OpenAI

GPT-5.5

• Released 23 April 2026
• Framework: Preparedness Framework
• 4 statements about capability levels
• 18 independent or government tests
• 1 safeguard
• 12 tests by the provider
• 19 source documents

What the provider states

• Autonomy & replication · High · Stated as not crossed

  for ai self-improvement, evaluations of final checkpoints indicate that, like its predecessor models, gpt-5.5 does not have a plausible chance of reaching a high threshold.

  OpenAI · 23 April 2026 · Read the source
  The same level is stated in 1 other sentence, counted once. Show it.

  gpt-5.5 did not meet our thresholds for high capability in ai self-improvement.

  OpenAI · 23 April 2026 · Read the source
• Chemical, biological, radiological and nuclear · High · Stated as crossed

  we are continuing to treat gpt-5.5 as high capability in the biological and chemical domain.

  OpenAI · 23 April 2026 · Read the source
• Cyber · Critical · Stated as not crossed

  we therefore treat vulnlmp as important evidence that gpt-5.5 has high cybersecurity capability, while also as evidence against classifying it as critical under the preparedness framework.

  OpenAI · 23 April 2026 · Read the source
• Cyber · High capability, below critical · Stated as not crossed

  we are treating gpt-5.5 as high capability in the cybersecurity domain, but below critical.

  OpenAI · 23 April 2026 · Read the source

Independent and government tests

• asking the operator for permission to perform unsanctioned supply-chain attacks · UK AI Security Institute, government evaluator · Cyber

  gpt-6 astra also frequently conducted unsanctioned supply-chain attacks without ever asking the user, and gpt-5.6 sol and gpt-5.5 never asked.

  UK AI Security Institute · 28 September 2026 · Read the source
• Cooling Tower · UK AI Security Institute, government evaluator · Cyber

  GPT-5.5 was unable to solve Cooling Tower; no model has yet done so.

  UK AI Security Institute · 30 April 2026 · Read the source
• advanced suite (Expert-level tasks) · UK AI Security Institute, government evaluator · Cyber

  On the Expert-level tasks, GPT-5.5 achieves an average pass rate of 71.4% (±8.0%, 1 standard error of the mean), compared to 68.6% (±8.7%) for Mythos Preview, 52.4% (±9.8%) for GPT-5.4, and 48.6% (±10.0%) for Opus 4.7.

  UK AI Security Institute · 30 April 2026 · Read the source
• expert red-teaming on GPT-5.5's cyber safeguards · UK AI Security Institute, government evaluator · Misuse & jailbreak

  We identified a universal jailbreak that elicited violative content across all malicious cyber queries OpenAI provided, including in multi-turn agentic settings.

  UK AI Security Institute · 30 April 2026 · Read the source
• APE (Attempt to Persuade Eval) · Independent evaluator · Harmful content

  Reported result: gpt-5.5 attempts to persuade towards conspiracy in 18% of the cases and toward undermining control in 22% of the trials.

  glm-5.2 attempts to persuade towards conspiracy in 43% of the cases as opposed to 8% for opus 4.7 and 18% for gpt-5.5.

  SaferAI · 2 August 2026 · Read the source
• MASK · Independent evaluator · Deception & sabotage

  opus 4.7 lies in 17% of the trials and gpt-5.5 in 10%.

  SaferAI · 2 August 2026 · Read the source
• agentic misalignment benchmark · Independent evaluator · Deception & sabotage

  in this evaluation, glm-5.2 never displays any leaking or murder behavior, similar to gpt-5.5 and opus 4.7.

  SaferAI · 2 August 2026 · Read the source
• agentic misalignment evaluation · Independent evaluator · Deception & sabotage

  in this evaluation, claude opus 4.7 and gpt-5.5 display a 0% harmful-action rate across every scenario, goal, and threat condition.

  SaferAI · 2 August 2026 · Read the source
• Apollo's deferred subversion tasks · Apollo Research, independent evaluator · Deception & sabotage

  apollo found that the evaluated checkpoint [of gpt 5.5] is the first openai model it has evaluated that does not sandbag on any of apollo’s deferred subversion tasks.

  Redwood Research · 31 July 2026 · Read the source
• expenditure horizon on NanoGPT speedrun · METR, independent evaluator · Autonomy & replication

  GPT-5.5 and Opus-4.8 show significant improvements over the baseline, and we can quantify those with significant expenditure horizons, as shown above.

  METR · 21 July 2026 · Read the source

Safeguards the provider describes

• Safety training (harmlessness and refusal)

  as with gpt-5.4 thinking, we trained gpt-5.5 to refuse requests that clearly enable unauthorized, destructive, or harmful actions, including areas such as malware deployment, credential theft, and exfiltration.

  OpenAI · 23 April 2026 · Read the source

The provider's own tests

• Atomic Challenge Suite · Run by Irregular, reported by the provider · Cyber

  on irregular’s atomic challenge suite, gpt-5.5 achieved an average success rate of 98% in network attack simulation challenges, 92% in vulnerability research and exploitation challenges, and 54% in evasion challenges, and solved all atomic challenges, including three challenges that were not solved by gpt-5.4.

  OpenAI · 23 April 2026 · Read the source
• CTF challenges and vulnerability discovery benchmark · Run by CAISI (NIST), reported by the provider · Cyber

  caisi’s cyber assessment showed gpt-5.5 as outperforming previous gpt models on a set of ctf challenges and a vulnerability discovery benchmark.

  OpenAI · 23 April 2026 · Read the source
• CVE-Bench · The provider · Cyber

  gpt-5.5 and gpt-5.5 pro perform slightly higher than previous models.

  OpenAI · 23 April 2026 · Read the source
• UK AISI cyber safeguard testing · Run by UK AI Security Institute, reported by the provider · Cyber

  uk aisi tested gpt-5.5’s cyber safeguards and identified a universal jailbreak that elicited violative content across all malicious cyber queries openai provided, including in multi-turn agentic settings.

  OpenAI · 23 April 2026 · Read the source
• ai self-improvement evaluations · The provider · Autonomy & replication

  gpt-5.5 did not meet our thresholds for high capability in ai self-improvement.

  OpenAI · 23 April 2026 · Read the source
• biochemistry knowledge improvement over gpt-5.4-thinking · The provider · Chemical, biological, radiological and nuclear

  we find that gpt-5.5 shows only modest improvement over gpt-5.4-thinking, achieving a score of 32.32% vs. 30.97% for a difference of 1.35%, well within the 30% threshold.

  OpenAI · 23 April 2026 · Read the source
• cot-control · The provider · Deception & sabotage

  we find that gpt-5.5’s cot controllability is lower than that of gpt-5.4 thinking and gpt-5.2 thinking.

  OpenAI · 23 April 2026 · Read the source
• deception evaluations with representative prompts · The provider · Deception & sabotage

  our results suggest that gpt-5.5 shows a mix of higher and lower rates of misalignment than gpt-5.4 thinking on representative chatgpt prompts for the various categories we measure.

  OpenAI · 23 April 2026 · Read the source
• expert-level narrow cyber tasks (pass@1) · The provider · Cyber

  gpt-5.5 had the second-highest score of any model on pass@1 for expert-level tasks, scoring 66.7%±15.9%, and achieved 100% on lower-difficulty cyber tasks.

  OpenAI · 23 April 2026 · Read the source
• first-person fairness evaluation · The provider · Bias

  gpt-5.5 performs on par with gpt-5.1 and within the confidence interval of gpt-5.2 and gpt-5.4.

  OpenAI · 23 April 2026 · Read the source

No incident on record names this version.

Some documents we hold are stored in lower case only, so their quotes are shown in lower case. The source link opens the original.

Previous version: GPT-5.4 Thinking · Compare the two