OpenAI has released GPT-Rosalind-6, a model for life sciences research, and the company’s own system card addendum says it is built on the weights of GPT-6 Astra, its general-purpose model. OpenAI added no training data and ran no extra post-training. What changed is the deployment: who is allowed to use it and which questions it will answer.
That second part is the point. According to the addendum, published on OpenAI’s deployment safety site, the model is meant to serve real scientists doing advanced biology better than the ChatGPT models anyone can sign up for. It handles certain dual-use subjects that the general release of GPT-6 Astra may turn down. OpenAI says it still tunes the model to refuse or respond safely to requests that would meaningfully help someone build a biological weapon, and that this training is kept separate from the training of its classifiers so the safeguards do not fail together.
The capability claim is specific. On GeneBench Pro v13, which tests whether an agent can plan and run quantitative analyses of biological data, OpenAI sampled seven answers from each model for every one of 129 problems and estimated the odds of getting it right on the first try. With reasoning effort turned to its maximum setting, GPT-Rosalind-6 scored 37.7 percent. Its predecessor, GPT-Rosalind-5.5, scored 16.7 percent. That is a little more than double, on a benchmark OpenAI describes as using a configuration that differs from production, and the addendum offers no outside replication.
The risk rating is just as plain. OpenAI classes this launch as High capability for biology and chemistry, the same call it made for GPT-6 Astra. The company runs four High evaluations, which probe lab knowledge and debugging experiments, and four Critical evaluations, which test whether a model could help an expert design a highly dangerous novel threat. It adds that the Critical thresholds are preliminary estimates based on expert judgment and may change, and that two evaluations used for GPT-Rosalind-5.5 (one on protein binding, one on designing DNA sequences) have been retired.
One scoring choice deserves a close look. For the High evaluations, OpenAI reports refusal-adjusted results that count a refusal as a correct answer, which estimates what the model could do if safety training were not hiding it. Because this is a trusted-access deployment, the safeguard analysis leans mainly on the Biosecurity - Severe benchmark. OpenAI notes that a flagged response is not necessarily unsafe, and the prose of the addendum does not state the pass rates.
Since the weights are the same ones the public can reach, the gate carries most of the weight, and the gate is the customer. Approved organizations must run tight identity checks, give administrators control, grant each person only the permissions the work needs, and cut off anyone who no longer has a legitimate reason to be there. Model access and data retention are approved separately for each deployment. OpenAI says it will keep watching safety signals and misuse patterns and may update the safeguards as the deployment evolves.
The tradeoff is easy to state. A lab gets a model that engages with questions a general chatbot would decline, and in return it takes on the job of proving that nobody it employs misuses it. For any biotech or research institute weighing an application, the security review is likely to take longer than the benchmark comparison.
Reported by OpenAI, in the GPT-Rosalind-6 system card addendum on its Deployment Safety Hub; the page carries no publication date.
