OpenAI reports GPT-Rosalind-6, a biology model with restricted access

OpenAI published a system card addendum for GPT-Rosalind-6, a model for biology, drug discovery and translational medicine that it offers as “GPT-Rosalind-6 Research” only to qualified scientists, research institutes, companies and government partners. The addendum is dated 30 October 2026. A launch post for the model was not located; the addendum is the only primary document consulted.

According to the card, GPT-Rosalind-6 uses the same weights as GPT-6 Astra, OpenAI’s flagship, and “we did not add training data or perform additional post-training for this release”. What differs is behaviour and access. The model refuses less often on dual-use biological questions, while still refusing requests for biological weaponisation and keeping refusals on other safety topics; its cyber refusal boundary is described as more conservative than the base model’s. Applicants are reviewed on their proposed uses, security controls and governance, and the card lists trusted-access controls, model-level boundaries, monitoring and enforcement, and contractual security requirements as its four safeguards. The model follows the earlier GPT-Rosalind line, whose biodefence programme launched in June.

On capability, OpenAI compared the model with GPT-Rosalind-5.5, re-running both on the same problem sets, so the older model’s figures differ from those published at its own launch. At the highest reasoning budget tested, it reported mean rubric scores of 49.6% against 28.9% on MedChemBench v7, 37.7% against 16.7% on GeneBench Pro v13, and 61.3% against 44.0% on LifeSciBench Gold. These are OpenAI’s benchmarks and have not been independently checked; the card notes the GeneBench configuration differs from production.

The risk classification is the part most likely to draw scrutiny. Under its Preparedness Framework, OpenAI said it is treating the launch as High capability in the Biological and Chemical domain, below the threshold for Critical. After adjusting scores to count refusals as correct answers, the model exceeds the indicative High thresholds on three of four evaluations, and none of the four Critical evaluations met its indicative threshold. For other risk categories the card relies on Astra’s assessment: it treats GPT-Rosalind-6 as Critical in cybersecurity and below High in AI self-improvement.

The release shows OpenAI’s approach to dual-use biology: rather than train a separate model, it applies different refusal behaviour and access conditions to a single model, with vetting as the main control. A system card cannot show how well that vetting works in practice. The card describes monitoring and enforcement that can restrict or revoke access for misuse, and says pre-launch biosecurity red-teaming carried out on GPT-Rosalind-5.5 is being repeated for the new model.