OpenAI GPT-5 System Card
OpenAI GPT-5 System Card
Quick read
Based on the paper's full text (AI-generated); refer to the original
OpenAI releases the GPT-5 System Card, presenting safety evaluations, external red teaming, and Preparedness Framework dangerous capability assessments for models such as gpt-5-main and gpt-5-thinking. The GPT-5 series adopts safe-completions safety training in place of binary refusals; OpenAI, on precautionary grounds, treats gpt-5-thinking as having High capability in the biological and chemical domains and activates corresponding protections, while stating there is no conclusive evidence that it can significantly help novices cause severe biological harm, and the GPT-5 series does not reach the high-risk threshold for cybersecurity. Evaluations show gpt-5-thinking scores 0.99 on both the browsing and tool-calling prompt injection evaluations, versus 0.89 and 0.80 for o3 respectively; preliminary online measurements show the sycophancy rate for gpt-5-main is 69% lower than GPT-4o among free users and 75% lower among paid users.
- Before release, the GPT-5 series (gpt-5-main, gpt-5-thinking, etc.) requires systematic evaluation of safety risks, including inappropriate content, jailbreaks, sycophancy, hallucination, deception, biochemical and cybersecurity capabilities, etc., and a determination of whether the high-capability thresholds of the Preparedness Framework are triggered.
- The authors replace binary refusal training with safe-completions, combined with instruction hierarchy, multi-layer prompt injection defenses, CoT monitoring, and red teaming; they conduct Preparedness evaluations of capabilities such as biochemistry, cybersecurity, and AI self-improvement, along with system-level protections combining classifiers and reasoning monitoring, and account enforcement.
- The authors report that gpt-5-thinking is comparable to or better than o3 on multiple safety evaluations, with lower hallucination and deception rates and significantly reduced sycophancy; biochemistry is treated as High capability and protections are enabled, while cybersecurity and self-improvement do not reach the High threshold; external red teamers consider its overall safety comparable to or better than o3.
- The authors acknowledge that protections are not perfect and that residual risks remain, including deception, evaluation awareness, unknown universal jailbreaks, and policy gray areas; evaluations of sycophancy and emotional reliance are not yet mature, and METR also points out that pre-deployment evaluations have limitations regarding risks such as internal use and weight theft.
The system card presents evaluation data for the GPT-5 series across dimensions such as jailbreaks, prompt injection, and biological and cybersecurity, which can be compared with prior-generation models such as o3 to examine safety changes.