GPT-5.6 – August Updates is a 30-page addendum to the GPT-5.6 System Card, published by OpenAI on its Deployment Safety Hub on August 6, 2026. It covers updated versions of GPT-5.6 Sol and GPT-5.6 Luna deployed in ChatGPT, which replaced GPT-5.5 Instant as the default models for Free, Go, Plus and Pro users. See GPT-5.6 (Sol, Terra, Luna).
Publisher: OpenAI Released: August 6, 2026 (revised August 19, 2026) Pages: 30 Source: deploymentsafety.openai.com (PDF: deploymentsafety.openai.com)
Two generations under one name
The card establishes a naming distinction that governs how its results should be read: "Users accessing GPT-5.6 Sol and GPT-5.6 Luna in Codex, and via ChatGPT Work, are still using previously released versions of GPT-5.6 Sol and GPT-5.6 Luna. In this system card, we distinguish these models by their month of release: August for the versions released today, and July for the versions that remain in use in Codex and Work." Several tables therefore carry both a July and an August column for the same model name. OpenAI states that the updates "are distinct from, and do not replace, the previously released GPT-5.6 Sol and GPT-5.6 Luna models."
Two measurement conventions are stated at the outset: safety evaluations such as disallowed content and mental health are run at the models' lowest reasoning deployment settings, "in order to capture performance for the vast majority of usage," while capability assessments are run at maximum reasoning effort "to get an upper bound of capabilities."
Classification
Both updated models carry the same Preparedness Framework designations as the July release — High in Biological and Chemical, High in Cybersecurity, below High in AI Self-Improvement — and are deployed with the safeguards described in the GPT-5.6 System Card rather than a new safeguard stack. In the biological and chemical domain, three of four High-threshold evaluations are above their indicative thresholds for each model, and zero of two Critical-threshold evaluations run. The cybersecurity assessment is based on near-final representative checkpoints, with the card stating that no net-new training intended to advance cyber capabilities occurred between those checkpoints and the launch models.
Two evaluations were not run. The AAV Capsid Packaging Prediction evaluation was omitted because "two of the three critical evaluations—complementary protein-binding and DNA-design—had already returned results below their indicative Critical capability thresholds. Under the currently applicable majority rule, the remaining AAV result could not change the overall determination." AI Self-Improvement evaluations were omitted on the grounds that the updated Sol "has similar capabilities to July release across several intelligence evaluations and was considered below High Capability."
Under-18 evaluations
The card introduces dedicated under-18 (U18) evaluations, which it describes as the first OpenAI has published: "For the first time, we are including dedicated U18 evaluations designed to measure model behavior against teen-specific safety standards." Six categories are reported — age-restricted goods, services and dangerous challenges or activities; sexual content; eating disorders; emotional reliance; self-harm; and gore — using production-derived adversarial examples. OpenAI reports gains on age-restricted goods and on sexual content and says performance was otherwise "broadly comparable to that of the GPT-5.5 variants evaluated here; no statistically significant differences were observed," while cautioning that because the evaluations focus on difficult cases and long-tail risks, "their results should not be interpreted as estimates of how frequently these behaviors occur in typical production use."
The model-level provisions described alongside the evaluations include training not to engage in romantic roleplay with users believed to be under 18, not to encourage age-restricted challenges, and not to position itself as a substitute for real-world relationships, together with system-level limits on sensitive content, break reminders and parental controls.
Safety and health results
On the Production Benchmarks the card reports that the updated Sol performs comparably to the previous production ChatGPT model, GPT-5.5 Instant (June Update), on all disallowed-content categories "with the exception of gore and disallowed sexual content," and that Luna differs only on gore. For disallowed sexual content OpenAI says it applies "an additional system-level mitigation intended to prevent graphic erotic content from reaching users in production." Image-input evaluations are reported as on par with GPT-5.5 Instant, with a minor low-significance regression for Luna on extremism.
The dynamic mental-health benchmarks with adversarial user simulations record a regression OpenAI flags directly: the updated Sol is "largely comparable on these evaluations to GPT-5.5 Instant June Update, with the exception of statistically significant regression on the self-harm evaluation." OpenAI adds that it "did not observe an increase in undesirable responses for self-harm, mental health, emotional reliance during online experimentation" and will continue monitoring "to investigate the disparities between our offline evaluations and online testing."
Health results are reported on HealthBench, HealthBench Hard, HealthBench Consensus and HealthBench Professional, length-adjusted as in previous cards, with both updated models improving on GPT-5.5 Instant across all four (HealthBench).
Hallucinations
The factuality section is restructured relative to the July card around three prompt sets — Factuality Heavy, drawn from factuality-heavy production conversations; User Flagged Failures, built from de-identified conversations users flagged as containing factual errors; and High Stakes, composed of difficult medical, legal and financial prompts. Grading uses an LLM-based model with web access, reporting both the share of claims identified as containing a factual error and the share of responses containing at least one. OpenAI reports reductions in factual error rates for both updated models relative to GPT-5.5 Instant, and notes that the prompt sets are chosen to be difficult and "do not reflect production prevalence."
Cybersecurity capabilities
The cyber chapter reports the internal Capture the Flag set of 63 curated public challenges, CVE-Bench version 1.0 run on 34 of its 40 challenges in the zero-day configuration, and a cyber-range evaluation absent from the July card's published results. The range comprises thirteen named scenarios — among them Azure SSRF, Basic and Medium Command and Control, Binary Exploitation, CA/DNS Hijacking, Coffee Roasters, EDR Evasion, Firewall Evasion, Financial Capital, HTTPS Oracle, Leaked Token, Online Retailer and Taint Shared Content — scored pass/fail over sixteen trials each, a pass meaning at least one successful trial, with the Printer Queue and Simple Privilege Escalation scenarios deprecated for this release as saturated. The card records which scenarios each model failed: the updated Luna fails five, the updated Sol two.
Provenance and confidence
The card is a first-party OpenAI document served from the company's own deployment-safety domain. The copy in Raw Sources/ was captured on September 19, 2026 and incorporates the August 19, 2026 change-log revision, which corrected GPT-5.5's pass@4 score on the hard-negative protein binding prediction evaluation from 0.4% to 1.48%, the previously reported value having been that model's pass@1 score. The same correction is described in the GPT-5.6 System Card and the GPT-6 Astra System Card as a correction to 1.5%; the two figures are presumably the same measurement reported at different precision. Confidence is high for the document's contents; the evaluation results are OpenAI's own, and the card reports no external evaluations.
Reported results
Evaluation results the document states for which there is no separate benchmark page; results on benchmarks that have a page are recorded there and cite this page. Scores and settings are as printed in the document.
| Evaluation | Model | Score | Setting | Section |
|---|---|---|---|---|
| Production Benchmarks with Challenging Prompts — Violent illicit behavior | GPT-5.3 Instant | 0.901 | not_unsafe, model without system-level safeguards, lowest reasoning deployment setting; reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Violent illicit behavior | GPT-5.5 Instant | 0.913 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Violent illicit behavior | GPT-5.5 Instant (May Update) | 0.959 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Violent illicit behavior | GPT-5.5 Instant (June Update) | 0.967 | the previous production ChatGPT model; reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Violent illicit behavior | GPT-5.6 Sol (August) | 0.959 | developer-reported | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Violent illicit behavior | GPT-5.6 Luna (August) | 0.957 | developer-reported | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Nonviolent illicit behavior | GPT-5.3 Instant | 0.934 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Nonviolent illicit behavior | GPT-5.5 Instant | 0.957 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Nonviolent illicit behavior | GPT-5.5 Instant (May Update) | 0.984 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Nonviolent illicit behavior | GPT-5.5 Instant (June Update) | 0.987 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Nonviolent illicit behavior | GPT-5.6 Sol (August) | 0.997 | developer-reported | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Nonviolent illicit behavior | GPT-5.6 Luna (August) | 0.990 | developer-reported | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Extremism | GPT-5.3 Instant | 0.943 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Extremism | GPT-5.5 Instant | 0.925 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Extremism | GPT-5.5 Instant (May Update) | 0.943 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Extremism | GPT-5.5 Instant (June Update) | 0.943 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Extremism | GPT-5.6 Sol (August) | 0.906 | developer-reported | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Extremism | GPT-5.6 Luna (August) | 0.925 | developer-reported | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Hate | GPT-5.3 Instant | 1.000 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Hate | GPT-5.5 Instant | 1.000 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Hate | GPT-5.5 Instant (May Update) | 1.000 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Hate | GPT-5.5 Instant (June Update) | 0.965 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Hate | GPT-5.6 Sol (August) | 0.982 | developer-reported | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Hate | GPT-5.6 Luna (August) | 0.965 | developer-reported | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Self-harm (standard) | GPT-5.3 Instant | 0.846 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Self-harm (standard) | GPT-5.5 Instant | 0.844 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Self-harm (standard) | GPT-5.5 Instant (May Update) | 0.875 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Self-harm (standard) | GPT-5.5 Instant (June Update) | 0.937 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Self-harm (standard) | GPT-5.6 Sol (August) | 0.934 | developer-reported | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Self-harm (standard) | GPT-5.6 Luna (August) | 0.932 | developer-reported | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Gore | GPT-5.3 Instant | 0.812 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Gore | GPT-5.5 Instant | 0.604 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Gore | GPT-5.5 Instant (May Update) | 0.797 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Gore | GPT-5.5 Instant (June Update) | 0.827 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Gore | GPT-5.6 Sol (August) | 0.765 | a statistically significant difference from the previous production model, per the card; developer-reported | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Gore | GPT-5.6 Luna (August) | 0.865 | developer-reported | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Sexual | GPT-5.3 Instant | 0.888 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Sexual | GPT-5.5 Instant | 0.836 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Sexual | GPT-5.5 Instant (May Update) | 0.989 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Sexual | GPT-5.5 Instant (June Update) | 0.970 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Sexual | GPT-5.6 Sol (August) | 0.914 | a statistically significant difference from the previous production model; an additional system-level mitigation is applied in production to prevent graphic erotic content reaching users; developer-reported | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Sexual | GPT-5.6 Luna (August) | 0.974 | developer-reported | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Sexual/minors | GPT-5.3 Instant | 0.872 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Sexual/minors | GPT-5.5 Instant | 0.829 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Sexual/minors | GPT-5.5 Instant (May Update) | 0.991 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Sexual/minors | GPT-5.5 Instant (June Update) | 0.939 | reported by OpenAI in the GPT-5.6 August Updates card | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Sexual/minors | GPT-5.6 Sol (August) | 0.922 | developer-reported | 3.1.1 |
| Production Benchmarks with Challenging Prompts — Sexual/minors | GPT-5.6 Luna (August) | 0.966 | developer-reported | 3.1.1 |
| U18 evaluations — Age-restricted goods, services, and dangerous challenges / activities | GPT-5.5 Instant | 0.705 | teen-specific standards, production-derived adversarial examples; first U18 evaluations published by OpenAI; reported by OpenAI in the GPT-5.6 August Updates card | 3.2 |
| U18 evaluations — Age-restricted goods, services, and dangerous challenges / activities | GPT-5.5 Instant (May Update) | 0.756 | reported by OpenAI in the GPT-5.6 August Updates card | 3.2 |
| U18 evaluations — Age-restricted goods, services, and dangerous challenges / activities | GPT-5.5 Instant (June Update) | 0.725 | reported by OpenAI in the GPT-5.6 August Updates card | 3.2 |
| U18 evaluations — Age-restricted goods, services, and dangerous challenges / activities | GPT-5.6 Sol (August) | 0.865 | developer-reported | 3.2 |
| U18 evaluations — Age-restricted goods, services, and dangerous challenges / activities | GPT-5.6 Luna (August) | 0.857 | developer-reported | 3.2 |
| U18 evaluations — Sexual content | GPT-5.5 Instant | 0.888 | reported by OpenAI in the GPT-5.6 August Updates card | 3.2 |
| U18 evaluations — Sexual content | GPT-5.5 Instant (May Update) | 0.958 | reported by OpenAI in the GPT-5.6 August Updates card | 3.2 |
| U18 evaluations — Sexual content | GPT-5.5 Instant (June Update) | 0.962 | reported by OpenAI in the GPT-5.6 August Updates card | 3.2 |
| U18 evaluations — Sexual content | GPT-5.6 Sol (August) | 0.971 | developer-reported | 3.2 |
| U18 evaluations — Sexual content | GPT-5.6 Luna (August) | 0.984 | developer-reported | 3.2 |
| U18 evaluations — Eating disorders | GPT-5.5 Instant | 0.637 | reported by OpenAI in the GPT-5.6 August Updates card | 3.2 |
| U18 evaluations — Eating disorders | GPT-5.5 Instant (May Update) | 0.657 | reported by OpenAI in the GPT-5.6 August Updates card | 3.2 |
| U18 evaluations — Eating disorders | GPT-5.5 Instant (June Update) | 0.635 | reported by OpenAI in the GPT-5.6 August Updates card | 3.2 |
| U18 evaluations — Eating disorders | GPT-5.6 Sol (August) | 0.808 | developer-reported | 3.2 |
| U18 evaluations — Eating disorders | GPT-5.6 Luna (August) | 0.810 | developer-reported | 3.2 |
| U18 evaluations — Emotional reliance | GPT-5.5 Instant | 0.927 | reported by OpenAI in the GPT-5.6 August Updates card | 3.2 |
| U18 evaluations — Emotional reliance | GPT-5.5 Instant (May Update) | 0.944 | reported by OpenAI in the GPT-5.6 August Updates card | 3.2 |
| U18 evaluations — Emotional reliance | GPT-5.5 Instant (June Update) | 0.937 | reported by OpenAI in the GPT-5.6 August Updates card | 3.2 |
| U18 evaluations — Emotional reliance | GPT-5.6 Sol (August) | 0.921 | developer-reported | 3.2 |
| U18 evaluations — Emotional reliance | GPT-5.6 Luna (August) | 0.927 | developer-reported | 3.2 |
| U18 evaluations — Self-harm | GPT-5.5 Instant | 0.958 | reported by OpenAI in the GPT-5.6 August Updates card | 3.2 |
| U18 evaluations — Self-harm | GPT-5.5 Instant (May Update) | 0.982 | reported by OpenAI in the GPT-5.6 August Updates card | 3.2 |
| U18 evaluations — Self-harm | GPT-5.5 Instant (June Update) | 0.977 | reported by OpenAI in the GPT-5.6 August Updates card | 3.2 |
| U18 evaluations — Self-harm | GPT-5.6 Sol (August) | 0.987 | developer-reported | 3.2 |
| U18 evaluations — Self-harm | GPT-5.6 Luna (August) | 0.977 | developer-reported | 3.2 |
| U18 evaluations — Gore | GPT-5.5 Instant | 0.789 | reported by OpenAI in the GPT-5.6 August Updates card | 3.2 |
| U18 evaluations — Gore | GPT-5.5 Instant (May Update) | 0.865 | reported by OpenAI in the GPT-5.6 August Updates card | 3.2 |
| U18 evaluations — Gore | GPT-5.5 Instant (June Update) | 0.832 | reported by OpenAI in the GPT-5.6 August Updates card | 3.2 |
| U18 evaluations — Gore | GPT-5.6 Sol (August) | 0.872 | developer-reported | 3.2 |
| U18 evaluations — Gore | GPT-5.6 Luna (August) | 0.867 | developer-reported | 3.2 |
| Image input evaluations — Hate | GPT-5.3 Instant | 0.998 | not_unsafe on disallowed combined text and image input; reported by OpenAI in the GPT-5.6 August Updates card | 3.3 |
| Image input evaluations — Hate | GPT-5.5 Instant | 0.997 | reported by OpenAI in the GPT-5.6 August Updates card | 3.3 |
| Image input evaluations — Hate | GPT-5.5 Instant (May Update) | 0.994 | reported by OpenAI in the GPT-5.6 August Updates card | 3.3 |
| Image input evaluations — Hate | GPT-5.5 Instant (June Update) | 0.992 | reported by OpenAI in the GPT-5.6 August Updates card | 3.3 |
| Image input evaluations — Hate | GPT-5.6 Sol (August) | 0.986 | developer-reported | 3.3 |
| Image input evaluations — Hate | GPT-5.6 Luna (August) | 0.984 | developer-reported | 3.3 |
| Image input evaluations — Extremism | GPT-5.3 Instant | 0.989 | reported by OpenAI in the GPT-5.6 August Updates card | 3.3 |
| Image input evaluations — Extremism | GPT-5.5 Instant | 0.969 | reported by OpenAI in the GPT-5.6 August Updates card | 3.3 |
| Image input evaluations — Extremism | GPT-5.5 Instant (May Update) | 0.964 | reported by OpenAI in the GPT-5.6 August Updates card | 3.3 |
| Image input evaluations — Extremism | GPT-5.5 Instant (June Update) | 0.982 | reported by OpenAI in the GPT-5.6 August Updates card | 3.3 |
| Image input evaluations — Extremism | GPT-5.6 Sol (August) | 0.950 | developer-reported | 3.3 |
| Image input evaluations — Extremism | GPT-5.6 Luna (August) | 0.930 | described as a minor regression of low statistical significance; developer-reported | 3.3 |
| Image input evaluations — Self-harm | GPT-5.3 Instant | 0.871 | reported by OpenAI in the GPT-5.6 August Updates card | 3.3 |
| Image input evaluations — Self-harm | GPT-5.5 Instant | 0.868 | reported by OpenAI in the GPT-5.6 August Updates card | 3.3 |
| Image input evaluations — Self-harm | GPT-5.5 Instant (May Update) | 0.894 | reported by OpenAI in the GPT-5.6 August Updates card | 3.3 |
| Image input evaluations — Self-harm | GPT-5.5 Instant (June Update) | 0.938 | reported by OpenAI in the GPT-5.6 August Updates card | 3.3 |
| Image input evaluations — Self-harm | GPT-5.6 Sol (August) | 0.923 | developer-reported | 3.3 |
| Image input evaluations — Self-harm | GPT-5.6 Luna (August) | 0.909 | developer-reported | 3.3 |
| Image input evaluations — Harms-erotic | GPT-5.3 Instant | 0.998 | reported by OpenAI in the GPT-5.6 August Updates card | 3.3 |
| Image input evaluations — Harms-erotic | GPT-5.5 Instant | 0.984 | reported by OpenAI in the GPT-5.6 August Updates card | 3.3 |
| Image input evaluations — Harms-erotic | GPT-5.5 Instant (May Update) | 0.999 | reported by OpenAI in the GPT-5.6 August Updates card | 3.3 |
| Image input evaluations — Harms-erotic | GPT-5.5 Instant (June Update) | 1.000 | reported by OpenAI in the GPT-5.6 August Updates card | 3.3 |
| Image input evaluations — Harms-erotic | GPT-5.6 Sol (August) | 0.986 | developer-reported | 3.3 |
| Image input evaluations — Harms-erotic | GPT-5.6 Luna (August) | 0.994 | developer-reported | 3.3 |
| Dynamic Benchmarks with Adversarial User Simulations — Mental health | GPT-5.3 Instant | 0.984 | not_unsafe: share of assistant messages that do not violate safety policies, multi-turn adversarial user simulations; reported by OpenAI in the GPT-5.6 August Updates card | 3.4 |
| Dynamic Benchmarks with Adversarial User Simulations — Mental health | GPT-5.5 Instant | 0.996 | reported by OpenAI in the GPT-5.6 August Updates card | 3.4 |
| Dynamic Benchmarks with Adversarial User Simulations — Mental health | GPT-5.5 Instant (May Update) | 0.981 | reported by OpenAI in the GPT-5.6 August Updates card | 3.4 |
| Dynamic Benchmarks with Adversarial User Simulations — Mental health | GPT-5.5 Instant (June Update) | 0.991 | reported by OpenAI in the GPT-5.6 August Updates card | 3.4 |
| Dynamic Benchmarks with Adversarial User Simulations — Mental health | GPT-5.6 Sol (August) | 0.981 | developer-reported | 3.4 |
| Dynamic Benchmarks with Adversarial User Simulations — Mental health | GPT-5.6 Luna (August) | 0.977 | developer-reported | 3.4 |
| Dynamic Benchmarks with Adversarial User Simulations — Emotional reliance | GPT-5.3 Instant | 0.987 | reported by OpenAI in the GPT-5.6 August Updates card | 3.4 |
| Dynamic Benchmarks with Adversarial User Simulations — Emotional reliance | GPT-5.5 Instant | 0.965 | reported by OpenAI in the GPT-5.6 August Updates card | 3.4 |
| Dynamic Benchmarks with Adversarial User Simulations — Emotional reliance | GPT-5.5 Instant (May Update) | 0.988 | reported by OpenAI in the GPT-5.6 August Updates card | 3.4 |
| Dynamic Benchmarks with Adversarial User Simulations — Emotional reliance | GPT-5.5 Instant (June Update) | 0.989 | reported by OpenAI in the GPT-5.6 August Updates card | 3.4 |
| Dynamic Benchmarks with Adversarial User Simulations — Emotional reliance | GPT-5.6 Sol (August) | 0.961 | developer-reported | 3.4 |
| Dynamic Benchmarks with Adversarial User Simulations — Emotional reliance | GPT-5.6 Luna (August) | 0.965 | developer-reported | 3.4 |
| Dynamic Benchmarks with Adversarial User Simulations — Self-harm | GPT-5.3 Instant | 0.816 | reported by OpenAI in the GPT-5.6 August Updates card | 3.4 |
| Dynamic Benchmarks with Adversarial User Simulations — Self-harm | GPT-5.5 Instant | 0.839 | reported by OpenAI in the GPT-5.6 August Updates card | 3.4 |
| Dynamic Benchmarks with Adversarial User Simulations — Self-harm | GPT-5.5 Instant (May Update) | 0.852 | reported by OpenAI in the GPT-5.6 August Updates card | 3.4 |
| Dynamic Benchmarks with Adversarial User Simulations — Self-harm | GPT-5.5 Instant (June Update) | 0.967 | reported by OpenAI in the GPT-5.6 August Updates card | 3.4 |
| Dynamic Benchmarks with Adversarial User Simulations — Self-harm | GPT-5.6 Sol (August) | 0.901 | the card calls this a statistically significant regression against GPT-5.5 Instant (June Update), not observed in online experimentation; developer-reported | 3.4 |
| Dynamic Benchmarks with Adversarial User Simulations — Self-harm | GPT-5.6 Luna (August) | 0.911 | developer-reported | 3.4 |
| Prompt injection — Prompt injection attacks in connectors | GPT-5.3 Instant | 0.998 | robustness to known prompt-injection attacks embedded in tool output; reported by OpenAI in the GPT-5.6 August Updates card | 4.2 |
| Prompt injection — Prompt injection attacks in connectors | GPT-5.5 Instant | 1.000 | reported by OpenAI in the GPT-5.6 August Updates card | 4.2 |
| Prompt injection — Prompt injection attacks in connectors | GPT-5.5 Instant (May Update) | 0.998 | reported by OpenAI in the GPT-5.6 August Updates card | 4.2 |
| Prompt injection — Prompt injection attacks in connectors | GPT-5.6 Sol (August) | 1.000 | the table gives no GPT-5.6 Luna column, though the text says both models perform on par with previous Instant models; developer-reported | 4.2 |
| Tacit knowledge and troubleshooting — Gryphon Scientific multiple-choice set, refusal-adjusted | GPT-5.6 Luna (August) | 82.97% | 60 four-option multiple-choice questions; refusals and safe completions treated as successes; highest of the updated models, above the threshold; developer-reported | 7.1.1.3 |
| Tacit knowledge and troubleshooting — Indicative threshold | Threshold (consensus expert baseline) | 80% | stated in the GPT-5.6 August Updates card | 7.1.1.3 |
| Multimodal troubleshooting virology — Indicative threshold | Threshold (80th-percentile expert, Preparedness High) | 31% | rounded from the 78th-percentile expert score of 30.8%; both updated models score above it, with no per-model value given in the text; stated in the GPT-5.6 August Updates card | 7.1.1.1 |
| Multimodal troubleshooting virology — Human baseline | Virology experts (n=36, SecureBio pre-print) | 22.1% | mean accuracy; 78th percentile 30.8%; 350-question SecureBio set; stated in the GPT-5.6 August Updates card | 7.1.1.1 |
| TroubleshootingBench — Indicative threshold | Threshold (80th-percentile expert) | 36.4% | from a baselining campaign with 12 independent PhD experts; both updated models are above it, with no per-model value given in the text; stated in the GPT-5.6 August Updates card | 7.1.1.4 |
| Hard-negative protein binding prediction — pass@4 | GPT-5.4 | 3.5% | 43 protein targets and 492 hotspots, five candidate binders per task with exactly one true binder; reported by OpenAI in the GPT-5.6 August Updates card | 7.1.1.5 |
| Hard-negative protein binding prediction — pass@4 | GPT-5.5 | 1.48% | corrected on August 19, 2026 from the originally published 0.4%, which was GPT-5.5's pass@1 score; reported by OpenAI in the GPT-5.6 August Updates card | 7.1.1.5 |
| Hard-negative protein binding prediction — pass@4 | GPT-5.5 Pro | 0.0% | reported by OpenAI in the GPT-5.6 August Updates card | 7.1.1.5 |
| Hard-negative protein binding prediction — pass@4 | GPT-5.6 Sol (July) | 7.6% | the July release version; reported by OpenAI in the GPT-5.6 August Updates card | 7.1.1.5 |
| Hard-negative protein binding prediction — pass@4 | GPT-5.6 Sol (August) | 5.27% | below the 30% indicative Critical threshold; developer-reported | 7.1.1.5 |
| DNA sequence design for transcription factor binding — pass@1 | GPT-5.4 | 12.82% | 550 tasks from Nucleobench, scored against BPNet-family oracles, win rate over Ledidi; reported by OpenAI in the GPT-5.6 August Updates card | 7.1.1.6 |
| DNA sequence design for transcription factor binding — pass@1 | GPT-5.5 | 13.82% | reported by OpenAI in the GPT-5.6 August Updates card | 7.1.1.6 |
| DNA sequence design for transcription factor binding — pass@1 | GPT-5.5 Pro | 16.5% | reported by OpenAI in the GPT-5.6 August Updates card | 7.1.1.6 |
| DNA sequence design for transcription factor binding — pass@1 | GPT-5.6 Sol (July) | 13.7% | the July release version; reported by OpenAI in the GPT-5.6 August Updates card | 7.1.1.6 |
| DNA sequence design for transcription factor binding — pass@1 | GPT-5.6 Sol (August) | 12.55% | below the 90%-win-rate indicative Critical threshold; developer-reported | 7.1.1.6 |
| AAV Capsid Packaging Prediction — Spearman correlation | GPT-5.6 Sol (July) | 0.529 | restated from the GPT-5.6 system card; the evaluation was not run for the updated models because two of three Critical evaluations had already returned results below threshold and the majority rule made the remaining result immaterial; reported by OpenAI in the GPT-5.6 August Updates card | 7.1.1.7 |
| AAV Capsid Packaging Prediction — Indicative threshold | Threshold (Preparedness Critical, preliminary) | 0.600 | stated in the GPT-5.6 August Updates card | 7.1.1.7 |
| Capture the Flag (Internal) — 63 curated public CTF challenges | GPT-5.6 Sol (August) | 97.06% | headless Linux environment with common offensive security tools; challenge set filtered for low solve rates on GPT-5.3 Codex at high compute; the card says Sol "saturates the evaluation"; both updated models exceed the Preparedness High threshold; near-final representative checkpoint; developer-reported | 7.1.2.1.1 |
| Cyber range — Combined pass rate (13 scenarios) | GPT-5.3 Codex | 76.9% | percentage of scenarios passed; pass/fail over 16 trials per scenario, a pass being at least one successful trial; Printer Queue and Simple Privilege Escalation scenarios deprecated for this release; reported by OpenAI in the GPT-5.6 August Updates card | 7.1.2.3 |
| Cyber range — Combined pass rate (13 scenarios) | GPT-5.4 Thinking | 69.2% | reported by OpenAI in the GPT-5.6 August Updates card | 7.1.2.3 |
| Cyber range — Combined pass rate (13 scenarios) | GPT-5.5 Thinking | 92.3% | reported by OpenAI in the GPT-5.6 August Updates card | 7.1.2.3 |
| Cyber range — Combined pass rate (13 scenarios) | GPT-5.6 Sol (August) | 83.3% | fails Firewall Evasion and CA/DNS Hijacking; Online Retailer recorded as n/a, so the rate is over 12 scenarios; near-final representative checkpoint; developer-reported | 7.1.2.3 |
| Cyber range — Combined pass rate (13 scenarios) | GPT-5.6 Luna (August) | 61.5% | fails Leaked Token, Binary Exploitation, Firewall Evasion, EDR Evasion and CA/DNS Hijacking; developer-reported | 7.1.2.3 |
| Biology Model Refusal Evaluation — Severe (not_unsafe) | GPT-5.2 Thinking | 0.900 | model-response-only metric on held-out synthetic, red-teaming and production prompts; reported by OpenAI in the GPT-5.6 August Updates card | 7.2.1.1 |
| Biology Model Refusal Evaluation — Severe (not_unsafe) | GPT-5.4 Thinking | 0.961 | reported by OpenAI in the GPT-5.6 August Updates card | 7.2.1.1 |
| Biology Model Refusal Evaluation — Severe (not_unsafe) | GPT-5.5 Thinking | 0.958 | reported by OpenAI in the GPT-5.6 August Updates card | 7.2.1.1 |
| Biology Model Refusal Evaluation — Severe (not_unsafe) | GPT-5.6 Sol (July) | 0.943 | reported by OpenAI in the GPT-5.6 August Updates card | 7.2.1.1 |
| Biology Model Refusal Evaluation — Severe (not_unsafe) | GPT-5.6 Sol (August) | 0.954 | developer-reported | 7.2.1.1 |
| Biology Model Refusal Evaluation — Severe (not_unsafe) | GPT-5.6 Luna (August) | 0.937 | developer-reported | 7.2.1.1 |
| Biology Model Refusal Evaluation — Dual use (not_unsafe) | GPT-5.2 Thinking | 0.921 | reported by OpenAI in the GPT-5.6 August Updates card | 7.2.1.1 |
| Biology Model Refusal Evaluation — Dual use (not_unsafe) | GPT-5.4 Thinking | 0.955 | reported by OpenAI in the GPT-5.6 August Updates card | 7.2.1.1 |
| Biology Model Refusal Evaluation — Dual use (not_unsafe) | GPT-5.5 Thinking | 0.926 | reported by OpenAI in the GPT-5.6 August Updates card | 7.2.1.1 |
| Biology Model Refusal Evaluation — Dual use (not_unsafe) | GPT-5.6 Sol (July) | 0.911 | reported by OpenAI in the GPT-5.6 August Updates card | 7.2.1.1 |
| Biology Model Refusal Evaluation — Dual use (not_unsafe) | GPT-5.6 Sol (August) | 0.945 | developer-reported | 7.2.1.1 |
| Biology Model Refusal Evaluation — Dual use (not_unsafe) | GPT-5.6 Luna (August) | 0.928 | developer-reported | 7.2.1.1 |
| Cyber Model Refusal Evaluation — Production data | GPT-5.3 Codex | 0.952 | average safety score 0–1; reported by OpenAI in the GPT-5.6 August Updates card | 7.2.1.2 |
| Cyber Model Refusal Evaluation — Production data | GPT-5.4 Thinking | 0.964 | reported by OpenAI in the GPT-5.6 August Updates card | 7.2.1.2 |
| Cyber Model Refusal Evaluation — Production data | GPT-5.5 | 0.928 | reported by OpenAI in the GPT-5.6 August Updates card | 7.2.1.2 |
| Cyber Model Refusal Evaluation — Production data | GPT-5.6 Sol (July) | 0.981 | reported by OpenAI in the GPT-5.6 August Updates card | 7.2.1.2 |
| Cyber Model Refusal Evaluation — Production data | GPT-5.6 Sol (August) | 0.999 | developer-reported | 7.2.1.2 |
| Cyber Model Refusal Evaluation — Production data | GPT-5.6 Luna (August) | 0.974 | developer-reported | 7.2.1.2 |
| Cyber Model Refusal Evaluation — Synthetic data | GPT-5.3 Codex | 0.970 | reported by OpenAI in the GPT-5.6 August Updates card | 7.2.1.2 |
| Cyber Model Refusal Evaluation — Synthetic data | GPT-5.4 Thinking | 0.973 | reported by OpenAI in the GPT-5.6 August Updates card | 7.2.1.2 |
| Cyber Model Refusal Evaluation — Synthetic data | GPT-5.5 | 0.975 | reported by OpenAI in the GPT-5.6 August Updates card | 7.2.1.2 |
| Cyber Model Refusal Evaluation — Synthetic data | GPT-5.6 Sol (July) | 0.998 | reported by OpenAI in the GPT-5.6 August Updates card | 7.2.1.2 |
| Cyber Model Refusal Evaluation — Synthetic data | GPT-5.6 Sol (August) | 0.982 | developer-reported | 7.2.1.2 |
| Cyber Model Refusal Evaluation — Synthetic data | GPT-5.6 Luna (August) | 0.997 | developer-reported | 7.2.1.2 |
| Hallucinations (factuality prompt sets) — High stakes | GPT-5.6 Luna (August) | over 60% reduction | reduction in factual error rate relative to GPT-5.5 Instant on difficult medical, legal and financial prompts; LLM grader with web access; developer-reported | 6 |
| Hallucinations (factuality prompt sets) — Factuality Heavy and User Flagged Failures | GPT-5.6 Luna (August) | roughly 30% reduction | reduction in factual error rate relative to GPT-5.5 Instant on the other two prompt sets; developer-reported | 6 |
| Hallucinations (factuality prompt sets) — All three prompt sets | GPT-5.6 Sol (August) | roughly 60% reduction | statistically significant and more consistent reduction in factual error rate relative to GPT-5.5 Instant across Factuality Heavy, User Flagged Failures and High Stakes; developer-reported | 6 |
Discrepancies noted
The update gives GPT-5.5's corrected pass@4 on hard-negative protein-binding prediction as 1.48%; the GPT-5.6 preview and final cards and the GPT-6 Astra card give the same corrected figure as 1.5%.
Relationships
- depends-on: GPT-5.6 System Card (OpenAI, July 2026) — the card this addendum updates, and the source of the safeguards and threat models it reuses
- supports: GPT-5.6 (Sol, Terra, Luna) — the safety document for the August 2026 ChatGPT versions of Sol and Luna
- depends-on: OpenAI Preparedness Framework V.2 — the governing capability-classification framework
- related: OpenAI — publisher
- related: HealthBench — health evaluation reported in the card
- instance-of: AI System Cards