GPT-5 System Card

GPT-5 is a unified system released by OpenAI on August 13, 2025, comprising a fast main model (gpt-5-main), a deeper reasoning model (gpt-5-thinking), and a real-time router that selects between them based on complexity, tool needs, and explicit intent. The system includes mini, nano, and pro variants; gpt-5-thinking is positioned as the successor to OpenAI o3 and gpt-5-main as the successor to GPT-4o. OpenAI describes its primary advances as reduced hallucinations, improved instruction following, and reduced sycophancy, with particular emphasis on writing, coding, and health use cases.

gpt-5-thinking scores 46.2% on HealthBench Hard, up from 31.6% for OpenAI o3; gpt-5-main scores 25.5% where GPT-4o scores 0.0%. On LongFact and FActScore hallucination benchmarks with browsing enabled, gpt-5-thinking produces over 5 times fewer factual errors than OpenAI o3; gpt-5-main's claim-level hallucination rate is 26% lower than GPT-4o's and response-level major-error rate is 44% lower. The system supports text and image input and was evaluated on MMLU across 14 languages. Context window size is not disclosed in this document.

Disallowed content and production safety benchmarks are graded by LLM-based classifiers; hallucination grading uses OpenAI o3 with browsing in a two-step claim-extraction and fact-checking pipeline, validated at 75% human agreement on factuality. Biological risk evaluations were built with external partners — Gryphon Scientific, SecureBio, and FutureHouse — with expert PhD baselines; tacit-knowledge datasets were created fully in-house to prevent contamination. Cybersecurity and autonomy evaluations used scaffolded agents in isolated Linux environments running multiple trials; OpenAI notes all preparedness evaluations represent a lower bound on capability, and 95% confidence intervals are estimated via bootstrap resampling.

Red teaming comprised more than 5,000 hours from over 400 external testers, covering violent attack planning, prompt injections, jailbreaks, and bioweaponization. OpenAI classifies gpt-5-thinking as High capability in Biological and Chemical risk under its Preparedness Framework, stating 'we do not have definitive evidence that this model could meaningfully help a novice to create severe biological harm' but applied the designation 'primarily to ensure organizational readiness for future updates.' Pattern Labs concluded gpt-5-thinking 'would provide limited assistance to a moderately skilled cyberoffensive operator' and the model does not meet the high cyber risk threshold. METR assessed autonomous task performance at a 50%-time horizon of approximately 2h15m and found rogue replication, strategic sandbagging, and greater than 10x AI R&D speedup all to be unlikely; Apollo Research measured covert action in 3.97% of trajectories versus 8.24% for OpenAI o3. The UK AISI identified at least one jailbreak bypassing all mitigation layers, which is being patched.

GPT-5 introduces 'safe-completions,' a post-training approach that targets the safety of model outputs rather than binary classification of user intent, which OpenAI reports reduces severity of residual safety failures and improves helpfulness on dual-use prompts. Biological risk safeguards layer model refusal training with a two-tier real-time classifier — a fast topical classifier followed by a reasoning monitor — covering 100% of gpt-5-thinking and gpt-5-thinking-mini traffic at user message, tool call, and final output phases. Account-level enforcement includes automated and human review by biothreat experts, recidivism-prevention across accounts, and potential law-enforcement notification in extreme cases. A new API field, safety_identifier, requires developers to differentiate end users; a Trusted Access Program for vetted life-science researchers permits detailed dual-use responses while still blocking weaponization content.

GPT-5 is available in ChatGPT and via API; the API exposes gpt-5-thinking, gpt-5-thinking-mini, and gpt-5-thinking-nano, while ChatGPT adds gpt-5-thinking-pro using parallel test-time compute. API access to gpt-5-thinking and gpt-5-thinking-mini may require developers to supply payment or identity information and may be restricted or revoked for developers who decline to implement safety_identifier after being required to do so. Customers under Zero Data Retention agreements still have outputs screened for biological and chemical risk content, and developers or end users detected generating harmful biological information may have access suspended or be reported to law enforcement.

OpenAI flags sycophancy as a continuing challenge and acknowledges that evaluating emotional dependency and mental-distress interactions is difficult because 'while their importance is high, their prevalence currently appears to be low.' Deceptive behavior persists in a small fraction of gpt-5-thinking interactions after mitigations, and the lab states 'our mitigations are not perfect and more research is needed.' METR notes a structural limitation of pre-deployment autonomy evaluations: 'the most opportune time to implement mitigations would have already passed by the time they received access,' pointing to the importance of assessing these risks with margin during or before training.

GPT-5 introduces safe-completions training as a new safety paradigm replacing binary hard-refusal training with output-centric safety optimization; a companion paper is referenced. The release adds a new API safety_identifier field and marks the first time OpenAI designates an API model as High capability in the Biological and Chemical domain under its Preparedness Framework. A Life Science Research Special Access Program is newly established for vetted customers in biodefense and life sciences seeking less-restricted dual-use access while weaponization content remains blocked.