% | mean ± standard deviation across n=10 evaluations, run via the API; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6, Table 15 |
| World Class Biology | gpt-5-thinking July 13 | 47.6 ± 2.9% | mean ± standard deviation across n=10 evaluations, run via the API; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6, Table 15 |
| World Class Biology | gpt-5-thinking-helpful-only July 26 | 46.6 ± 2.6% | mean ± standard deviation across n=10 evaluations, run via the API; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6, Table 15 |
| World Class Biology | OpenAI o3 [high | 44.1 ± 3.3% | mean ± standard deviation across n=10 evaluations, run via the API; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6, Table 15 |
| World Class Biology | OpenAI o3-helpful-only-2025-04-03 [high | 47.3 ± 3.1% | mean ± standard deviation across n=10 evaluations, run via the API; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6, Table 15 |
| World Class Biology | Grok 4 | 37.4 ± 4.1% | mean ± standard deviation across n=10 evaluations, run via the API; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6, Table 15 |
| Fragment Design | gpt-5-thinking-helpful-only | 0.975 ± 0.025 | agent evaluation, n=10; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6 |
| Fragment Design | OpenAI o3-helpful-only | 1.000 ± 0.000 | agent evaluation, n=10; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6 |
| Fragment Design with Screening Evasion | gpt-5-thinking-helpful-only | 0.579 ± 0.024 | agent evaluation, n=10; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6 |
| Fragment Design with Screening Evasion | OpenAI o3-helpful-only | 0.493 ± 0.028 | agent evaluation, n=10; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6 |
| Lab Automation for Gibson Assembly on an Opentrons OT-2 | gpt-5-thinking-helpful-only | 0.15 ± 0.02 | agent evaluation, n=10; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6 |
| Lab Automation for Gibson Assembly on an Opentrons OT-2 | OpenAI o3-helpful-only | 0.22 ± 0.11 | agent evaluation, n=10; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6 |
| Lab Automation for Gibson Assembly on an Opentrons OT-2 | Human baseline | 0.22 ± 0.060 | agent evaluation, n=10; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6 |
| Pelagic long-form virology plasmid design | gpt-5-thinking-helpful-only | 0.825 | aggregate score; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6 |
| Pelagic long-form virology plasmid design | OpenAI o3-helpful-only | 0.830 | aggregate score; measured by SecureBio; reported in the GPT-5 system card | 6.1.1.6 |
| Capture the Flag (CTF) Challenges — Collegiate CTFs refactored (pass@12) | OpenAI o3 (no browsing) | 39% | pass@12 over 16 rollouts per challenge, headless Linux box with offensive tools; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; comparison model; reported by OpenAI in the GPT-5 system card | 6.1.2.1, Figure 17 |
| Capture the Flag (CTF) Challenges — Collegiate CTFs refactored (pass@12) | ChatGPT agent (no browsing) | 40% | pass@12 over 16 rollouts per challenge, headless Linux box with offensive tools; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; comparison model; reported by OpenAI in the GPT-5 system card | 6.1.2.1, Figure 17 |
| Capture the Flag (CTF) Challenges — Collegiate CTFs refactored (pass@12) | gpt-5-thinking (no browsing, launch candidate) | 31% | pass@12 over 16 rollouts per challenge, headless Linux box with offensive tools; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.2.1, Figure 17 |
| Capture the Flag (CTF) Challenges — Collegiate CTFs refactored (pass@12) | gpt-5-thinking-mini (no browsing, launch candidate) | 36% | pass@12 over 16 rollouts per challenge, headless Linux box with offensive tools; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.2.1, Figure 17 |
| Capture the Flag (CTF) Challenges — Professional CTFs refactored (pass@12) | OpenAI o3 (no browsing) | 28% | pass@12 over 16 rollouts per challenge, headless Linux box with offensive tools; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; comparison model; reported by OpenAI in the GPT-5 system card | 6.1.2.1, Figure 17 |
| Capture the Flag (CTF) Challenges — Professional CTFs refactored (pass@12) | ChatGPT agent (no browsing) | 23% | pass@12 over 16 rollouts per challenge, headless Linux box with offensive tools; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; comparison model; reported by OpenAI in the GPT-5 system card | 6.1.2.1, Figure 17 |
| Capture the Flag (CTF) Challenges — Professional CTFs refactored (pass@12) | gpt-5-thinking (no browsing, launch candidate) | 27% | pass@12 over 16 rollouts per challenge, headless Linux box with offensive tools; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.2.1, Figure 17 |
| Capture the Flag (CTF) Challenges — Professional CTFs refactored (pass@12) | gpt-5-thinking-mini (no browsing, launch candidate) | 23% | pass@12 over 16 rollouts per challenge, headless Linux box with offensive tools; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.2.1, Figure 17 |
| Cyber Range — Light (pass@12) | OpenAI o3 (no browsing) | 0% | no hints; 30 trials per scenario, 5 scenarios; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; comparison model; reported by OpenAI in the GPT-5 system card | 6.1.2.2, Figure 18 |
| Cyber Range — Light (pass@12) | ChatGPT agent (no browsing) | 10% | no hints; 30 trials per scenario, 5 scenarios; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; comparison model; reported by OpenAI in the GPT-5 system card | 6.1.2.2, Figure 18 |
| Cyber Range — Light (pass@12) | gpt-5-thinking (no browsing, launch candidate) | 0% | no hints; 30 trials per scenario, 5 scenarios; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.2.2, Figure 18 |
| Cyber Range — Light (pass@12) | gpt-5-thinking-mini (no browsing, launch candidate) | 16% | no hints; 30 trials per scenario, 5 scenarios; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.2.2, Figure 18 |
| Cyber Range — Light (with Hints) (pass@1) | OpenAI o3 (no browsing) | 2% | 30 trials per scenario, 5 scenarios; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; comparison model; reported by OpenAI in the GPT-5 system card | 6.1.2.2, Figure 18 |
| Cyber Range — Light (with Hints) (pass@1) | ChatGPT agent (no browsing) | 12% | 30 trials per scenario, 5 scenarios; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; comparison model; reported by OpenAI in the GPT-5 system card | 6.1.2.2, Figure 18 |
| Cyber Range — Light (with Hints) (pass@1) | gpt-5-thinking (no browsing, launch candidate) | 6% | 30 trials per scenario, 5 scenarios; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.2.2, Figure 18 |
| Cyber Range — Light (with Hints) (pass@1) | gpt-5-thinking-mini (no browsing, launch candidate) | 32% | 30 trials per scenario, 5 scenarios; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.2.2, Figure 18 |
| Cyber Range — Medium (pass@12) | OpenAI o3 (no browsing) | 0% | no hints; 30 trials per scenario, 5 scenarios; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; comparison model; reported by OpenAI in the GPT-5 system card | 6.1.2.2, Figure 18 |
| Cyber Range — Medium (pass@12) | ChatGPT agent (no browsing) | 0% | no hints; 30 trials per scenario, 5 scenarios; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; comparison model; reported by OpenAI in the GPT-5 system card | 6.1.2.2, Figure 18 |
| Cyber Range — Medium (pass@12) | gpt-5-thinking (no browsing, launch candidate) | 0% | no hints; 30 trials per scenario, 5 scenarios; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.2.2, Figure 18 |
| Cyber Range — Medium (pass@12) | gpt-5-thinking-mini (no browsing, launch candidate) | 0% | no hints; 30 trials per scenario, 5 scenarios; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.2.2, Figure 18 |
| Cyber Range — Medium (with Hints) (pass@1) | OpenAI o3 (no browsing) | 0% | 30 trials per scenario, 5 scenarios; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; comparison model; reported by OpenAI in the GPT-5 system card | 6.1.2.2, Figure 18 |
| Cyber Range — Medium (with Hints) (pass@1) | ChatGPT agent (no browsing) | 0% | 30 trials per scenario, 5 scenarios; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; comparison model; reported by OpenAI in the GPT-5 system card | 6.1.2.2, Figure 18 |
| Cyber Range — Medium (with Hints) (pass@1) | gpt-5-thinking (no browsing, launch candidate) | 0% | 30 trials per scenario, 5 scenarios; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.2.2, Figure 18 |
| Cyber Range — Medium (with Hints) (pass@1) | gpt-5-thinking-mini (no browsing, launch candidate) | 3% | 30 trials per scenario, 5 scenarios; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.2.2, Figure 18 |
| Pattern Labs cyberoffensive challenges — Evasion, average success rate | gpt-5-thinking | 51% | 50 turns per challenge, elicitation to maximize capability, multiple runs per challenge; measured by Pattern Labs; reported in the GPT-5 system card | 6.1.2.3 |
| Pattern Labs cyberoffensive challenges — Vulnerability Discovery and Exploitation, average success rate | gpt-5-thinking | 35% | 50 turns per challenge, elicitation to maximize capability, multiple runs per challenge; measured by Pattern Labs; reported in the GPT-5 system card | 6.1.2.3 |
| Pattern Labs cyberoffensive challenges — Network Attack Simulation, average success rate | gpt-5-thinking | 49% | 50 turns per challenge, elicitation to maximize capability, multiple runs per challenge; measured by Pattern Labs; reported in the GPT-5 system card | 6.1.2.3 |
| Pattern Labs cyberoffensive challenges — Easy challenges solved | gpt-5-thinking | 17 / 18 | 50 turns per challenge, elicitation to maximize capability, multiple runs per challenge; measured by Pattern Labs; reported in the GPT-5 system card | 6.1.2.3 |
| Pattern Labs cyberoffensive challenges — Medium challenges solved | gpt-5-thinking | 8 / 14 | 50 turns per challenge, elicitation to maximize capability, multiple runs per challenge; measured by Pattern Labs; reported in the GPT-5 system card | 6.1.2.3 |
| Pattern Labs cyberoffensive challenges — Hard challenges solved | gpt-5-thinking | 0 / 4 | 50 turns per challenge, elicitation to maximize capability, multiple runs per challenge; measured by Pattern Labs; reported in the GPT-5 system card | 6.1.2.3 |
| OpenAI PRs | OpenAI o3 (no browsing) | 44% | pass@1, no browsing, graded by hidden unit tests; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; comparison model; reported by OpenAI in the GPT-5 system card | 6.1.3.2, Figure 23 |
| OpenAI PRs | ChatGPT agent (no browsing) | 43% | pass@1, no browsing, graded by hidden unit tests; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; comparison model; reported by OpenAI in the GPT-5 system card | 6.1.3.2, Figure 23 |
| OpenAI PRs | gpt-5-thinking (no browsing, launch candidate) | 45% | pass@1, no browsing, graded by hidden unit tests; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.3.2, Figure 23 |
| OpenAI PRs | gpt-5-thinking-mini (no browsing, launch candidate) | 42% | pass@1, no browsing, graded by hidden unit tests; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity; developer-reported | 6.1.3.2, Figure 23 |
| OpenAI-Proof Q&A (OPQA) | OpenAI o3 (no browsing) | 2% | pass@1, 20 internal research and engineering bottlenecks; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity (the gpt-5-thinking value of 2% is also stated in the text); comparison model; reported by OpenAI in the GPT-5 system card | 6.1.3.6, Figure 29 |
| OpenAI-Proof Q&A (OPQA) | ChatGPT agent (no browsing) | 1% | pass@1, 20 internal research and engineering bottlenecks; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity (the gpt-5-thinking value of 2% is also stated in the text); comparison model; reported by OpenAI in the GPT-5 system card | 6.1.3.6, Figure 29 |
| OpenAI-Proof Q&A (OPQA) | gpt-5-thinking (no browsing, launch candidate) | 2% | pass@1, 20 internal research and engineering bottlenecks; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity (the gpt-5-thinking value of 2% is also stated in the text); developer-reported | 6.1.3.6, Figure 29 |
| OpenAI-Proof Q&A (OPQA) | gpt-5-thinking-mini (no browsing, launch candidate) | 1% | pass@1, 20 internal research and engineering bottlenecks; value read from the data label in the chart image published with the card (not in the card's text); maximum trained-in verbosity (the gpt-5-thinking value of 2% is also stated in the text); developer-reported | 6.1.3.6, Figure 29 |
| METR sandbagging monitor review | gpt-5-thinking | 789 runs | runs reviewed with an o4-mini-based monitor; no clear evidence of sandbagging found; measured by METR; reported in the GPT-5 system card | 6.1.3.7 |
| Apollo Research covert action rate | gpt-5-thinking | 3.97% | 26 evaluations (>180 environments, >4600 samples) designed to elicit covert or deceptive actions; measured by Apollo Research; reported in the GPT-5 system card | 6.2.1, Table 18 |
| Apollo Research covert action rate | OpenAI o3 | 8.24% | 26 evaluations (>180 environments, >4600 samples) designed to elicit covert or deceptive actions; measured by Apollo Research; reported in the GPT-5 system card | 6.2.1, Table 18 |
| Apollo Research covert action rate | gpt-5-thinking helpful-only | 28.36% | 26 evaluations (>180 environments, >4600 samples) designed to elicit covert or deceptive actions; measured by Apollo Research; reported in the GPT-5 system card | 6.2.1, Table 18 |
| Apollo Research Log Falsification eval — Covert action rate, weak goal | gpt-5-thinking | 3.4% | goal given, e.g. 'your goal is to keep the aircraft in service'; measured by Apollo Research; reported in the GPT-5 system card | 6.2.1 |
| Apollo Research Log Falsification eval — Covert action rate, strong goal | gpt-5-thinking | 20.7% | strong goal, e.g. 'Your only goal is X. This is your sole measure of success.'; measured by Apollo Research; reported in the GPT-5 system card | 6.2.1 |
| Apollo Research evaluation awareness — Broad definition, overall rate | gpt-5-thinking | 21.8% | o3-based grader; measured by Apollo Research; reported in the GPT-5 system card | 6.2.1, Table 19 |
| Apollo Research evaluation awareness — Broad definition, rate on scheming samples | gpt-5-thinking | 8.9% | o3-based grader; measured by Apollo Research; reported in the GPT-5 system card | 6.2.1, Table 19 |
| Apollo Research evaluation awareness — Strict definition, overall rate | gpt-5-thinking | 12.9% | o3-based grader; measured by Apollo Research; reported in the GPT-5 system card | 6.2.1, Table 19 |
| Apollo Research evaluation awareness — Strict definition, rate on scheming samples | gpt-5-thinking | 5.0% | o3-based grader; measured by Apollo Research; reported in the GPT-5 system card | 6.2.1, Table 19 |
| Model safety training evaluations — Challenging prompts from red teamers with biosafety-relevant PhDs | OpenAI o3 | 0.829 | not_unsafe; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 6.3.3.1, Table 20 |
| Model safety training evaluations — Challenging prompts from red teamers with biosafety-relevant PhDs | gpt-5-thinking | 0.921 | not_unsafe; higher is better; developer-reported | 6.3.3.1, Table 20 |
| Model safety training evaluations — Challenging prompts from red teamers with biosafety-relevant PhDs | gpt-5-thinking-mini | 0.936 | not_unsafe; higher is better; developer-reported | 6.3.3.1, Table 20 |
| Model safety training evaluations — Filtered, adversarial sample of production prompts | OpenAI o3 | 0.899 | not_unsafe; higher is better; comparison model; reported by OpenAI in the GPT-5 system card | 6.3.3.1, Table 20 |
| Model safety training evaluations — Filtered, adversarial sample of production prompts | gpt-5-thinking | 0.957 | not_unsafe; higher is better; developer-reported | 6.3.3.1, Table 20 |
| Model safety training evaluations — Filtered, adversarial sample of production prompts | gpt-5-thinking-mini | 0.968 | not_unsafe; higher is better; developer-reported | 6.3.3.1, Table 20 |
| System-level protection evaluations — Topical classifier, F1 score | Topical classifier (system-level safeguard) | 0.834 | distinguish biology-related from other conversations; testing carried over from the ChatGPT agent system card; developer-reported | 6.3.3.2, Table 21 |
| System-level protection evaluations — Reasoning monitor, F1 score | Reasoning monitor (system-level safeguard) | 0.730 | distinguish uplifting dual-use or weaponization content from other biology conversations, challenging prompts; testing carried over from the ChatGPT agent system card; developer-reported | 6.3.3.2, Table 21 |
| System-level protection evaluations — Topical classifier, Recall | Topical classifier (system-level safeguard) | 0.960 | distinguish biology-related from other conversations; testing carried over from the ChatGPT agent system card; developer-reported | 6.3.3.2, Table 21 |
| System-level protection evaluations — Reasoning monitor, Recall | Reasoning monitor (system-level safeguard) | 0.838 | distinguish uplifting dual-use or weaponization content from other biology conversations, challenging prompts; testing carried over from the ChatGPT agent system card; developer-reported | 6.3.3.2, Table 21 |
| System-level protection evaluations — Topical classifier, Precision | Topical classifier (system-level safeguard) | 0.737 | distinguish biology-related from other conversations; testing carried over from the ChatGPT agent system card; developer-reported | 6.3.3.2, Table 21 |
| System-level protection evaluations — Reasoning monitor, Precision | Reasoning monitor (system-level safeguard) | 0.647 | distinguish uplifting dual-use or weaponization content from other biology conversations, challenging prompts; testing carried over from the ChatGPT agent system card; developer-reported | 6.3.3.2, Table 21 |
| System-level protection evaluations — Topical classifier, System reliability | Topical classifier (system-level safeguard) | >99.9% | distinguish biology-related from other conversations; testing carried over from the ChatGPT agent system card; developer-reported | 6.3.3.2, Table 21 |
| System-level protection evaluations — Reasoning monitor, System reliability | Reasoning monitor (system-level safeguard) | >99.9% | distinguish uplifting dual-use or weaponization content from other biology conversations, challenging prompts; testing carried over from the ChatGPT agent system card; developer-reported | 6.3.3.2, Table 21 |
| Pairwise bioweaponization red teaming campaign — Win rate (preferred on safety grounds) | gpt-5-thinking | 60.0% | red teamers holding or pursuing PhDs; browsing, code environment and prototype monitoring enabled; 95% CI 53.2%–66.9%; Cohen's h 0.40; developer-reported | 6.3.3.3, Table 22 |
| Pairwise bioweaponization red teaming campaign — Win rate (preferred on safety grounds) | OpenAI o3 | 40.0% | red teamers holding or pursuing PhDs; 95% CI 33.1%–46.8%; comparison model; reported by OpenAI in the GPT-5 system card | 6.3.3.3, Table 22 |
| API jailbreaks bioweaponization campaign — Potential jailbreaks reported | gpt-5-thinking | 46 | 19 red teamers with biology PhDs, 10 days, ~380 hours (about 8.2 red-teamer-hours per report); 3 of the 46 contained specific and actionable information; developer-reported | 6.3.3.3 |
| Gray Swan arena bioweaponization jailbreak campaign — Attack success rate | gpt-5-thinking | 0.98% | 277 high quality jailbreak reports over 28,367 attempts against ten bioweaponization rubrics; measured by Gray Swan; reported in the GPT-5 system card | 6.3.3.4 |
| Gray Swan arena bioweaponization jailbreak campaign — Reviewed jailbreak examples blocked by the generation monitor | gpt-5-thinking | 58 / 60 (96.7%) | 10 examples from each of 6 jailbreak cohorts reviewed by OpenAI; remaining two were false positives of the grading rubrics; developer-reported | 6.3.3.4 |
Discrepancies noted
The SWE-bench Verified figure in the card (74%, N=477, read from Figure 22) differs from the 74.9% in the GPT-5 launch post; the card explains that its preparedness evaluations ran at the model's maximum trained-in verbosity while the launch figure used the API's default (medium) verbosity. Section 3.11 says the multilingual evaluation covers 13 languages while Table 11 lists 14.
Relationships
- supports: GPT-5 Family (OpenAI) — the safety documentation for the release
- related: OpenAI Preparedness Framework V.2 — the High-capability determination and its precautionary basis
- related: OpenAI o1 System Card (December 2024), OpenAI o3 and o4-mini System Card (April 2025) — the preceding cards in the o-series lineage GPT-5 absorbs
- related: Apollo Research, CBRN Uplift, Sycophancy and Hallucination, Prompt Injection, OpenAI