Dated October 29, 2025, covering gpt-oss-safeguard-120b and gpt-oss-safeguard-20b — open-weight models released for safety classification rather than general use.
Scope
The report is organized around safety classification performance and its limitations, multilingual performance, and observed safety challenges with their mitigations: disallowed content, jailbreaks, instruction hierarchy, hallucinated chains of thought, and hallucinations.
Two features of that structure are worth noting. The report devotes a section to limitations of the classification performance rather than only reporting scores. And it treats hallucinated chains of thought as a distinct failure category from hallucination generally — relevant because a classifier whose stated reasoning does not correspond to its actual computation defeats the purpose of using a reasoning model for the task, which is the same concern raised in Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation (Baker et al., OpenAI, 2025).
Position in the open-weight argument
Releasing classifier models with open weights is a different proposition from releasing capable general models: the artifact is a safeguard component rather than a capability, and open release lets deployers run their own moderation rather than depend on a provider's API. It complements the marginal-risk analysis in Estimating Worst-Case Frontier Risks of Open-Weight LLMs (Wallace et al., OpenAI, 2025), which addressed the release of the general gpt-oss models.
Relationships
- supports: gpt-oss (OpenAI open-weight models) — the safeguard variants of the same open-weight family
- related: Estimating Worst-Case Frontier Risks of Open-Weight LLMs (Wallace et al., OpenAI, 2025) — the risk analysis for the general gpt-oss release
- related: Open-Weight Frontier Models, AI and Content Moderation, Sycophancy and Hallucination, OpenAI