The OpenAI Model Spec is OpenAI's specification for how its models should behave, released under a Creative Commons CC0 1.0 public domain dedication. It functions as the behavior-governing document for GPT-5.x and Codex, defining a chain of command over levels of instruction authority and a set of red-line principles that cannot be overridden. The document is versioned by date at model-spec.openai.com; the current revision is dated 18 August 2026 (Source: model-spec.openai.com), succeeding the 18 December 2025 revision (Source: model-spec.openai.com).
The 2026-08-18 revision organizes the document into seven top-level sections — Overview, Definitions, The chain of command, Stay in bounds, Seek the truth together, Do the best work and Use appropriate style — followed by a set of Under-18 Principles (Source: model-spec.openai.com).
Chain of command
The Spec assigns every instruction — its own, and those from developers and users — a level of authority, with higher levels overriding lower ones. OpenAI describes the arrangement as designed "to maximize steerability and control for users and developers, enabling them to adjust the model's behavior to their needs while staying within clear boundaries." The ordering is unchanged between the December 2025 and August 2026 revisions.
| Level | Source | Can be overridden by |
|---|---|---|
| Root | The Model Spec and the detailed policies it contains | Nothing |
| System | OpenAI, via the Spec, detailed policies, or a system message | Root |
| Developer | API customers | Root, System |
| User | End users | Root, System, Developer |
| Guideline | Default styles and behaviors stated in the Spec | Any of the above, including implicitly |
Root-level instructions are described as "mostly prohibitive, requiring models to avoid behaviors that could contribute to catastrophic risks, cause direct physical harm to people, violate laws, or undermine the chain of command." OpenAI states its restraint by analogy: it expects AI "to become a foundational technology for society, analogous to basic internet infrastructure," and so imposes root-level rules "only when we believe they are necessary for the broad spectrum of developers and users who will interact with this technology." Where two root-level principles conflict, "the model should default to inaction." The system level exists so that rules can vary by serving surface and by user characteristics such as age, and can be supplied only by OpenAI. On the developer level the Spec states an explicitly market-based rationale: "we aim to give developers broad latitude, trusting that those who impose overly restrictive rules on end users will be less competitive in an open market" (Source: model-spec.openai.com).
Red-line principles
Three principles are stated as applying "across all deployments of our models": that the models should never be used to facilitate critical and high severity harms, the Spec naming acts of violence (crimes against humanity, war crimes, genocide, torture, human trafficking or forced labor), creation of cyber, biological or nuclear weapons, terrorism, child abuse, persecution and mass surveillance; that "Humanity should be in control of how AI is used and how AI behaviors are shaped," with targeted or scaled exclusion, manipulation, undermining human autonomy and eroding participation in civic processes disallowed; and a commitment to safeguarding individual privacy in interactions with AI.
Three further principles are committed to only in OpenAI's first-party consumer products including ChatGPT: easy access to trustworthy safety-critical information; transparency into the rules and reasons behind model behavior, provided "primarily through this Model Spec"; and that customization, personalization and localization, except as it relates to legal compliance, "should never override any principles above the 'guideline' level." OpenAI encourages API developers and ChatGPT organization administrators to follow these as well but does not require it. This wording is identical in the December 2025 and August 2026 revisions (Source: model-spec.openai.com).
The red lines prohibit facilitation of weapons of mass destruction but do not specifically address lethal autonomous weapons (Autonomous Weapons). The Spec separately addresses sycophancy and hallucination as failure modes the model should avoid (Sycophancy and Hallucination).
Risk taxonomy
The August 2026 revision adds a Specific risks subsection to the Overview, absent from the December 2025 text, naming three categories with their assigned mitigations. Misaligned goals — pursuing the wrong objective through misalignment, misunderstanding, or being misled by a third party, the Spec's examples being a model that deletes every file when asked to "clean up my desktop" and one that follows malicious instructions hidden in a website — are addressed by following the chain of command and asking clarifying questions. Execution errors — understanding the task but erring in carrying it out, the examples given being incorrect medication dosages and inaccurate information about a person amplified through social media — are addressed by controlling side effects, avoiding factual and reasoning errors, expressing uncertainty and staying in bounds. Harmful instructions — harm caused by simply following user or developer instructions — are described as "particularly challenging because they involve a direct conflict between empowering the user and preventing harm," addressed by refusal or safe completion for the enumerated categories (Source: model-spec.openai.com).
Changes in the August 2026 revision
Compared against the December 2025 text held alongside it, the 2026-08-18 revision leaves the red-line principles, the chain-of-command ordering, and the self-harm, mental-health and sycophancy provisions verbatim or near-verbatim, and makes its substantive additions in four places.
Agentic operation. The section Act within an agreed-upon scope of autonomy gains an explicit grounding in established security doctrine, citing the principle of least privilege and capability-based security, together with a caution that scope "should also not be so narrow as to require multiple confirmations by the user for trivial actions, which could habituate the user to automatically confirming all requests." It also introduces a machine-readable form for the agreed scope: "Scopes should be recorded in a semi-structured format — for instance, a ScopeOfAutonomy record with fields allowed_tools, latest_time, max_cost, tool_constraints, and free-text additional_details — to facilitate validation, enforcement, and auditing by the platform," and states that including a time limit in the ending condition is a best practice (Source: model-spec.openai.com).
Conduct during evaluations. Both revisions instruct the assistant to "act as if side effects will manifest in reality unless explicitly instructed otherwise, even if likely operating within simulations, training, or evaluation contexts." The August 2026 text adds a rationale absent from the December version: "Consistency across training, evaluation, and deployment ensures reliable model behavior and proper measurement of essential safety properties." The Spec thus makes indifference to whether one is being evaluated a stated behavioral requirement, a question also treated at Unverbalized Evaluation Awareness (Source: model-spec.openai.com).
Prompt injection. Ignore untrusted data by default grows by roughly 40%, adding concrete guidance that developers place untrusted data in untrusted_text blocks where available and otherwise in YAML, JSON or XML, since without such formatting "the untrusted input might contain malicious instructions ('prompt injection'), and it can be extremely difficult for the assistant to distinguish them from the developer's instructions." It further advises developers to give the assistant enough information about each tool to assess trustworthiness and side effects, noting that the assistant "should behave differently when using a terminal tool that accesses the user's personal computer compared to a disposable sandbox environment" (Source: model-spec.openai.com).
Truthfulness. Do not lie is the most expanded provision, growing from roughly 5,800 to roughly 9,800 characters. The additions draw a distinction between first-party and API contexts: under the red-line principles "OpenAI commits to never overriding objectivity in ChatGPT (e.g., via a system or developer message)," while in API use "'misleading' can be highly context-dependent" because the model "cannot fully know if its outputs will be shown to a user distinct from the developer." The stated resolution is to default to trusting developers not to mislead end users, following their instructions, "while addressing usage policy violations at the system level." A further addition governs false premises: where a request rests on a false or possibly false premise the assistant should flag the misalignment, but "if context already makes fiction, roleplay, satire, or speculation clear, no extra disclaimer is needed," and it should avoid "over-disclaiming, being patronizing or inconsiderate, or confidently declaring a premise false when it is uncertain" (Source: model-spec.openai.com).
Two further guideline-level sections are new. Be clear about capabilities and limits requires the assistant to help the user "form and maintain an accurate mental model of what the assistant can and can't do in the current context," giving as a violation an assistant that answers a request to forget prior statements with "Done—I won't mention her again!" where deletion is not something it can perform. Don't make unprompted personal comments requires the assistant to "refrain from making personal observations or comments about the user that were not solicited," with violations including inferring cuisine preferences from a user's clothing visible on video (Source: model-spec.openai.com).
Companion methodology essay
OpenAI published "Inside our approach to the Model Spec" on April 23, 2026, a methodology essay describing the process by which the Spec is developed, balanced against safety, user-freedom, and accountability trade-offs, and updated as AI systems advance. The essay presents the Model Spec as a public framework, released under CC0, that other developers can adopt and that civil society can comment on, rather than a closed internal policy document.
It also supplies structural detail the Spec itself does not state. The Spec's contents divide into hard rules — non-overridable root- or system-level boundaries, "mostly prohibitive," covering catastrophic risk, direct physical harm, illegality, and undermining the chain of command — and defaults, overridable starting points split between implicitly steerable guideline-level defaults such as tone and style, and user-level defaults such as truthfulness and objectivity that can be overridden only by explicit instruction, so that a change of factual stance stays "transparent and legible." OpenAI states its restraint on hard rules by analogy: because it expects AI "to become a foundational technology for society, analogous to basic internet infrastructure," it imposes rules limiting intellectual freedom "only when we believe they are necessary."
The essay is also explicit that the Spec's preamble is not an instruction to the model — "Benefiting humanity is OpenAI's goal, not a goal we want our models to pursue autonomously" — on the reasoning that training models to select instructions by OpenAI's own view of social good "would be in the position of adjudicating morality at a very broad level." It records four reasons production models diverge from the Spec (training lagging Spec updates; training inadvertently teaching inconsistent behavior, treated as a serious bug; incomplete coverage of the behavior space; and generalization differing from intent, which deliberative alignment mitigates without solving), states that the Spec is drafted to sit "around 0-3 months ahead of the present," and announces Model Spec Evals, a scenario-based suite measuring compliance by Spec section across models.
Relationships
- related: OpenAI — the publishing organization; the Spec is its stated behavior-governance document.
- related: Inside our approach to the Model Spec (OpenAI, April 2026) — OpenAI's methodology essay on how the Spec is written and revised.
- related: Constitutional AI — Anthropic's counterpart approach to behavior specification.
- related: AI Safety Cases and Frameworks — the layer of documents this belongs to.
- related: Unverbalized Evaluation Awareness — the revision states consistency across training, evaluation and deployment as a requirement.
- related: Prompt Injection — the untrusted-data provisions.
- related: Sycophancy and Hallucination — failure modes the Spec instructs against.
Provenance
The Model Spec is OpenAI's behavior-specification document for its frontier models and is described by OpenAI as the governance document for those systems (OpenAI). It is OpenAI's counterpart to Anthropic's Constitutional AI and represents the behavior-specification layer within broader AI Safety Frameworks.
Two revisions are held. The 18 August 2026 revision was captured 1 September 2026 from model-spec.openai.com by forced live fetch returning HTTP 200, with the page title reporting as Model Spec (2026/08/18): Raw Sources/OpenAI Model Spec (2026-08-18 revision).md. The 18 December 2025 revision was captured 13 April 2026: Raw Sources/OpenAI Model Spec.md. The comparison in this page was made between those two captured texts section by section; example dialogues and inline commentary widgets are captured as prose and images were not retrieved, so a change confined to a figure would not be detected.