OpenAI opens dual-use biology model to vetted labs only

Key Points

1. OpenAI released GPT-Rosalind-6, a biology model that refuses fewer dual-use questions than its public counterpart.
2. The model shares GPT-6 Astra's weights entirely; only refusal thresholds, safeguards and access rules differ.
3. Access is gated behind commercial vetting, compliance screening and mandatory human review of outputs.

The latest:

A frontier biology model that answers dual-use research questions the public system declines is now available to vetted organizations only. OpenAI listed gpt-6-rosalind in its API changelog on October 30, 2026, restricting it to Rosalind Research-approved organizations under a Trusted Access program. A system card addendum published the same day describes it as a reasoning model for biology, drug discovery and translational medicine.

Details:

• The architecture: According to the system card addendum, GPT-Rosalind-6 uses the same GPT-6 Astra weights, with no additional training data and no further post-training. The entire difference is a deployment one: a different refusal threshold for dual-use biology questions, separate safeguards, and restricted access.
• Who gets in: OpenAI said non-government applicants undergo commercial verification and compliance screening, while government bodies follow a separate track covering biosecurity, biosafety, public health and biodefense. The model is not offered to ChatGPT subscribers or to general API developers on any plan.
• The conditions: Approved organizations are bound to least-privilege permissions, internal risk controls and identity and access management, according to OpenAI. Qualified human review of outputs is required before results enter experiments, publications or decisions, and OpenAI monitors for misuse and can revoke access.
• The benchmarks: Against GPT-Rosalind-5.5, the new model scored 49.6% versus 28.9% on MedChemBench v7, 37.7% versus 16.7% on GeneBench Pro v13, and 61.3% versus 44.0% on LifeSciBench Gold. OpenAI described the overall comparison with 5.5 as mixed.
• The risk rating: Under OpenAI’s Preparedness Framework, biology and chemistry are rated High but below Critical, cybersecurity is Critical as inherited from Astra with a more conservative cyber refusal threshold, and AI self-improvement sits below High.
• Near the threshold: Biorisk knowledge scored 78.3% with a 9.4% refusal rate, rising to 85.0% after refusal adjustment, against an 80% indicative High threshold. TroubleshootingBench returned 491 of 832 correct, roughly 59%, versus a 36.4% indicative threshold.
• Critical evals missed: No Critical-level evaluation reached its threshold. AAV capsid packaging prediction hit a Spearman of 0.529 against 0.600, SHP2 protein function averaged R² 0.38 against 0.60, and ACE2 coronavirus entry screening scored 0.42 against 0.75.
• Refusals drop: On biosecurity refusal tests, GPT-Rosalind-6 refused 79.0% of sensitive prompts versus 99.8% for Astra, 83.8% versus 95.6% on selected sequences, and 84.6% versus 97.8% on dual-use. It refused 100% of benign biosecurity prompts, where Astra hit 91.6%.
• The pricing: The pricing page dated October 31, 2026 lists gpt-rosalind-research and gpt-rosalind-discovery at $5.00 per million input tokens and $25.00 per million output, half the $10.00 and $50.00 charged for standard gpt-6-astra. No separate row exists for gpt-6-rosalind.
• The lineage: The series launched in April 2026, with access limited to eligible US Enterprise customers and named users including Amgen, Moderna, the Allen Institute and Thermo Fisher Scientific. Billing for gpt-rosalind-research began October 5, 2026.

Background:

OpenAI lists three interfaces on its Rosalind page: Rosalind Workbench in research preview, a Workbench inside Codex, and the GPT-Rosalind API. Eligible organizations receive the newest GPT-Rosalind models as they ship.

Between the lines:

The safety case rests on deployment controls rather than model capability: identical weights to Astra, loosened biology refusals, and a trust perimeter built from vetting, least-privilege access and human review. The gap between a 79.0% sensitive-prompt refusal rate and Astra’s 99.8% measures what that perimeter is being asked to absorb. OpenAI also noted a biosecurity red-team exercise run on version 5.5 is being repeated on the new model, with details withheld.

What’s next

The repeated biosecurity red-team exercise on GPT-Rosalind-6 is the next disclosure to track, alongside whether biorisk knowledge scores cross the 80% High threshold and whether any Critical-level evaluation closes its gap.