OpenAI releases GPT-Rosalind-6 under trusted access: same weights, looser biology refusals, cyber still rated Critical

A refusal boundary that moves without retraining

The addendum states that GPT-Rosalind-6 uses the same weights as GPT-6 Astra and that no training data was added and no additional post-training was performed for the release. The difference between the two models therefore lies in the operational boundary of how far the model answers dual-use biology questions and in the distribution condition of who receives it, rather than in the weights. The model is designed to be more useful for legitimate advanced research while still refusing requests that would meaningfully enable severe biological weaponisation.

The arrangement amounts to a two-tier release of a single capability: conservative refusals for the public, looser ones for vetted researchers. Separating the capability assessment from the vetting of recipients resembles end-user screening in export controls. Holding capability fixed and managing risk through access design has now been set out as one template for handling dual-use frontier AI.

The basis for the High rating and the unmet Critical thresholds

In the capability evaluations the model exceeded the indicative High thresholds on three of four evaluations after adjusting for refusals. On the troubleshooting benchmark it answered 491 of 832 items, far above the indicative 36.4%. On biorisk knowledge it scored 78.3% against an 80% threshold, rising to 85.0% after refusal adjustment. Against GPT-Rosalind-5.5, MedChemBench v7 rose from 28.9% to 49.6%, GeneBench Pro v13 from 16.7% to 37.7% and LifeSciBench Gold from 44.0% to 61.3%.

None of the four Critical-level evaluations, covering AAV capsid design, SHP2, coronavirus–ACE2 binding and phage–plasmid prediction, met its indicative threshold, so OpenAI placed the launch at High, below Critical. In cybersecurity the model inherits GPT-6 Astra's Critical rating and retains that model's standard safeguards including real-time blocking. Task success under historical jailbreak attacks was 14.3%, close to Astra's 15.7%.

Conditions of use: vetting, least privilege and human review

Vetting checks for a legitimate life-sciences or related mission, a credible use case, appropriate research and operational governance, and the ability to control access safely. Non-government applicants undergo business verification and compliance screening. For government entities a separate trusted-access pathway covers approved biosecurity, biosafety, public-health preparedness and biodefense work. The addendum says the release does not broaden eligibility beyond prior announcements such as the Rosalind Academic Plan.

Approved customers must restrict access to authorised users with a legitimate need, apply least-privilege controls, onboarding and insider-risk controls, and apply qualified human review before outputs inform experiments, publications or consequential decisions. They also need processes to remove access when a user no longer needs it, and OpenAI can restrict or revoke access for misuse. Pricing and customer names do not appear in the addendum; the prices and pharmaceutical partners cited in some coverage remain unconfirmed.

Questions for evaluators and regulators

The release shows frontier safety frameworks shifting their weight from whether to train and publish toward the conditions and auditing of distribution. Because the same weights carry a cyber capability rated Critical, the model handed to biologists also carries top-tier cyber capability, so the effectiveness of vetting, insider-risk management and revocation now matter as much as the capability assessment itself. The evaluations rest on internal metrics without published third-party replication, so the scope of verification by the US and UK evaluation bodies is the next question.