SafetyPage

Lab system cards and frameworks · System card · OpenAI

Addendum to GPT-6 Astra System Card: GPT-6.1 Sol

29 Sep 2026

Read at deploymentsafety.openai.com ↗Read at sourceAll rights reserved

Outline · 262 paragraphs

  1. Addendum to GPT-6 Astra System Card: GPT-6.1 Sol¶2
  2. 1. Introduction¶3
  3. 2. Model Data and Training¶8
  4. 3. Model Safety¶14
  5. 3.1 Safe Completions¶16
  6. 3.1.1 Evaluations with Challenging Prompts¶17
  7. Table 1: Production Benchmarks with Challenging Prompts (higher is better)¶20
  8. Figure 1¶22
  9. 3.1.2 Safe Completions for Users Under 18¶24
  10. Table 2: U18 evaluations (higher is better)¶25
  11. 3.1.3 Agentic Safe Completions¶27
  12. Table 3: Agentic Safe Completions (higher is better)¶28
  13. 3.2 Vision¶30
  14. Table 4: Image input evaluations, with metric safe completion (higher is better)¶31
  15. 4. Robustness¶33
  16. 4.1 Jailbreaks¶34
  17. Table 5: Static Jailbreak Evaluations¶38
  18. Figure 2¶40
  19. 4.2 Prompt Injection¶43
  20. Figure 3¶47
  21. Table 6: Defender success rate averaged per defender query on instruction hierarchy attacks (higher is better).¶49
  22. 5. Health¶50
  23. 5.1 HealthBench¶52
  24. Table 7: HealthBench Evaluations - reported as length-adjusted score (unadjusted, mean response length in characters). Higher is better.¶54
  25. 5.2 Dynamic Mental Health Benchmarks with Adversarial User Simulations¶57
  26. Table 8: Dynamic Benchmarks with Adversarial User Simulations (higher is better)¶61
  27. 5.3 MentalHealthBench¶63
  28. Table 9: MentalHealthBench¶67
  29. Figure 4¶69
  30. 6. Hallucinations¶71
  31. 6.1 Performance in Cases Flagged by Users¶72
  32. Figure 5¶75
  33. 7. Alignment¶77
  34. 7.1 Respecting Auto-Review¶79
  35. Figure 6¶80
  36. 7.2 Respecting Warnings¶83
  37. Figure 7¶84
  38. 7.3 Declining to Exploit a Honeypot During Difficult ExploitGym Problems¶88
  39. Figure 8¶89
  40. 7.4 Avoiding Deceptive Interactions with Users¶92
  41. 7.4.1 Coding Deception¶93
  42. Figure 9¶94
  43. 7.4.2 Broken Search Tool¶97
  44. Figure 10¶98
  45. 7.5 Avoiding Misaligned Behavior in Realistic Work Environments¶101
  46. Figure 11¶104
  47. Figure 12¶106
  48. 7.5.1 Unintended Engagement with External Agent Messages¶108
  49. Figure 13¶111
  50. 7.6 Forecasting Misaligned Behavior with Deployment Simulation of Internal Codex Traffic¶114
  51. Figure 14¶117
  52. Figure 15¶120
  53. Figure 16¶123
  54. Figure 17¶127
  55. 8. Monitorability¶129
  56. 8.1 Monitorability Under Adversarial Conditions¶130
  57. 8.1.1 CoT Controllability¶131
  58. Figure 18¶133
  59. Figure 19¶135
  60. Figure 20¶137
  61. Table 10: Selected CoT excerpts from GPT‑5.6 Sol, GPT‑6 Sol, GPT‑6 Astra, and GPT-6.1 Sol for the same problem and control instruction. GPT‑5.6 Sol discusses how to obey the alternating-case constraint but violates it. Like GPT‑6 Sol and GPT‑6 Astra, GPT‑6.1 Sol performs the calculation in alternati¶139
  62. Table 11: Selected CoT excerpts from GPT‑5.6 Sol, GPT‑6 Sol, GPT‑6 Astra, and GPT-6.1 Sol for the same problem and control instruction. GPT‑5.6 Sol and GPT‑6 Sol continue reasoning about the question despite instructions to think about something else. GPT‑6 Sol explicitly recognizes this violation n¶141
  63. 8.1.2 Monitor Evasion¶143
  64. Figure 21¶149
  65. Figure 22¶151
  66. 8.1.2.1 Awareness of CoT Monitoring Reduces Monitorability¶153
  67. Figure 23¶157
  68. Figure 24¶159
  69. 8.1.2.2 Math Side-tasking Monitor Evasion¶161
  70. Figure 25¶165
  71. Figure 26¶167
  72. 9. Preparedness¶169
  73. 9.1 Capabilities Assessment¶172
  74. 9.1.1 Biological and Chemical Capabilities¶173
  75. 9.1.1.1 Capability Threshold: High¶176
  76. Table 12: Biological capability evaluations: High threshold¶177
  77. Figure 27¶181
  78. Figure 28¶185
  79. Figure 29¶189
  80. Figure 30¶193
  81. 9.1.1.2 Capability Threshold: Critical¶195
  82. Table 13: Biological capability evaluations: Critical threshold¶197
  83. Figure 31¶202
  84. Figure 32¶206
  85. Figure 33¶210
  86. Figure 34¶214
  87. 9.1.2 Cybersecurity Capabilities¶216
  88. 9.1.2.1 ExploitBench¶220
  89. Figure 35¶223
  90. 9.1.2.2 ExploitBench - Internal Port (June–August 2026)¶225
  91. Figure 36¶229
  92. Figure 37¶233
  93. 9.1.3 AI Self-Improvement Capabilities¶235
  94. 9.1.3.1 Internal Research Debugging Evaluation¶238
  95. Figure 38¶240
  96. 9.1.3.2 KernelGen 1P¶242
  97. Figure 39¶244
  98. 9.2 Safeguards¶246
  99. 9.2.1 Model Safety Training and Evaluation¶249
  100. 9.2.1.1 Biological and Chemical Safety Training and Evaluation¶251
  101. Table 14: Biology Model Refusal Evaluation (higher is better)¶252
  102. 9.2.1.2 Cybersecurity Safety Training and Evaluation¶255
  103. Table 15: Cybersecurity Safety Evaluation (higher is better)¶256
  104. 9.2.1.3 Cybersecurity - Trusted Access for Cyber¶259
  105. 10. References¶261