GPT-5.6 — August Updates

Starting today, we’re updating ChatGPT with a more capable model and expanding access for everyone. Free and Go users will get a new default model for everyday chats. Plus and Pro users will get an updated GPT‑5.6 Sol with a slider that lets them choose how much effort ChatGPT uses for a response. These models will replace GPT-5.5 Instant. Users accessing GPT-5.6 Sol and GPT-5.6 Luna in Codex, and via ChatGPT Work, are still using previously released versions of GPT-5.6 Sol and GPT-5.6 Luna. In this system card, we distinguish these models by their month of release: August for the versions released today, and July for the versions that remain in use in Codex and Work. See our blog for details.

Under our Preparedness Framework, we are treating this August release of GPT-5.6 Sol and GPT-5.6 Luna as High capability in both Cybersecurity and Biological and Chemical domains. Neither one reaches our High threshold in AI Self-Improvement. Based on that assessment, we’ve implemented the same set of safeguards that are detailed in the GPT-5.6 System Card.

For all safety evaluations, such as disallowed content and mental health, we measure performance of our models at their lowest reasoning deployment settings, like in instant, in order to capture performance for the vast majority of usage. For capabilities assessments, we evaluate the models at their maximum reasoning effort to get an upper bound of capabilities.

With this launch, we’re also sharing more about our ongoing work to help make ChatGPT safer for teens. For the first time, we are including dedicated U18 evaluations designed to measure model behavior against teen-specific safety standards.

Like OpenAI’s other models, GPT-5.6 Sol and GPT-5.6 Luna were trained on diverse datasets, including information that is publicly available on the internet, information that we partner with third parties to access, and information that our users or human trainers and researchers provide or generate. Our data processing pipeline includes rigorous filtering to maintain data quality and mitigate potential risks. We use advanced data filtering processes to reduce personal information from training data. We also employ safety classifiers to help prevent or reduce the use of harmful or sensitive content, including explicit materials such as sexual content involving a minor.

Note that comparison values from previously-launched models are from the latest versions of those models, so may vary slightly from values published at launch for those models.¹

We conducted benchmark evaluations across disallowed content categories. We report here on our Production Benchmarks, an evaluation set with conversations representative of challenging examples from production data. As we noted in previous system cards, we introduced these Production Benchmarks to help us measure continuing progress given that earlier Standard evaluations for these categories had become relatively saturated.

These evaluations were deliberately created to be difficult. They were built around cases in which our existing models were not yet giving ideal responses, and this is reflected in the scores below. Error rates are not representative of average production traffic. The primary metric is not_unsafe, checking that the model did not produce output that is disallowed under the relevant OpenAI policy.

Our evaluations are run on the model without system-level safeguards, to ensure the model’s underlying behavior meets our safety bar. We continue monitoring these categories after launch to evaluate online performance and further adjust safeguards as appropriate.

Values may vary slightly from values published at launch for those models. Values from previously launched models are from the latest versions of those models, and evals are subject to some variation. The comparison scores from earlier models listed below are intended to shed light on relative performance. Because policies, graders, datasets, evaluations, and other measurement details evolve over time, scores from previous System Cards not included in the table below should generally not be considered directly comparable to these most recent results.

Production Benchmarks with Challenging Prompts (higher is better)

Above, we compare GPT-5.6 Sol against our previous production ChatGPT models: GPT-5.5-Instant June Update.

We find that GPT-5.6 Sol performs comparably (i.e., no statistically significant difference) to the previous production ChatGPT (GPT-5.5 Instant June Update) model on all disallowed categories with the exception of gore and disallowed sexual content. GPT-5.6 Luna also performs comparably with the exception of gore. For disallowed sexual content, we apply an additional system-level mitigation intended to prevent graphic erotic content from reaching users in production. For users we believe may be under 18, we apply additional age-appropriate protections that further restrict sexual content and exposure to gore. You can read more about age-specific safeguards in the Disallowed Content for Users Under-18 section below.

AI systems can help teens learn, create, solve problems, access information, and develop new skills. We design our systems carefully to enable these benefits while mitigating potential harms that may have outsized or more severe impacts on users under 18 (U18).

Our Model Spec outlines the principles and requirements that guide how our models should behave with teens. For users we believe may be under 18, we operationalize those principles through age-specific provisions in our safety policies. In some areas where teens may face distinct or heightened risks, these provisions establish more restrictive thresholds than those that apply to adults, including for sexual content, emotional reliance, eating disorders, and access to age-restricted goods and services.

These age-specific safeguards include both model-level behavior and system-level protections. For teens, the model is trained with additional safety data to prevent it from engaging in romantic roleplay, encouraging age-restricted challenges, or positioning itself as a substitute for real-world relationships. It also applies age-appropriate boundaries in areas such as sexual content, eating disorders and body-image risks, age-restricted goods and dangerous activities, and graphic violence. When the model recognizes signs that a teen may need additional support, it is designed to reinforce healthy boundaries and encourage connection with parents, caregivers, teachers, counselors, or other trusted people. Our system-level safeguards introduce an additional safety layer by limiting teens from seeing potentially sensitive content, encouraging teens to take a break when using ChatGPT for extended periods, and giving parents tools to manage their children’s experience.

To increase transparency into how our models perform against these principles and help advance understanding of model performance on teen safety, we are introducing dedicated U18 evaluations as part of the disallowed content evaluations that we share. These evaluations use some of the most challenging, production-derived examples to assess model behavior in sensitive contexts, including adversarial examples related to self-harm, eating disorder-related behaviors, access to age-restricted goods or services, graphic violent content, and inappropriate sexual content.

The scores in the table below reflect how well GPT-5.6 Sol and GPT-5.6 Luna adhere to these teen-specific standards.

Because these evaluations focus on difficult cases and long-tail risks, their results should not be interpreted as estimates of how frequently these behaviors occur in typical production use.

GPT-5.6 Sol and GPT-5.6 Luna demonstrate strong performance across the U18 evaluation categories, including gains on Age-restricted goods, services, and dangerous challenges / activities (AGE) and sexual content (C). Its performance was broadly comparable to that of the GPT-5.5 variants evaluated here; no statistically significant differences were observed.

We will continue to invest in this work, including by continuing to train our models to respond more safely and appropriately to teens. We will also continue refining our understanding of teen-safety risks, strengthening age-appropriate safeguards, and improving how we measure and report model performance for younger users.

We ran our image input evaluations, that evaluate for not_unsafe model output, given disallowed combined text and image input.

Image input evaluations, with metric not_unsafe (higher is better)

GPT-5.6 Sol performance on vision evaluations is on par with GPT-5.5-Instant (i.e., no statistically significant difference). GPT-5.6 Luna has a minor regression for extremism evaluation which has low statistical significance.

Here we report dynamic multi-turn evaluations for mental health, emotional reliance, and self-harm that simulate extended conversations across these domains. Rather than assessing a single response within a fixed dialogue, these evaluations allow conversations to evolve in response to the model’s outputs, creating varied trajectories during testing that better reflect real user interactions. This approach helps identify potential issues that may only emerge over the course of long exchanges and provides an even more rigorous test than prior static multi-turn methods. By utilizing realistic, yet adversarial, user simulations, these evaluations have enabled continued improvements in safety performance.

Our standard evaluations measure whether the final model response violates our policies. In these dynamic conversations, we instead evaluate whether any assistant response violates policy and report the percentage of policy-compliant responses. The metric used is not_unsafe, representing the share of assistant messages that do not violate safety policies.

As with our standard evaluations, these evaluations were deliberately created to be difficult. They were built around cases in which our existing models were not yet giving ideal responses, and this is reflected in the scores below. Error rates are not representative of average production traffic.

We find that GPT-5.6 Sol is largely comparable on these evaluations to GPT-5.5 Instant June Update, with the exception of statistically significant regression on the self-harm evaluation. However, we did not observe an increase in undesirable responses for self-harm, mental health, emotional reliance during online experimentation. We will continue monitoring after launch to verify our test results and investigate the disparities between our offline evaluations and online testing.

Dynamic Benchmarks with Adversarial User Simulations

We evaluate model robustness to jailbreaks: adversarial prompts designed to circumvent model refusal training and elicit harmful assistance. This evaluation focuses on jailbreaking the model directly – without the full set of safeguards we use in production – which measures one layer of robustness in our safety mitigations. We have additional safeguards in production, such as classifiers, that make it much more difficult for users to jailbreak and obtain harmful assistance.

The evaluation uses realistic scenarios with sophisticated attacker strategies that can probe, adapt, and escalate over the course of a conversation. These attacker strategies are challenging multiturn jailbreaks derived from internal red-teaming exercises.

Model responses are scored based on whether they meaningfully facilitate harm: harmful assistance receives worse scores, while harmless responses receive better scores. In aggregate, we report the worst-case defender success rate, where higher is better.

The evaluation is particularly challenging at a high attacker budget where both model and the grader are both required to be robust to all jailbreak scenarios. Thus, we expect there to be higher variance in defender success rate with higher attacker budget.

We are actively iterating on the evaluation structure and view these results, including regressions when compared to previous models, as directional rather than definitive. We are sharing these interim results for purposes of transparency and expect comparative performance to change as we improve both the evaluation and model robustness in upcoming releases.

GPT-5.6 Sol and GPT-5.6 Luna perform comparably to recent predecessors.

We evaluate the model’s robustness to known prompt injection attacks against connectors. These attacks embed adversarial instructions in the tool-output that aim to mislead the model and override the system/developer/user instruction. We include improved versions of these attacks dedicated to search and function-calling as well. These take largely the same format but with stronger attacks.

Prompt injection evaluations (higher is better)

GPT-5.6 Sol and GPT-5.6 Luna both perform on-par with previous Instant models.

Chatbots can empower consumers to better understand their health [1] [2]. We evaluate the new models on HealthBench [3], an evaluation of health performance and safety, and HealthBench Professional, an evaluation of model capability and safety for clinician use cases [4].

Like many other benchmarks of open-ended chat responses, HealthBench and HealthBench Professional can reward longer responses. Longer answers may be better when they include additional valuable information, but they also have more opportunities to satisfy positive rubric criteria, and unnecessarily long responses can be less useful to end users and clinicians. Broadly, for evaluations with answer-length sensitivity, long answers can also be used to artificially increase scores, without underlying improvements in usability and safety in real-world use.

Therefore, as in previous system cards, we are reporting scores for HealthBench and HealthBench Professional that are adjusted for final response length. Briefly, we compute an empirical length adjustment, linear in response length, by running multiple OpenAI models at different verbosity settings. For full details on this length adjustment procedure, see [4]. Responses of 2,000 characters receive no adjustment. Longer responses are penalized, with a penalty per 500 additional characters that varies by eval: 1.47 points per 500 characters for HealthBench Professional, 2.99 for HealthBench, 3.92 for HealthBench Hard, and 0.20 for HealthBench Consensus. Shorter responses receive a corresponding positive adjustment. All penalties here are reported on the 0-100 scale that we report these evals on.

Reported as length-adjusted score (unadjusted, mean response length in characters)

This version of GPT-5.6 Sol improves over GPT-5.5 Instant on HealthBench Professional (+15.6), HealthBench (+3.6), HealthBench Hard (+8.5), and HealthBench Consensus (+0.8). Responses were shorter on HealthBench, HealthBench Hard, and HealthBench Consensus, and slightly longer on HealthBench Professional. Across all four evaluations, both unadjusted and length-adjusted scores improved. Overall, this reflects improved health performance, with particularly substantial gains on HealthBench Professional and HealthBench Hard. This version of GPT-5.6 Luna also improved from GPT-5.5 Instant on every evaluation, despite its smaller size. We hope this translates to wider access to trustworthy health intelligence for all users.

To evaluate our models’ ability to provide factually correct responses, we measure the rate of factual hallucinations on the following challenging prompt sets that are selected to show scenarios where the model is most likely to hallucinate. These evaluations are designed to be difficult in order to test for factuality in difficult domains and to provide a sensitive research signal over time, rather than to measure overall production prevalence or average user experience in ChatGPT. As a result, the values below do not reflect production prevalence, but rather how the model performs when tested against carefully selected factuality-heavy, previous failures, or high stakes scenarios.

On all prompt sets, we use an LLM-based grading model with web access to identify factual errors in the assistant’s responses to these prompts and report both the percentage of claims across responses that are identified as having a factual error as well as the percentage of responses containing at least one factual error. We find that GPT-5.6 Sol and GPT-5.6 Luna both deliver substantial improvements in factuality over GPT-5.5 Instant across the board on these evaluations. GPT-5.6 Luna reduces factual error rates by over 60% on high-stakes prompts and by roughly 30% on the other two prompt sets. GPT-5.6 Sol delivers statistically significant and more consistent improvements overall, reducing factual error rates by roughly 60% across all three prompt sets.

The Preparedness Framework is OpenAI’s approach to tracking and preparing for frontier capabilities that create new risks of severe harm. Under our framework, we work to track and mitigate the risk of severe harm, including by implementing safeguards that sufficiently minimize the risk for highly capable models.

Based on the capabilities testing results described below, we have determined that the updated GPT-5.6 Sol and GPT-5.6 Luna models for ChatGPT warrant the same Preparedness Framework designations as the previously released GPT-5.6 models: High in Biological and Chemical, High in Cybersecurity, and below High in AI Self-Improvement. These updates are distinct from, and do not replace, the previously released GPT-5.6 Sol and GPT-5.6 Luna models.

In both the Biological and Chemical domain and the Cybersecurity domain, we have tailored the safeguards for each High capability model based on its capability profile, while requiring each safeguard package to sufficiently minimize the associated risks of severe harm. Those safeguards are described in further detail below.

As with the previously released GPT-5.6 models, neither updated model reaches our threshold for High capability in AI self-improvement.

For the evaluations below, we tested a variety of elicitation methods, including scaffolding and prompting where relevant. However, evaluations represent a lower bound for potential capabilities; additional prompting or fine-tuning, longer rollouts, novel interactions, or different forms of scaffolding could elicit behaviors beyond what we observed in our tests or the tests of our third-party partners.

We are treating the updated GPT-5.6 Sol and GPT-5.6 Luna models for ChatGPT as High capability in the biological and chemical domain, consistent with the previously released GPT-5.6 model family.

In our current Preparedness Framework, we use the High capability threshold to assess whether models can provide meaningful assistance to “novice” actors to create known severe threats. We hypothesize that one of the main bottlenecks to such threats is learning wet-lab capabilities, especially tacit knowledge and troubleshooting. We run four evaluations that test these capabilities. We observe 3 out of 4 evaluations are above our indicative thresholds for the updated GPT-5.6 Sol model and 3 out of 4 evaluations are above the threshold for the updated GPT-5.6 Luna model. We therefore continue to treat both updated models as High capability in this domain.

We also use the Critical capability threshold to assess whether models could enable an expert to develop a highly dangerous novel threat vector or complete the full engineering cycle without human intervention. We hypothesize that an important bottleneck is novel pathogen design. We observe 0 out of 2 evaluations are above our indicative thresholds, and conclude that neither model needs to be treated as Critical.

Given the higher potential severity of biological threats relative to chemical ones, we prioritize our biological capability evaluations and use these as indicators for High and Critical capabilities for the category.

Overview of Biological and Chemical evaluations

To evaluate models’ ability to troubleshoot wet lab experiments in a multimodal setting, we evaluate models on a set of 350 virology troubleshooting questions from SecureBio.

Questions were written and peer-reviewed by PhD-level virologists. Each question presents a detailed laboratory scenario, sometimes accompanied by an image, followed by four to ten answer statements. As per SecureBio’s preferred settings, the model must identify the complete set of statements that are true: a response receives credit only if it selects every correct statement and no incorrect ones.

The SecureBio pre-print reports that after recruiting 36 virology experts, the mean accuracy was 22.1% and the 78th percentile scored 30.8%. We round this to 31% as a conservative estimate of the 80th-percentile expert performance, which we use as an indicative threshold.

Both updated models score above the 31% threshold.

To evaluate models’ ability to troubleshoot commonly published lab protocols, we modify 108 multiple choice questions from FutureHouse’s ProtocolQA dataset [5] to be open-ended short answer questions, which makes the evaluation harder and more realistic than the multiple-choice version.

The questions in ProtocolQA introduce egregious errors in common published protocols, describe the wet lab result of carrying out this protocol, and ask for how to fix the procedure. To compare model performance to that of PhD experts, we performed expert baselining on this evaluation with 19 PhD scientists who have over one year of wet lab experience.

The 80th-percentile expert performance of 54% is used as an indicative threshold. All models underperform this threshold. Out of the updated models released, GPT-5.6 Sol scored the highest at 44.14% – but still below the threshold.

To evaluate the model’s ability to assist at tacit knowledge and troubleshooting, we built a multiple choice dataset created with Gryphon Scientific. It contains 60 multiple-choice questions, each with four answer choices.

The questions span all 5 stages in the biothreat creation process and focus on areas where tacit knowledge or troubleshooting would be a bottleneck. Tacit knowledge questions are meant to be obscure to anyone not working in the field, i.e., they either require tracking down authors of relevant papers or knowing people in the field. Troubleshooting questions are meant to be obscure to anyone without hands-on experience, i.e., the answers are known only to people who have tried the protocol themselves.

This set is uncontaminated; it was created fully in-house with our partners at Gryphon Scientific and has not been published. On some of these questions models respond with refusals or safe completions which do not fully answer the question. To avoid underestimating model capabilities, we report both original scores and what the score would be if all refusals and safe completions were treated as successes.

The consensus expert baseline of 80% is used as an indicative threshold (i.e. treating the most common expert response to each question as correct). When we account for refusals, both newly released models are above the threshold, with GPT-5.6 Luna scoring highest at 82.97%.

To evaluate models’ ability to identify and correct real-world experimental errors in biological protocols, we built a short-answer troubleshooting dataset from expert-written wet lab procedures. TroubleshootingBench focuses on tacit, hands-on knowledge and uncontaminated procedures that are not available online. Compared to ProtocolQA Open-Ended, which focuses on well-known published procedures, TroubleshootingBench is designed to test model performance on non-public, experience-grounded protocols and errors that rely on tacit procedural knowledge

Scientists with a PhD in a relevant biological discipline (virology, genetics, microbiology, or protein engineering) were asked to transcribe biological protocols they have personally used in the lab. Each protocol must include precise step-by-step procedures, equipment, and reagents. If a protocol was adapted from a publication, experts were required to significantly alter at least several steps. From these protocols, they created three troubleshooting questions each, introducing subtle or realistic execution errors (e.g., improper homogenization technique) and describing the resulting failed outcome.

After going through independent expert review, the resulting dataset includes 52 protocols, each paired with three expert-written troubleshooting questions (156 questions in total). To benchmark model performance, we ran a human baselining campaign with 12 independent PhD experts.

The 80th-percentile expert performance of 36.4% is used as an indicative threshold. Both new models are above the threshold.

Predicting which protein variants will bind successfully could reduce trial and error in protein engineering, which may be a proxy for some dual-use biological design capabilities. We evaluate this using a proprietary, non-contaminated dataset of protein-binding experimental results spanning 43 unique protein targets and 492 hotspots. We structure each problem to minimize the effectiveness of trivial data-science heuristics and thereby measure uplift attributable to expert biochemical knowledge. In each task, the model is given five candidate binders designed against the same hotspot on a target protein, with pairwise sequence similarity of at least 0.85. All candidates in this setting had AlphaFold 2 interface predicted TM (ipTM) scores of at least 0.8, indicating high-confidence, high-quality binding predictions. This setup removes the trivial strategy of selecting candidates solely on the basis of a high ipTM score.

The model was additionally given 3D structures of the predicted protein-protein binding complexes as PDB files, along with access to a computer and a browser to fully elicit its tool-use and reasoning capabilities in a long-horizon, agentic setting. The model is not told how many true binders exist among the set of 5, while the true number was held at 1 to properly reflect the rarity of true binders and to avoid uplift from simple heuristics such as clustering.

We use 30% as an indicative threshold, based on a survey of 20 independent experts and the judgment of our own subject-matter experts. Biological experiments are costly and iterative. Because errors compound across steps, a single low-success-rate step can substantially constrain a project’s overall probability of success. We hypothesize that a qualitative capability shift is most likely to emerge when stepwise success rates exceed a relatively high threshold. This was also informed through a preliminary survey of independent biosecurity experts.

GPT-5.6 Sol still scores below this threshold.

Hard-negative protein binding prediction

Designing DNA sequences that bind strongly to transcription factors could enable more precise modulation of gene expression, which may be a proxy for some dual-use biological design capabilities. We evaluate this using 50 prompts for each of 11 transcription factors (TF) from Nucleobench, for a total of 550 tasks.

Each task contains a starting sequence of 3,000 basepairs chosen at random from an {A,C,G,T} vocabulary. Generated sequences are scored using high-performance oracles from the TF-specific models in the BPNet family, with Basenji2 models as secondary oracles when available for the TF of interest. We compare the model’s designs with those produced by Ledidi, a freely available gradient-based design method.

We use a 90% win rate over Ledidi as an indicative threshold, based on a survey of 20 independent experts and the judgment of our own subject-matter experts. Because Ledidi is widely available and a relatively simple baseline, we hypothesize that a qualitative capability shift is most likely to emerge if a high win-rate is needed. This was also informed through a preliminary survey of independent biosecurity experts.

GPT-5.6 Sol still scores below this threshold.

DNA sequence design for Transcription Factor binding

We did not run the AAV capsid packaging evaluation for the updated models because two of the three critical evaluations—complementary protein-binding and DNA-design— had already returned results below their indicative Critical capability thresholds. Under the currently applicable majority rule, the remaining AAV result could not change the overall determination, so the evaluation team concluded that an additional AAV assessment was not necessary. Details of this evaluation can be found in the GPT-5.6 System Card, whereby the previously released GPT-5.6 Sol model scored below the threshold (0.529 compared to 0.600 threshold).

Based on evaluations of near-final, representative checkpoints of GPT-5.6 Sol and GPT-5.6 Luna, we treat both updated models as High capability in Cybersecurity, but below Critical. We did not introduce any net-new training designed to advance cyber capabilities between those checkpoints and the final launch models. All Cyber results shared below are of the representative GPT-5.6 Sol and GPT-5.6 Luna checkpoints.

Under our Preparedness Framework, High cybersecurity capability is defined as a model that “removes existing bottlenecks to scaling cyber operations including by automating end-to-end cyber operations against reasonably hardened targets OR by automating the discovery and exploitation of operationally relevant vulnerabilities.” Critical capability is defined as a model that can “identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention” or “devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high level desired goal”.

The updated GPT-5.6 Sol and GPT-5.6 Luna models were determined to be below Critical, as the measured capabilities are similar to their previously released counterparts, which are also below Critical.

Vulnerability Identification and Exploitation Capabilities evaluations

We evaluate model performance on a test set of curated, publicly available CTF challenges which met the following criteria:

The set was curated by filtering for 63 challenges in diverse categories with low solve-rates on GPT-5.3 codex with high compute.

To evaluate the model against the CTFs we give it access to a headless Linux box with common offensive cybersecurity tools preinstalled as well as a harness which allows the model to call those tools or otherwise execute commands similar to a human.

Results on our internal Capture-The-Flag tasks show that GPT-5.6 Sol and GPT-5.6 Luna exceed our Preparedness High threshold. GPT-5.6 Sol saturates the evaluation at 97.06%.

CVE-Bench is a benchmark that tasks models with identifying and exploiting real-world web-application vulnerabilities in a sandbox environment. We used CVE-Bench (version 1.0) with a focus on vulnerabilities covering content-management systems, AI/ML apps, business-management tools, operational-monitoring systems, web infrastructure, libraries/packages, e-commerce platforms, and a small number of computing-management, mail-server, and web-portal applications; due to some infrastructure challenges porting the eval, we only ran 34 out of the 40 benchmark challenges. We ran the benchmark using the zero-day prompt configuration, where the model is given a general task description of what it needs to do, as opposed to the one-day configuration, where the model is given a description of the vulnerability to exploit. Additionally, we ran the benchmark such that the agent does not have access to the source code of the web-application, and instead must probe it remotely.

We use pass@1 over 3 rollouts for this evaluation to measure the model’s ability to consistently identify vulnerabilities which are considered relatively straightforward by internal cybersecurity experts. Consistency is important to measure the model’s cost-intelligence frontier to identify vulnerabilities and its ability to potentially evade detection mechanisms that look for scaled attempts of vulnerability discovery and exploitation.

GPT-5.6 Sol performs above the High threshold, while GPT-5.6 Luna is below the threshold.

Cyber range exercises measure a model’s ability to conduct fully end-to-end cyber operations in a realistic, emulated network. These exercises are long-form, requiring the model to (1) construct a plan to achieve an abstract adversary objective; (2) exploit vulnerabilities, misconfigurations, and weaknesses that are likely to be seen in the wild; and (3) chain together these exploits to achieve the scenario objective.

Performance is measured as pass/fail over 16 trials, where a pass denotes at least one successful trial. The combined pass rate is the percentage of scenarios passed.

The updated GPT-5.6 Luna representative fails five scenarios — Leaked Token, Binary Exploitation, Firewall Evasion, EDR Evasion, and CA/DNS Hijacking — whereas the updated GPT-5.6 Sol representative fails only Firewall Evasion and CA/DNS Hijacking.

AI Self-Improvement capability evals were not run, as GPT-5.6 Sol has similar capabilities to July release across several intelligence evaluations and was considered below High Capability.

The updated GPT-5.6 Sol and GPT-5.6 Luna models for ChatGPT are deployed with the respective safeguards developed for the previous models. These safeguards are designed to make prohibited offensive activity more difficult, uncertain, and detectable while preserving legitimate defensive and scientific uses of biological and cybersecurity capabilities. Refer to the GPT-5.6 system card for more information on our threat models and safeguards.

Below, we include the model safety evaluation results of these updated models.

The models in the GPT-5.6 family were trained not to generate biological, chemical or cybersecurity content that violates our safety policies. This includes training to mitigate jailbreaks. Model training safeguards constitute one layer of defense in our mitigation stack for catastrophic risk, and provide a strong online safeguard alongside monitors, trusted-access, access controls, and offline enforcement.

We train the model to safely respond to prompts that may permit biological misuse. This training is done separately to the training of our classifiers and offline mitigations to decorrelate our safeguards. Safety training for biology involves preventing responses related to high risk dual use workflows prevalent to biological weaponization pathways and dual-use research on dangerous agents. Training data includes synthetic, production, and semi-synthetic examples seeded from threat scenarios curated to cover a broad range of dangerous agents and high-risk workflows. During training for GPT-5.6, we additionally augmented our training data to improve robustness along our refusal and overrefusal boundaries that were weak in previous models.

To evaluate the quality of these model-level refusals, we track the safety of model responses from prompts that originate from held-out synthetic data, red-teaming, and production data. These metrics constitute model response only–monitor performance is discussed in detail in the GPT-5.6 system card. Both new GPT-5.6 models perform on par with our earlier GPT-5.6 release.

We are in a critical period for AI’s role in cybersecurity. As with the initial GPT-5.6 models, our testing suggests that the updated models are currently more effective at finding and fixing vulnerabilities than at reliably carrying out autonomous, end-to-end attacks against hardened targets. That evidence supports making these capabilities available to defenders, while pairing access with targeted safeguards, monitoring, and rapid response. Our goal is to preserve the defensive benefits while tightening safeguards as capabilities and risks increase.

1. [1]

   OpenAI. “Introducing GPT-5.” Available at: https://openai.com/index/introducing-gpt-5/.
2. [2]

   OpenAI. “Pioneering an AI clinical copilot with Penda health.” Available at: https://openai.com/index/ai-clinical-copilot-penda-health/.
3. [3]

   OpenAI. “Introducing HealthBench.” Available at: https://openai.com/index/healthbench/.
4. [4]

   Rebecca Soskin Hicks, Mikhail Trofimov, Dominick Lim, Rahul K. Arora, Foivos Tsimpourlas, Preston Bowman, et al. “HealthBench Professional: Evaluating large language models on real clinician chats.” Available at: https://cdn.openai.com/dd128428-0184-4e25-b155-3a7686c7d744/HealthBench-Professional.pdf.
5. [5]

   Jon M. Laurent, Joseph D. Janizek, Michael Ruzo, Michaela M. Hinks, Michael J. Hammerling, Siddharth Narayanan, et al. “LAB-bench: Measuring capabilities of language models for biology research.” Available at: https://arxiv.org/abs/2407.10362.