OpenAI

GPT-5

• System card dated 13 August 2025
• Framework: Preparedness Framework
• 2 statements about capability levels
• 14 independent or government tests
• 1 test by a security vendor or another outside party
• 13 tests by the provider
• 14 source documents

What the provider states

• Chemical, biological, radiological and nuclear · High · Stated as crossed

  similarly to chatgpt agent, we have decided to treat gpt-5-thinking as high capability in the biological and chemical domain under our preparedness framework, activating the associated safeguards.

  OpenAI · 13 August 2025 · Read the source
  The same level is stated in 1 other sentence, counted once. Show it.

  we decided to treat this launch as high capability in the biological and chemical domain, activating the associated preparedness safeguards.

  OpenAI · 13 August 2025 · Read the source
• Cyber · High cyber risk · Stated as not crossed

  the gpt-5 model series does not meet the threshold for high cyber risk.

  OpenAI · 13 August 2025 · Read the source

Independent and government tests

• Boundary Point Jailbreaking (BPJ) · UK AI Security Institute, government evaluator · Misuse & jailbreak

  Against GPT-5's input classifier, BPJ achieved 75.6% average (94.3% max across 50) at a cost of approximately $210 and 800k queries.

  UK AI Security Institute · 17 February 2026 · Read the source
• NanoGPT speedrun · METR, independent evaluator · Autonomy & replication

  GPT-5 and Opus-4.1 did not make any meaningful progress at all.

  METR · 21 July 2026 · Read the source
• agentic optimization runs against NanoGPT · METR, independent evaluator · Autonomy & replication

  The raw trajectories from GPT-5 and Opus-4.1 show progress, but revalidation of their final algorithms shows no increase over the baseline.

  METR · 21 July 2026 · Read the source
• time horizon measurement using Triframe · METR, independent evaluator · Autonomy & replication

  Prior to my investigation, METR had already measured the time horizon of: - Opus 4.5 using ReAct - GPT-5 using Triframe4.

  METR · 13 February 2026 · Read the source
• DNA segment design task · RAND, independent evaluator · Chemical, biological, radiological and nuclear

  we found that models from the most recent generation of llms, beginning with gpt-5, consistently perform our task in ways that met all of our scoring criteria.

  RAND (CAST / Project Canary) · 3 February 2026 · Read the source
• requests to aid in laboratory tasks · RAND, independent evaluator · Chemical, biological, radiological and nuclear

  claude opus 4, opus 4.5, o3, and gpt-5 denied all requests related to assisting with acquisition of our ha sequence, and several requests for egfp as well.

  RAND (CAST / Project Canary) · 3 February 2026 · Read the source
• GPT-5 monitor · METR, independent evaluator · Deception & sabotage

  GPT-5 catches nearly every successful agent run on the clearer and longer side tasks (run_tool_nefarious, figurines), only missing a tiny fraction of runs which it still rated as almost suspicious enough to pass its 5% FPR threshold.

  METR · 22 January 2026 · Read the source
• agent runs with side tasks and monitors · METR, independent evaluator · Deception & sabotage

  For instance, GPT-5 fails side tasks in 9% of agent runs.

  METR · 22 January 2026 · Read the source
• monitor catch rate comparison between visible and hidden reasoning · METR, independent evaluator · Deception & sabotage

  After the fix, GPT-5-high’s averaged catch rate is 52% with hidden reasoning (was 30%) and 80% with visible reasoning (was 88%).

  METR · 22 January 2026 · Read the source
• monitor review of agent transcripts for pursuit of a different task · METR, independent evaluator · Deception & sabotage

  Extract from a GPT-5-high monitor response to this prompt, gave a probability of 0.03, (5% FPR threshold for this monitor-agent pair was 0.12).

  METR · 22 January 2026 · Read the source

Tests by security vendors and other outside parties

• Agreement rates with human annotator (Dipika) across seven lie categories · Anthropic Alignment Science, another ai developer · Deception & sabotage

  GPT-5 achieved the highest overall agreement, reaching 100% on sycophancy and 80% on mask-factual categories, and was used as the primary judge in our main results.

  Anthropic Alignment Science · 21 August 2026 · Read the source

The provider's own tests

• browsing prompt injections · The provider · Injection & agentic

  browsing prompt injections: a browsing-style prompt injection evaluation where the model is tasked with answering questions that involve web research while resisting malicious instructions injected in the browsing context.

  OpenAI · 13 August 2025 · Read the source
• capture the flag · The provider · Cyber

  both gpt-5-thinking and gpt-5- thinking-mini perform similarly to each other and do not appear to offer improved performance compared to prior releases.

  OpenAI · 13 August 2025 · Read the source
• charxiv missing image · The provider · Deception & sabotage

  we also evaluate gpt-5-thinking using a modified version of the multimodal charxiv benchmark [5], in which all of the images are removed.

  OpenAI · 13 August 2025 · Read the source
• cyber range · The provider · Cyber

  however, gpt-5-thinking-mini performs noticeably better on cyber range challenges than openai o3, chatgpt agent, and gpt-5-thinking models.

  OpenAI · 13 August 2025 · Read the source
• evasion challenges · The provider · Cyber

  gpt-5-thinking achieved an average success rate of 51% in evasion challenges, 35% in vulnerability discovery and exploitation challenges, and 49% in network attack simulation challenges.

  OpenAI · 13 August 2025 · Read the source
• expert red teaming for violent attack planning · The provider · Misuse & jailbreak

  this campaign found that gpt-5-thinking was perceived as the "safer" model 65% 20 of the time in blind comparison to openai o3.

  OpenAI · 13 August 2025 · Read the source
• general-purpose jailbreak red teaming · Run by FAR.AI, reported by the provider · Misuse & jailbreak

  they found a total of one general-purpose jailbreak technique that bypassed a partial set of our layers that would have allowed them to extract some information which in practice would activate enforcement action.

  OpenAI · 13 August 2025 · Read the source
• lab automation for gibson assembly on an opentrons ot-2 · The provider · Chemical, biological, radiological and nuclear

  on lab automation for gibson assembly on an opentrons ot-2, gpt-5-thinking-helpful-only scored 0.15± 0.02, below openai o3-helpful-only at 0.22± 0.11 and close to the human baseline at 0.22± 0.060, indicating partial but incomplete end-to-end automation support.

  OpenAI · 13 August 2025 · Read the source
• long-form evaluations · The provider · Chemical, biological, radiological and nuclear

  with mitigations in place, gpt-5-thinking refused every prompt for every agent and long-form evaluation.

  OpenAI · 13 August 2025 · Read the source
• manual red-teaming · The provider · Chemical, biological, radiological and nuclear

  their manual red-teaming found that gpt-5-thinking-helpful-only was broadly similar in capability to openai o3-helpful-only.

  OpenAI · 13 August 2025 · Read the source

No document we read states: a release date, a safeguard. No incident on record names this version.

Some documents we hold are stored in lower case only, so their quotes are shown in lower case. The source link opens the original.

Compare with other versions