OpenAI's GPT-Rosalind-6 reuses GPT-6 Astra weights with no new training, system card shows

OpenAI has published a system card addendum for GPT-Rosalind-6, and the most consequential disclosure is about what did not happen: the model runs on the same weights as GPT-6 Astra, with no added training data and no additional post-training. The document, hosted on OpenAI's Deployment Safety Hub and surfaced via Hacker News, points readers back to the GPT-6 Astra system card for details of the underlying model's data and training.

Same weights as GPT-6 Astra

According to the addendum, GPT-Rosalind-6 is a re-deployment of GPT-6 Astra rather than a separately trained model. That framing matters for evaluation. Any capability gap between GPT-Rosalind-6 and its genomics predecessor, GPT-Rosalind-5.5, reflects the jump in base model generation, not new domain-specific training. And any behavioral difference between GPT-Rosalind-6 and GPT-6 Astra in general access comes down to deployment choices — access restrictions, safeguards and configuration — rather than the model itself.

Genomics benchmark results

The addendum reports results on GeneBench Pro v13, which tests an agent's ability to plan and carry out quantitative analyses of biological data. OpenAI estimated single-attempt success from seven responses per model across 129 problems at each reasoning budget. At the highest reasoning budget tested, GPT-Rosalind-6 reached 37.7% single-attempt success versus 16.7% for GPT-Rosalind-5.5 — a wide generational gap. OpenAI cautions that the evaluation relied on a configuration specific to the benchmark that differs from production, so the figures do not directly describe out-of-the-box performance.

Biosecurity capability assessment

As with GPT-6 Astra, OpenAI classifies the launch as High capability in the Biological and Chemical domain. The assessment reuses the four High and four Critical capability evaluations described in the GPT-6 Astra system card. The High evaluations test knowledge of wet lab work and troubleshooting, while the Critical ones probe biological design abilities that could assist an expert in creating a dangerous novel threat. Two evaluations reported for GPT-Rosalind-5.5 — hard-negative protein binding and DNA sequence design — have been retired.

OpenAI stresses that these evaluations give evidence about specific capabilities, not a complete test of the ability to cause biological harm, and that the Critical capability thresholds are preliminary estimates informed by expert judgment that may shift as the evaluations are refined. Reported results include pass@1 scores and, for the High evaluations, refusal-adjusted scores that count refusals as correct answers in order to estimate capability that safety training might otherwise hide.

Safeguards and access controls

GPT-Rosalind-6 is positioned to be more helpful for legitimate advanced life sciences work than OpenAI's consumer ChatGPT models, supporting workflows — including some dual-use topics — that GPT-6 Astra may decline in General Access. OpenAI says the model is still tuned to refuse or answer safely to requests that would materially enable severe biological weaponization, and that this training is kept separate from its classifiers and offline mitigations so the safeguard layers do not share weaknesses. The addendum does not spell out how that tuning relates to the statement that no additional post-training was performed for this release.

Because GPT-Rosalind-6 is a trusted-access deployment, OpenAI says it focused mainly on its Biosecurity – Severe benchmark; it also notes that a response flagged under its grading criteria is not necessarily unequivocally unsafe. Behavioral evaluations were deliberately built around cases where existing models fell short, and OpenAI says it will keep monitoring safety signals, customer experience and misuse patterns after launch, and may adjust safeguards as the deployment evolves. Comparisons against GPT-6 Astra results are labeled descriptive rather than controlled, since evaluation versions, inference settings, grading and sample coverage differ across runs.

Approved customers must also maintain security controls appropriate for a higher-capability life sciences model: strong identity and access management, administrator controls, least-privilege access fitting the approved deployment, and offboarding procedures that cut access once a user no longer needs it. Model access and data-retention arrangements are approved separately.

Why it matters

The addendum is a clear example of how frontier labs now package domain models: GPT-Rosalind-6's headline genomics gains come entirely from GPT-6 Astra's existing weights, not from new training. Evaluators should treat its capability claims as claims about an already-released base model plus a deployment policy, and read benchmark scores with the caveat that they were produced under non-production settings. The release also sketches the shape of trusted-access AI for biology — more permissive on dual-use research than consumer products, underpinned by preliminary capability thresholds and customer-side security obligations rather than any model-level novelty.