GPT-5 System Card Summary

GPT-5 models were trained on a broad spectrum of data including public information, third-party content, and data provided by users or trainers. The training process involved extensive filtering to maintain data quality and reduce personal data inclusion. Additionally, the models integrate reinforcement learning to improve their reasoning abilities, enabling the system to generate long chain-of-thought processes prior to responding. An important innovation is the strategy of safe completions, which shifts the focus from simply refusing disallowed content to producing helpful outputs while conforming to safety constraints. This method has led to improvement in areas such as hallucination reduction, better instruction following, and decreased sycophancy^[1].

A large portion of the system card is dedicated to describing observed safety challenges and the various evaluations performed. The card details extensive testing on categories like disallowed content, including hate speech, illicit behavior, and personal data; it highlights that GPT-5 models perform near-perfectly on many safety benchmarks. The system card explicitly explains that the models now use safe completions to provide high-level, non-actionable responses instead of brittle binary refusals, which is especially relevant in dual-use scenarios. Evaluations also covered challenging production scenarios through multi-turn conversations, with specific benchmarks on topics such as sexual content involving minors, harassment, and substance misuse. In terms of performance, GPT-5 models have reduced factual hallucinations by significant margins relative to previous versions and have lower rates of deception. For instance, hallucination rates were reduced sharply when compared to earlier models during complex factual queries, with performance measured over multiple production-related benchmarks^[1].

To address issues of sycophantic behavior and deception, the GPT-5 series underwent additional post-training. The card details that methods have been implemented to minimize sycophancy, with offline evaluations showing much lower sycophantic scores compared to earlier models. Furthermore, detailed monitoring of the chain of thought (CoT) ensured that deceptive reasoning was flagged and reduced, with studies indicating lower percentages of deceptive responses in the new models. These measures appear to have contributed to a safer and more reliable user interaction, with extensive efforts made to both prevent the generation of misleading information and to ensure that the internal reasoning monitors are robust^[1].

Red teaming was a critical component in the evaluation process for GPT-5. External experts and specialized teams conducted red team campaigns to assess the model’s capability to generate harmful content and to examine the potential for generating information that could be used for violent or malicious purposes. In one campaign focused on violent attack planning, GPT-5-thinking was favored for safety compared to previous models, with win rates clearly indicating safer response behaviors. Additionally, automated red-teaming revealed that the new models were significantly more resistant to jailbreaks and prompt injections than earlier iterations. These steps, which included both expert manual assessments and automated testing platforms, helped refine the models’ safety measures and overall robustness against adversarial challenges^[1].

The system card emphasizes the implementation of a Preparedness Framework that tracks and minimizes risks associated with frontier capabilities, particularly in areas of biological, chemical, and cybersecurity risks. Extensive assessments have been made to evaluate the models’ performance on long-form biological risk questions, protocol troubleshooting, and even tacit knowledge required for complex laboratory tasks. In the biological and chemical domains, the framework treats GPT-5-thinking as 'High capability', necessitating additional safeguards to prevent misuse. Detailed evaluations in cybersecurity were also conducted, including Capture the Flag challenges and cyber range exercises. Although some improvements were noted across these domains, the card indicates that the models do not yet meet the threshold for high cyber risk. Overall, the assessment process serves both to benchmark current capabilities and to ensure that sufficient risk mitigations are in place for potentially dangerous applications^[1].

Due to the potential for misuse in sensitive areas such as biological weaponization and dual-use biology, the document details a layered defense system specifically addressing these risks. The safeguards include robust model training that instructs the model to refuse requests for weaponization assistance and to provide only non-actionable, high-level information on dual-use topics. In addition, system-level protections are deployed across all interactions via a two-tier system: a fast topical classifier identifies biology-related conversations, and a second reasoning monitor further assesses whether the generation belongs to any disallowed category. These protections operate in tandem with account-level enforcement mechanisms and dedicated API access controls. A trusted access program is also mentioned, enabling vetted customers to access less-restricted versions for beneficial applications while still maintaining strict safety controls. Such measures are continuously tested and updated through extensive red teaming, including external evaluations by government entities and cybersecurity research organizations, ensuring that any vulnerabilities are promptly addressed^[1].

In summary, the GPT-5 system represents a significant evolution in large language model design by emphasizing both improved performance and enhanced safety. The system card outlines a comprehensive approach that spans from data training and safe completions to a robust safety architecture supported by multi-layered mitigations. Extensive evaluation across various harmful content categories, rigorous red teaming, and a dedicated Preparedness Framework are integrated to monitor real-world performance and risk. The detailed assessments also highlight that while the models show improvements in factual accuracy, reduced deceptive behavior, and better handling of complex requests, ongoing work remains to further refine these safety systems. This integrated approach not only protects against malicious use but also seeks to support responsible advancements in areas like life sciences and cybersecurity, ensuring that as these models continue to scale, they do so in a manner that minimizes risk and enhances user safety^[1].