OpenAI's New Biology Model Loosens Safety Refusals the Same Week a Benchmark Rewards Doing That

On October 30, OpenAI quietly published a system-card addendum for a new model called GPT-Rosalind-6, built for biology, drug discovery and translational medicine. Three days later, on November 2, the AI research firm SemiAnalysis launched a new frontier-capability benchmark, GDPx, that tests leading models on biology, cybersecurity and other high-stakes domains. Taken separately, the two releases look like routine industry news. Read together, they describe the same uncomfortable dynamic from two different angles: some of the AI industry's most closely watched capability signals now appear to reward whichever lab is willing to loosen its dual-use safety filters the most.

A model built to say yes more often

According to OpenAI's own system-card addendum, GPT-Rosalind-6 runs on the same underlying weights as the company's general-purpose GPT-6 Astra model, with no additional training. What changes is access and behavior: OpenAI says the model "has fewer refusals on dual-use biological queries" than Astra, while still being tuned to refuse requests that would meaningfully enable severe biological weaponization. The company rates its biological and chemical capability as High on its own Preparedness Framework scale, one tier below Critical, and says none of four internal Critical-tier evaluations it ran, covering viral capsid packaging, a key cell-signaling protein, coronavirus cell-entry and phage-plasmid co-evolution, met the threshold it treats as concerning.

The capability jump between model generations looks substantial by OpenAI's own published numbers. On one chemistry benchmark, scores rose from 28.9 percent to 49.6 percent, an increase of roughly 70 percent; on a genetics benchmark, they more than doubled, from 16.7 percent to 37.7 percent; and on an internal biosecurity-knowledge test, refusal-adjusted performance reached 85 percent against an 80 percent threshold the company treats as indicative of High capability. Access is restricted to vetted enterprise and government customers, who OpenAI says must demonstrate a legitimate life-sciences mission and apply qualified human review before outputs inform real experiments or publications. Trade press has reported a price premium of roughly 50 percent over standard Astra access, and several pharmaceutical and biotech firms have been named by reporters as early customers, though OpenAI's own published materials do not independently confirm which organizations currently have access.

A benchmark that grades safety filters almost by accident

A new industry benchmark published the same week adds a second data point. SemiAnalysis's GDPx, a notoriously difficult capability test spanning eleven professional domains, found that in its biology section specifically, Google's Gemini 4 Carbon came out on top — but the benchmark's own authors attribute that lead, at least in part, to Gemini having weaker safety classifiers than its rivals, not to superior scientific reasoning. The firm goes further for two other labs, stating that Anthropic's Opus 5.5 and OpenAI's GPT-6 Astra had their overall GDPx scores suppressed because those models' safety classifiers activated specifically in the cyber, biology and alignment domains, and it publishes a separate classifier-excluded ranking to compensate for the effect.

Put side by side, the two data points describe the same incentive from opposite ends of the industry. OpenAI is explicitly, deliberately trading some of its dual-use biology refusals for commercial reach, wrapped inside an access-control regime it says keeps the model short of a Critical capability rating. SemiAnalysis's benchmark, meanwhile, suggests that even where a relaxation is not deliberate, a thinner safety filter can look like a capability win on the leaderboards that investors, enterprise buyers and rival labs now watch. If a widely cited benchmark score moves with safety-classifier strength nearly as much as with underlying ability, any lab under competitive pressure has a rational, defensible reason to keep trimming its own filters rather than appear to fall behind on a metric that does not cleanly separate genuine capability from reduced caution.

Neither finding is quite as alarming as it might first sound. OpenAI frames Rosalind-6 as a controlled trade rather than an open door: the relaxed refusals apply only inside a trusted-access gate, with applicant vetting, human-review requirements, and a biosecurity red-teaming process the company says it is repeating for this release, though it has not yet published those results publicly. SemiAnalysis's safety-classifier explanation for Gemini's biology lead is the benchmark authors' own interpretive judgment rather than an audited causal finding, and the firm's decision to publish a classifier-excluded ranking at all suggests it does not treat raw scores as a safe measure of real-world risk on their own. Independent outside researchers have not yet verified either claim.

Still, people who study biosecurity have warned for years that the more consequential erosion of AI safety margins rarely arrives as one dramatic jailbreak. It tends to arrive as a series of individually defensible decisions, each justified by competition or by legitimate research demand, that cumulatively lower the floor across an entire industry. This week offered a concrete illustration of that pattern rather than a hypothetical one: a frontier lab loosening its own refusals for paying customers, and a new industry yardstick that, by its own authors' account, rewards exactly that kind of loosening wherever it shows up in the model stack.