GPT-Rosalind-6 is OpenAI's newest life sciences model, and the headline fact is what it is not: it is not new weights. In a system card addendum posted on November 2, 2026, OpenAI says the model uses the same weights as GPT-6 Astra, the company's flagship reasoning model, with no added training data and no extra post-training. What changes is the deployment. Rosalind-6 refuses fewer dual-use biology questions, but only vetted customers can use it.
This post walks through what the addendum says, what the numbers mean, what OpenAI did and did not publish, and what developers on Hacker News made of it. Everything below comes from OpenAI's own documents unless it is marked otherwise. These are vendor-run evaluations, and no independent lab has reproduced them.
What OpenAI announced
The addendum describes GPT-Rosalind-6 as "a frontier reasoning model for biology, drug discovery, and translational medicine." OpenAI offers it as GPT-Rosalind-6 Research to qualified scientists, research institutes, companies and government partners.
Four facts matter most:
- Same weights as GPT-6 Astra. The model-data section says OpenAI "did not add training data or perform additional post-training for this release." Details of the underlying training sit in the GPT-6 Astra system card.
- Fewer refusals on dual-use biology, behind a gate. The card says Rosalind has fewer refusals on dual-use biological queries but is only available through trusted access.
- Safety ratings carried over from Astra. OpenAI treats the launch as High capability in Biological and Chemical, below the Critical threshold. It treats the model as Critical in Cybersecurity and below High in AI Self-Improvement.
- Comparison with Rosalind-5.5. The addendum reports results for GPT-Rosalind-5.5 where available, re-run on the same problem sets as Rosalind-6.
If the weights are identical, you may ask why a separate model name exists at all. The answer is policy, not architecture. General ChatGPT models built on Astra refuse certain biology requests. Rosalind is the same model operated under a different safeguard stack and a different customer contract. That is a useful pattern to understand, because it shows how a lab can ship one set of weights at two risk levels.
Rosalind-6 versus Rosalind-5.5: the benchmark gains
OpenAI re-ran three life science benchmarks on both models. The card notes that the Rosalind-5.5 scores use the same benchmark versions and problem sets as Rosalind-6, so they differ from the numbers published when 5.5 launched. All figures below are at the highest reasoning budget tested.
| Benchmark | What it tests | GPT-Rosalind-6 | GPT-Rosalind-5.5 |
|---|---|---|---|
| MedChemBench v7 | Structure reading, structure-activity relationships, potency and toxicity prediction (99 problems) | 49.6% | 28.9% |
| GeneBench Pro v13 | Planning and running quantitative analyses of biological data (129 problems) | 37.7% | 16.7% |
| LifeSciBench Gold | Research tasks contributed by practicing life scientists (94 problems after six were excluded) | 61.3% | 44.0% |
Read these carefully. MedChemBench scores are mean rubric scores, with up to nine scored responses per problem. GeneBench Pro is a single-attempt success rate estimated from seven responses per problem, and OpenAI states the evaluation used "a benchmark-specific configuration that differs from production." LifeSciBench Gold excluded six problems that were flagged for possible issues with the tasks or the environment.
The gains are large in relative terms, roughly 1.7x on MedChemBench and 2.3x on GeneBench Pro. Still, a 37.7% single-attempt rate on quantitative biology analysis means the model fails most attempts on this test. Scientists should treat the model as a fast first-pass collaborator whose outputs need checking. OpenAI says the same thing in its access terms: customers must apply qualified human review before outputs inform experiments, publications or consequential decisions.
One more caution: the card says Rosalind-6 and Astra are the same weights, so a large jump over Rosalind-5.5 is really a measure of how much better the Astra generation is than the 5.5 generation, not of any life-science-specific work done for this release.
The Preparedness ratings: High in biology, Critical in cyber
OpenAI's Preparedness Framework sorts frontier capability into levels. For this launch:
- Biological and Chemical: High, below Critical. OpenAI ran four High-capability evaluations (wet lab knowledge and troubleshooting) and four Critical-capability evaluations (biological design that could help an expert build a highly dangerous novel threat).
- Cybersecurity: Critical. The card relies on the GPT-6 Astra assessment. Astra was the first OpenAI model to reach Critical in cyber, a point we covered when OpenAI explained the Luna, Terra, Sol and Astra model names.
- AI Self-Improvement: below High. Again inherited from Astra.
The four High-capability biology tests
Three of four High-capability evaluations were cleared, after refusal adjustment, according to the card: "GPT-Rosalind-6 exceeds the indicative High capability thresholds on three of the four evaluations." The tests are ProtocolQA Open-Ended (threshold 54%), TroubleshootingBench (threshold 36.4%), Biorisk knowledge (threshold 80%) and Multi-select Virology Troubleshooting (threshold 31%).
The numbers the text gives directly:
- TroubleshootingBench: Rosalind-6 scored 491 out of 832, counting nine failed evaluation attempts as incorrect. That is about 59%, well above the 36.4% indicative threshold.
- Biorisk knowledge, consensus of 32 answers: Rosalind-6 scored 78.3%, Rosalind-5.5 scored 79.2% and GPT-6 Astra scored 63.3%. The refusal rates were 9.4%, 1.8% and 29.2%. Treating refusals as correct, Rosalind-6 reaches 85.0% and Astra 90.0%.
That last row shows the whole design in one line. Astra, the general model, refuses 29.2% of these questions. Rosalind-6 refuses 9.4%. The refusal-adjusted score treats a refusal as a right answer to estimate the latent capability that safety training hides. The capability is similar in both models. Only the willingness to answer differs.
Note also that the card says observed scores are lower than Rosalind-5.5 on Biorisk knowledge, and higher on the other three evaluations.
The four Critical-capability tests
None of the four Critical evaluations met its indicative threshold. They are AAV Capsid Packaging Prediction (threshold Spearman 0.600), SHP2 Protein Function Prediction (threshold R-squared 0.60), Coronavirus-ACE2 Cell-Entry Screen (threshold 0.75) and Phage-plasmid Co-evolution (threshold negative log-likelihood of 9.40 or lower). For SHP2, the card reports a GPT-6 Astra reference of 0.40, with a separate helpful-only run at 0.35. Results against Rosalind-5.5 were "mixed."
OpenAI is open about the limits of these tests. It says the Critical thresholds "are preliminary estimates informed by expert judgment and may change as the evaluations are refined," and that the evaluations provide evidence about specific capabilities, "rather than a complete test of the ability to cause biological harm."
How access works
Locked flask with a biohazard symbol illustrating GPT-Rosalind-6 trusted access for dual-use biology
Access is the real product decision here. The card lists four safeguard components: trusted access controls, model-level boundaries against harmful biological and cyber assistance, monitoring and enforcement, and additional contractual requirements.
Before granting access, OpenAI reviews whether the applicant has:
- a legitimate life sciences or related mission,
- a credible use case,
- appropriate research and operational governance,
- the ability to safely control access to the model.
Non-government applicants also go through business verification and compliance screening. Select government entities can use a separate pathway for approved biosecurity, biosafety, public-health preparedness and biodefense work.
Approved enterprises must limit access to authorized users with a legitimate need, apply least-privilege controls, onboarding and insider-risk controls, and keep qualified human review before outputs inform experiments or publications. OpenAI can restrict or revoke access for misuse, using classifiers, account-level signals, customer information and specialist review.
The card also says this release "does not broaden eligibility beyond prior announcements, such as the Rosalind Academic Plan." If you are in a US university lab, that program is the practical route. We explained it in our guide to the Rosalind Academic Plan: up to 30 free seats for 12 months, with Rosalind access still subject to trusted-access approval.
Safety and alignment evaluations
The addendum includes behaviour tables that compare Rosalind-6 with Astra. OpenAI warns that "evaluation versions, inference settings, grading and sample coverage differ across some runs, so these are descriptive comparisons." A few of the numbers (lower is better):
| Evaluation | GPT-Rosalind-6 | GPT-6 Astra |
|---|---|---|
| Historical cyber jailbreak task success (real-time blocking off) | 14.3% | 15.7% |
| Blocker deception rate | 9.5% | 12.9% |
| Circumventing a restriction after a warning | 21.7% | 18.9% |
| Harmful or unauthorized actions in replayed agentic conversations | 27.1% | 26.7% |
| Performing an unauthorized action after finding a message board | 2.5% | 0.0% |
| Misaligned outcomes in simulated workplace tasks | 1.4% | 1.2% |
Two details deserve attention. First, Rosalind-6 is slightly worse than Astra on several agent-behaviour rows, such as circumventing a restriction after a warning (21.7% versus 18.9%). The differences are small and the runs are not strictly matched, so do not read much into them. Second, the cyber result is a reminder that Rosalind keeps Astra's real-time cyber blocking and adds a "more conservative cyber refusal boundary." The jailbreak test was run with blocking disabled to measure the model alone: it replayed nine known attacks across ten ExploitBench tasks, and two attacks were excluded because every attempt errored or hit turn limits. For background on that benchmark, see our ExploitBench explainer.
On monitoring, OpenAI reports 0% sabotage success on its OAI-repo Sabotage v2 test, both unguided and guided, where Astra scored 0% unguided and 3% guided. It also reports chain-of-thought controllability of 71.8% on GPQA, 59.3% on HLE and 83.1% on MMLU. That is the rate at which the model follows instructions that constrain its reasoning, so higher means the reasoning is easier to steer, which OpenAI treats as a risk signal. For how OpenAI watches for these behaviours in production, read how OpenAI detects frontier model misalignment.
What is not in the card
A system card is useful for what it leaves out too.
- No independent replication. Every figure comes from OpenAI. The data behind several evaluations is unpublished by design, for example the held-out AAV, SHP2 and phage datasets.
- No price or API detail. The card points to OpenAI's model docs for modalities and says data-retention terms are approved separately per customer. We found no public price for GPT-Rosalind-6.
- Red-team results withheld. OpenAI ran biosecurity red-teaming on Rosalind-5.5 and says it is repeating the exercise for Rosalind-6 "now that it is deployed." It is not disclosing the details, though it shared them with its Safety Advisory Group.
- No new training. If you hoped for a domain-specific model with new biology data, this is not it.
What developers are saying
The Hacker News thread had 23 points and 17 comments when we read it, so the sample is small. Comments are individual reports, not verified facts.
- Commenter Alifatisk asked whether Sol 6.1 had topped Astra, and why Rosalind is built on Astra. This is a fair question, and the card does not explain the choice of base model.
- kingjimmy complained that OpenAI's naming scheme is inconsistent. Our naming guide tries to sort it out.
- lifeisloving argued that machine learning was not the bottleneck in drug discovery, saying many ML drug-discovery startups produced more candidates than the industry could use. They also worried about researchers offloading thinking to a specialty model.
- chairhairair warned against using any OpenAI product with proprietary data. The card does not address this directly, but it does say data retention is approved separately per customer.
What this means if you work in or near biotech
If you run a lab, the practical path is the same as before: apply through the trusted-access review and document your governance and security controls. The card makes clear that those controls are part of what you are buying, not paperwork.
If you build AI products, the more transferable lesson is the pattern. One set of weights, two safeguard stacks, access decided by identity and governance rather than by the prompt. Expect other labs to copy it. Anthropic runs a comparable gated approach, which we covered in its life sciences verification program. For OpenAI's earlier steps in the same line, see the Rosalind workbench launch, the Orchestra Bio acquisition and the 32-minute multi-agent brain-cell data run.
If you run AI agents that touch sensitive data or take actions on your behalf, plan for the same layers OpenAI lists: access control, monitoring and human review. AgentBeam, the agent security platform from the explainx.ai team, stops AI agents before they take dangerous actions, which fits the "monitor and enforce" layer.
Bottom line
GPT-Rosalind-6 is a policy product more than a model release. The weights are Astra's, the gains over Rosalind-5.5 are large on OpenAI's own tests, and the model sits at High in biology and Critical in cyber on OpenAI's own scale. Access stays tight. What is still missing is independent testing, a public price and the red-team findings. We will update this post if OpenAI or outside researchers publish them.