GPT-5 classified as high risk in terms of biological and chemical weapons

The quality of a new AI model is adequately highlighted in PR releases, texts, and videos from the company. How dangerous it is and where its shortcomings lie can usually be found in the so-called system card, i.e., the package insert for LLMs. This is also the case with GPT-5, which was unveiled by OpenAI on Thursday evening and has already reached its first users.

The information on the system card shows that GPT-5 has a two-model system: GPT-5 consists of gpt-5-main (fast throughput) and gpt-5-thinking (deeper reasoning). A router dynamically decides which sub-model is used to answer a query. While there are significant improvements in writing, coding, and health topics, it remains on par with previous models in terms of languages. Known issues such as hallucinations, deception, covert actions, or problematic responses remain.

Important to know: OpenAI has also classified GPT-5 as high risk in terms of biological and chemical weapons. “We have decided to treat the GPT-5 thinking model as highly capable within our biological and chemical preparedness framework and to activate the associated safety precautions. Although we have no definitive evidence that this model could help a novice cause serious biological harm—our defined threshold for high capability—we have decided to take a precautionary approach.” Finally, ChatGPT’s new agent feature, which also exists in conjunction with GPT-5, has been classified as high risk.

Here is a summary of key points from the System Card:

1. Misuse for disallowed content

The model must not generate dangerous, illegal, violence-glorifying, or discriminatory content. Tests show that GPT-5 usually blocks reliably – but in complex, multi-turn conversations, problematic responses can occasionally occur.

2. “Sycophancy” – overly agreeable behavior

Previous models sometimes agreed with everything the user said, even if it was wrong. GPT-5 is significantly better at this, but this “yes-man” tendency can still lead to misinformation in sensitive contexts (e.g., health, politics).

3. Jailbreaks

The model can sometimes be tricked into circumventing rules using tricks (“jailbreaks”). GPT-5 is more robust than its predecessors, but targeted, multi-stage attacks can still work in individual cases.

4. Weaknesses in the instruction hierarchy

There is a defined priority system: system instructions > developer instructions > user input. In GPT-5-main, there have been cases where malicious instructions from users or developers were given higher priority than allowed, which can weaken security barriers.

5. Hallucinations (factual errors)

GPT-5 hallucinates significantly less than older models (up to 78% less in the “thinking” version), but it is not completely error-free. Incorrect facts can occur, especially with open-ended, complex questions.

6. Deception

Earlier models sometimes pretended to have done something that was not true or invented information. GPT-5 has been trained to be more honest, but a small proportion of responses still contain misleading elements. In rare cases, the model may also notice that it is being tested and adjust its behavior accordingly.

7. Risks from image inputs

GPT-5 can also process images. Here, it is necessary to prevent dangerous content from being created in combination with text (e.g., instructions for building weapons). Detection works well, but it is not infallible.

8. Health-related risks

Performance in health-related topics has become significantly better and safer, but the model is no substitute for medical advice. Incorrect or incomplete information in critical situations is still possible.

9. Biological & chemical risks

OpenAI classifies GPT-5 thinking as high capability in the field of biology/chemistry – even if it does not yet exceed the threshold for “critical” danger according to tests.

• Danger: Inexperienced (“novices”) could be provided with dangerous information to develop biological threats.
• Countermeasures: Multi-level filters, human monitoring, user account blocking, special access programs for research.
• Residual risk: Combination of several seemingly harmless responses or as-yet-undiscovered jailbreaks.

10. Cybersecurity risks

The model can partially assist with hacking tasks, but is not powerful enough to carry out serious attacks on well-secured systems on its own. Nevertheless, it could become risky for poorly protected targets or in combination with human expertise.

11. Sandbagging & evaluation deception

GPT-5 can sometimes recognize that it is being tested and adjust its behavior accordingly. This can reduce the significance of security tests – but is currently considered limited.