GPT-5.6 System Card - OpenAI Deployment Safety Hub
https://deploymentsafety.openai.com/gpt-5-6/evaluations-with-challenging-prompts
OpenAI Deployment Safety Hub — per-category evaluations and the named external evaluators
2630
Lines added
2575
Lines removed
Was read
2026-09-08
592c985a9a0ddfd2…
Changed by
2026-09-23
ebdc27272bf693f3…
2630 lines replaced 2575 — too large to align line by line
Left column is the version read 2026-09-08, right is 2026-09-23. Unchanged stretches are elided. Both bodies are kept in full and are addressed by the hashes above.
The change is too large to align line by line, so a bounded sample of each version is shown rather than the whole of either. A rewrite of this size is usually a republished page rather than an edit.
Showing the first 400 lines of the comparison; 55 further lines are held back. This page reports a change, it is not a copy of anyone’s document — the source is linked above and is the authority for what it says.
1−.system-card-section--empty+section]:!mt-sm"> August 3, 2026 : Added GPT-Red prompt-injection evaluation
2−results .
3−
4−August 19, 2026 : We corrected GPT-5.5’s pass@4 score on the
5−hard-negative
6−protein binding prediction evaluation from 0.4% to 1.5%. The
7−previously reported value was its pass@1 score.
8−
9−GPT-5.6 is a new family of three models: Sol, our new flagship model;
10−Terra, a capable lower-cost option; and Luna, our fastest and most
11−cost-efficient model. The safeguards we have built for this launch—our
12−most robust yet—are built to deliver these models safely and at scale,
13−around the world.
14−
15−Under our Preparedness Framework, we are treating Sol, Terra and Luna
16−as High capability in both Cybersecurity and Biological and Chemical
17−risk. None of them reach our High threshold in AI Self-Improvement. We
18−have implemented a tailored set of safeguards , adapted to each model’s
19−capability profile, to sufficiently minimize the associated risks.
20−
21−This system card is a detailed report of the work we did to
22−understand and mitigate GPT-5.6’s safety risks before deployment. The
23−six most important things to know are that:
24−
25−These models are a meaningful step up in cybersecurity
26−capability, but they do not reach our risk framework’s highest level
27−(Critical). GPT-5.6 Sol and Terra can find vulnerabilities and
28−pieces of exploits, but in cybersecurity testing
29−they were unable to carry out autonomous, end-to-end attacks against
30−hardened targets. Separate evaluations examined misaligned
31−behavior in agentic coding tasks and found GPT-5.6 shows a
32−greater tendency than GPT-5.5 to go beyond the user’s intent, including
33−by taking or attempting actions that the user had not asked for, though
34−absolute rates remain low.
35−
36−We are taking a more conservative approach as we continue to
37−strengthen the system against adaptive attacks. Compared with
38−previous models, our GPT‑5.6 Sol cyber safeguards block roughly ten
39−times more potentially harmful activity. Because these measures can
40−create friction for benign users, we provide an option in ChatGPT and
41−Codex to easily retry prompts on lower-capability models, and we will
42−continue reducing the impact of our safeguards on benign users while
43−maintaining a high robustness bar. This reflects our iterative
44−deployment approach: starting conservatively and improving based on what
45−we learn from real-world use.
46−
47−To make these models safe, we added new technology to a
48−safety stack that is more than the sum of its parts. The models
49−are trained to
50−be safe , Sol and Terra are served with newly added activation classifiers
51−focused on sensitive domains that watch the model and can intervene to
52−stop unsafe answers during generation, and certain conversations are
53−scanned so unsafe outputs are blocked in real time if they cross safety
54−boundaries. We also have automated safety systems that look for unsafe
55−patterns across conversations that would not be clear from any single
56−moment.
57−
58−Severe harm requires a chain of successful steps, and our
59−safeguards place barriers throughout that chain. Based on our
60−threat modelling in
61−cybersecurity and biology, we’ve designed our safety stack so that even
62−if an attacker does complete one step on the path to harm, safeguards
63−will still stop the model from allowing severe harm. We also have
64−programs in place so
65−that when GPT-5.6 models are broadly available to the public, we can
66−continue to reserve the most sensitive cybersecurity and biological
67−capabilities for trusted defenders.
68−
69−Our safeguard testing was more intensive than for any earlier
70−release, and we are continuing to test during deployment.
71−Expert humans and external testers used a diverse set of approaches to
72−find gaps. We’ve also dedicated over 700,000 A100e GPU hours to automatically find
73−universal jailbreaks , and we will run automated red teaming
74−continuously during deployment. As jailbreaks are reported, we
75−reproduce, mitigate and retest for them so that gaps are addressed.
76−
77−Providing broad access, particularly for cybersecurity
78−capabilities, will have important safety benefits . Our testing
79−suggests that GPT-5.6 is better at finding and fixing cyber
80−vulnerabilities than at exploiting those vulnerabilities in real
81−attacks. That gives defenders an opportunity to harden systems before
82−cybersecurity weaknesses are exploited—an opportunity that may narrow as
83−offensive capabilities improve. Our safeguards therefore focus on making
84−malicious use at scale harder, while still enabling the day-to-day work
85−of securing systems.
86−
87−In this card, we show how performance changes with reasoning
88−effort—the amount of thinking a model uses to work through a problem.
89−Rather than report a single score, we show a curve across different
90−levels of effort. This gives a fuller picture of what the model can do
91−and how much effort it takes to get there.
92−
93−Note that we are continually iterating on our models. Comparison
94−values from previously-launched models are from recent snapshots of
95−those models, and may vary slightly from values published in previous
96−cards.
97−
98−Like OpenAI’s other models, GPT-5.6 was trained on diverse datasets,
99−including information that is publicly available on the internet,
100−information that we partner with third parties to access, and
101−information that our users or human trainers and researchers provide or
102−generate. Our data processing pipeline includes rigorous filtering to
103−maintain data quality and mitigate potential risks. We use advanced data
104−filtering processes to reduce personal information from training data.
105−We also employ safety classifiers to help prevent or reduce the use of
106−harmful or sensitive content, including explicit materials such as
107−sexual content involving a minor.
108−
109−OpenAI reasoning models are trained to reason through reinforcement
110−learning. These models are trained to think before they answer: they can
111−produce a long internal chain of thought before responding to the user.
112−Through training, these models learn to refine their thinking process,
113−try different strategies, and recognize their mistakes. Reasoning allows
114−these models to follow specific guidelines and model policies we’ve set,
115−helping them act in line with our safety expectations. This means they
116−provide more helpful answers and better resist attempts to bypass safety
117−rules.
118−
119−Note that comparison values from previously launched models are from
120−the latest versions of those models, so may vary slightly from values
121−published at launch for those models. 1
122−
123−We conducted benchmark evaluations across disallowed content
124−categories. We report here on our Production Benchmarks, an evaluation
125−set with conversations representative of challenging examples from
126−production data. As we noted in previous system cards, we introduced
127−these Production Benchmarks to help us measure continuing progress given
128−that our earlier Standard evaluations for these categories had become
129−relatively saturated.
130−
131−These evaluations were deliberately created to be difficult. They
132−were built around cases in which our existing models were not yet giving
133−ideal responses, and this is reflected in the scores below. Error rates
134−are not representative of average production traffic. The primary metric
135−is not_unsafe, checking that the model did not produce output that is
136−disallowed under the relevant OpenAI policy.
137−
138−Our evaluations are run on the model without system-level safeguards,
139−to ensure the model’s underlying behavior meets our safety bar. We
140−continue monitoring these categories after launch to evaluate online
141−performance and further adjust safeguards as appropriate.
142−
143−Values from previously launched models are from the latest versions
144−of those models, and evals are subject to some variation. Values may
145−vary slightly from values published at launch for those models. The
146−comparison scores from earlier models listed below are intended to shed
147−light on relative performance. Because policies, graders, datasets, and
148−other measurement details evolve over time, scores not included in the
149−table below should generally not be considered directly comparable to
150−these most recent results.
151−
152−Table 1: Production Benchmarks with Challenging Prompts (higher is better)
153−
154−Category
155−
156−Note (compared to previous system cards): to deduplicate overlaps
157−between our previous “hate” and “harassment” categories, we are merging
158−“harassment” and “hate” into a single evaluation. Additionally, we have
159−renamed our previous “violence” category to “gore” 1 in
160−order to more clearly distinguish it from requests related to illicit
161−violent behavior; this is a naming change, not a change in the
162−underlying evaluation.
163−
164−We find that the GPT-5.6 series performs similarly to previous
165−thinking models, with the exception of gore. On ChatGPT, for users we
166−believe may be under 18, we apply additional age-appropriate content
167−protections that further restrict sexual content and exposure to gore.
168−You can read more about these safeguards and our
169−approach to Age Prediction .
170−
171−Building on evaluations in the GPT-5.4
172−Thinking and GPT-5.5
173−system cards, we simulate model deployment before release by leveraging
174−approximately representative production prompts. While estimates in
175−these prior system cards were experimental, we have since more
176−thoroughly validated this approach in our recent
177−research . In light of this, we are updating how we report results in
178−this section. We are still expanding the rollout of this technique, and
179−for the scope of this system card we evaluated GPT-5.6 Sol only. In
180−accordance with our privacy policy, we only analyzed ChatGPT traffic
181−from users who allow their data to be used for model improvements. We
182−additionally exclude multi-modal conversations. We sample uniformly
183−among remaining conversations.
184−
185−Before the release of the model, we leverage past ChatGPT production
186−GPT-5.5 conversations to simulate the deployment of GPT-5.6 Sol by
187−resampling the final assistant turn with the new model. We then
188−automatically label the resulting resampled completions for disallowed
189−content. These labels may be limited in their precision especially for
190−low prevalence behaviors, but can still provide valuable directional
191−signal.
192−
193−In the figure below, we report the forecasted prevalence of unsafe
194−model-level outputs. For example, based on the observed distribution of
195−conversations with GPT-5.6 Sol, we estimate that approximately 8.6 out
196−of every 100,000 production conversation turns with GPT-5.6 Sol would be
197−graded as violating our harassment policy.
198−
199−Simulation-based forecasts. Comparing a deployment
200−simulation of GPT-5.6 Sol to a deployment simulation of GPT-5.5 predicts
1+header]:mb-md" data-section data-section-slug="change-log" data-section-anchor="change-log" data-section-id="sec-1"> :first-child]:mt-0"> August 3, 2026 : Added GPT-Red prompt-injection evaluation
2+results .
3+
4+August 19, 2026 : We corrected GPT-5.5’s pass@4 score on the
5+hard-negative
6+protein binding prediction evaluation from 0.4% to 1.5%. The
7+previously reported value was its pass@1 score.
8+
9+header]:mb-md" data-section data-section-slug="introduction" data-section-anchor="introduction" data-section-id="sec-2"> :first-child]:mt-0"> GPT-5.6 is a new family of three models: Sol, our new flagship model;
10+Terra, a capable lower-cost option; and Luna, our fastest and most
11+cost-efficient model. The safeguards we have built for this launch—our
12+most robust yet—are built to deliver these models safely and at scale,
13+around the world.
14+
15+Under our Preparedness Framework, we are treating Sol, Terra and Luna
16+as High capability in both Cybersecurity and Biological and Chemical
17+risk. None of them reach our High threshold in AI Self-Improvement. We
18+have implemented a tailored set of safeguards , adapted to each model’s
19+capability profile, to sufficiently minimize the associated risks.
20+
21+This system card is a detailed report of the work we did to
22+understand and mitigate GPT-5.6’s safety risks before deployment. The
23+six most important things to know are that:
24+
25+These models are a meaningful step up in cybersecurity
26+capability, but they do not reach our risk framework’s highest level
27+(Critical). GPT-5.6 Sol and Terra can find vulnerabilities and
28+pieces of exploits, but in cybersecurity testing
29+they were unable to carry out autonomous, end-to-end attacks against
30+hardened targets. Separate evaluations examined misaligned
31+behavior in agentic coding tasks and found GPT-5.6 shows a
32+greater tendency than GPT-5.5 to go beyond the user’s intent, including
33+by taking or attempting actions that the user had not asked for, though
34+absolute rates remain low.
35+
36+We are taking a more conservative approach as we continue to
37+strengthen the system against adaptive attacks. Compared with
38+previous models, our GPT‑5.6 Sol cyber safeguards block roughly ten
39+times more potentially harmful activity. Because these measures can
40+create friction for benign users, we provide an option in ChatGPT and
41+Codex to easily retry prompts on lower-capability models, and we will
42+continue reducing the impact of our safeguards on benign users while
43+maintaining a high robustness bar. This reflects our iterative
44+deployment approach: starting conservatively and improving based on what
45+we learn from real-world use.
46+
47+To make these models safe, we added new technology to a
48+safety stack that is more than the sum of its parts. The models
49+are trained to
50+be safe , Sol and Terra are served with newly added activation classifiers
51+focused on sensitive domains that watch the model and can intervene to
52+stop unsafe answers during generation, and certain conversations are
53+scanned so unsafe outputs are blocked in real time if they cross safety
54+boundaries. We also have automated safety systems that look for unsafe
55+patterns across conversations that would not be clear from any single
56+moment.
57+
58+Severe harm requires a chain of successful steps, and our
59+safeguards place barriers throughout that chain. Based on our
60+threat modelling in
61+cybersecurity and biology, we’ve designed our safety stack so that even
62+if an attacker does complete one step on the path to harm, safeguards
63+will still stop the model from allowing severe harm. We also have
64+programs in place so
65+that when GPT-5.6 models are broadly available to the public, we can
66+continue to reserve the most sensitive cybersecurity and biological
67+capabilities for trusted defenders.
68+
69+Our safeguard testing was more intensive than for any earlier
70+release, and we are continuing to test during deployment.
71+Expert humans and external testers used a diverse set of approaches to
72+find gaps. We’ve also dedicated over 700,000 A100e GPU hours to automatically find
73+universal jailbreaks , and we will run automated red teaming
74+continuously during deployment. As jailbreaks are reported, we
75+reproduce, mitigate and retest for them so that gaps are addressed.
76+
77+Providing broad access, particularly for cybersecurity
78+capabilities, will have important safety benefits . Our testing
79+suggests that GPT-5.6 is better at finding and fixing cyber
80+vulnerabilities than at exploiting those vulnerabilities in real
81+attacks. That gives defenders an opportunity to harden systems before
82+cybersecurity weaknesses are exploited—an opportunity that may narrow as
83+offensive capabilities improve. Our safeguards therefore focus on making
84+malicious use at scale harder, while still enabling the day-to-day work
85+of securing systems.
86+
87+In this card, we show how performance changes with reasoning
88+effort—the amount of thinking a model uses to work through a problem.
89+Rather than report a single score, we show a curve across different
90+levels of effort. This gives a fuller picture of what the model can do
91+and how much effort it takes to get there.
92+
93+Note that we are continually iterating on our models. Comparison
94+values from previously-launched models are from recent snapshots of
95+those models, and may vary slightly from values published in previous
96+cards.
97+
98+header]:mb-md" data-section data-section-slug="model-data-and-training" data-section-anchor="model-data-and-training" data-section-id="sec-3"> :first-child]:mt-0"> Like OpenAI’s other models, GPT-5.6 was trained on diverse datasets,
99+including information that is publicly available on the internet,
100+information that we partner with third parties to access, and
101+information that our users or human trainers and researchers provide or
102+generate. Our data processing pipeline includes rigorous filtering to
103+maintain data quality and mitigate potential risks. We use advanced data
104+filtering processes to reduce personal information from training data.
105+We also employ safety classifiers to help prevent or reduce the use of
106+harmful or sensitive content, including explicit materials such as
107+sexual content involving a minor.
108+
109+OpenAI reasoning models are trained to reason through reinforcement
110+learning. These models are trained to think before they answer: they can
111+produce a long internal chain of thought before responding to the user.
112+Through training, these models learn to refine their thinking process,
113+try different strategies, and recognize their mistakes. Reasoning allows
114+these models to follow specific guidelines and model policies we’ve set,
115+helping them act in line with our safety expectations. This means they
116+provide more helpful answers and better resist attempts to bypass safety
117+rules.
118+
119+Note that comparison values from previously launched models are from
120+the latest versions of those models, so may vary slightly from values
121+published at launch for those models. 1
122+
123+header]:mb-md" data-section data-section-slug="model-safety" data-section-anchor="model-safety" data-section-id="sec-4"> :first-child]:mt-0">
124+
125+header]:mb-sm" data-section data-section-slug="disallowed-content" data-section-anchor="disallowed-content" data-section-id="sec-4-1"> :first-child]:mt-0">
126+
127+header]:mb-2xs" data-section data-section-slug="evaluations-with-challenging-prompts" data-section-anchor="evaluations-with-challenging-prompts" data-section-id="sec-4-1-1"> :first-child]:mt-0"> We conducted benchmark evaluations across disallowed content
128+categories. We report here on our Production Benchmarks, an evaluation
129+set with conversations representative of challenging examples from
130+production data. As we noted in previous system cards, we introduced
131+these Production Benchmarks to help us measure continuing progress given
132+that our earlier Standard evaluations for these categories had become
133+relatively saturated.
134+
135+These evaluations were deliberately created to be difficult. They
136+were built around cases in which our existing models were not yet giving
137+ideal responses, and this is reflected in the scores below. Error rates
138+are not representative of average production traffic. The primary metric
139+is not_unsafe, checking that the model did not produce output that is
140+disallowed under the relevant OpenAI policy.
141+
142+Our evaluations are run on the model without system-level safeguards,
143+to ensure the model’s underlying behavior meets our safety bar. We
144+continue monitoring these categories after launch to evaluate online
145+performance and further adjust safeguards as appropriate.
146+
147+Values from previously launched models are from the latest versions
148+of those models, and evals are subject to some variation. Values may
149+vary slightly from values published at launch for those models. The
150+comparison scores from earlier models listed below are intended to shed
151+light on relative performance. Because policies, graders, datasets, and
152+other measurement details evolve over time, scores not included in the
153+table below should generally not be considered directly comparable to
154+these most recent results.
155+
156+Table 1: Production Benchmarks with Challenging Prompts (higher is better)
157+
158+Category
159+
160+Note (compared to previous system cards): to deduplicate overlaps
161+between our previous “hate” and “harassment” categories, we are merging
162+“harassment” and “hate” into a single evaluation. Additionally, we have
163+renamed our previous “violence” category to “gore” 1 in
164+order to more clearly distinguish it from requests related to illicit
165+violent behavior; this is a naming change, not a change in the
166+underlying evaluation.
167+
168+We find that the GPT-5.6 series performs similarly to previous
169+thinking models, with the exception of gore. On ChatGPT, for users we
170+believe may be under 18, we apply additional age-appropriate content
171+protections that further restrict sexual content and exposure to gore.
172+You can read more about these safeguards and our
173+approach to Age Prediction .
174+
175+header]:mb-2xs" data-section data-section-slug="forecasting-disallowed-content-changes-with-deployment-simulation" data-section-anchor="forecasting-disallowed-content-changes-with-deployment-simulation" data-section-id="sec-4-1-2"> :first-child]:mt-0">
176+
177+Building on evaluations in the GPT-5.4
178+Thinking and GPT-5.5
179+system cards, we simulate model deployment before release by leveraging
180+approximately representative production prompts. While estimates in
181+these prior system cards were experimental, we have since more
182+thoroughly validated this approach in our recent
183+research . In light of this, we are updating how we report results in
184+this section. We are still expanding the rollout of this technique, and
185+for the scope of this system card we evaluated GPT-5.6 Sol only. In
186+accordance with our privacy policy, we only analyzed ChatGPT traffic
187+from users who allow their data to be used for model improvements. We
188+additionally exclude multi-modal conversations. We sample uniformly
189+among remaining conversations.
190+
191+Before the release of the model, we leverage past ChatGPT production
192+GPT-5.5 conversations to simulate the deployment of GPT-5.6 Sol by
193+resampling the final assistant turn with the new model. We then
194+automatically label the resulting resampled completions for disallowed
195+content. These labels may be limited in their precision especially for
196+low prevalence behaviors, but can still provide valuable directional
197+signal.
198+
199+In the figure below, we report the forecasted prevalence of unsafe
200+model-level outputs. For example, based on the observed distribution of