GPT-Rosalind-6: OpenAI's Biology Model Doubles Some Benchmark Scores Behind a Trusted-Access Gate

On October 30, 2026, OpenAI published the deployment-safety page for GPT-Rosalind-6, which it describes as its frontier reasoning model for biology, drug discovery and translational medicine. The model is not available to the general public. It is offered only through trusted access to qualified scientists, research institutes, companies and government partners. According to the page, it shares weights with GPT-6 Astra, and OpenAI added no training data or post-training for this release.

What it is, and how access works

OpenAI reviews each applicant's proposed uses, security controls and governance practices. Non-government applicants go through business verification and compliance screening, and government entities can apply through a separate pathway for approved biosecurity, biosafety, public-health and biodefense uses. The release does not widen eligibility beyond earlier announcements such as the Rosalind Academic Plan. Enterprise customers must limit access to authorized users, apply least-privilege controls, and require qualified human review before outputs inform experiments, publications or decisions. AI Weekly lists launch partners including Amgen, Moderna, Thermo Fisher and the Allen Institute; this is secondary reporting, and we have not seen the partner list on OpenAI's own page.

The benchmark gains

On OpenAI's three internal benchmarks, GPT-Rosalind-6 scores higher than GPT-Rosalind-5.5 at the highest reasoning budget:

The relative gains are our arithmetic on the published scores. Two cautions apply. These are OpenAI's own benchmarks, so they are not independent evidence of real-world discovery performance. And with sets of roughly 100 problems, a few problems change the percentage by a point or more, so small differences should not be over-read. The pattern that the largest relative gain is on the hardest-scoring benchmark (GeneBench, single-attempt) is a fair observation, but the page does not explain the cause.

How OpenAI classified the risk

The page places GPT-Rosalind-6 at High capability in Biological and Chemical, below Critical, and below High in AI Self-Improvement. It also lists Cybersecurity at Critical; that line is reported as stated on the page, and readers should consult the original for the exact framing.

Selected preparedness results:

• Biorisk knowledge (indicative High threshold 80%): cons@32 of 78.3%, compared with 79.2% for 5.5 and 63.3% for GPT-6 Astra. The refusal rate was 9.4%, and the refusal-adjusted score was 85.0% (GPT-6 Astra: 90.0%).
• TroubleshootingBench (High threshold 36.4%): 491 of 832 correct, with nine failed attempts counted as incorrect.
• Critical-level evaluations (AAV capsid, SHP2, Coronavirus-ACE2, Phage-plasmid): none met its indicative threshold. SHP2, for example, scored 0.35 in a helpful-only run against a 0.60 threshold.
• Refusal-adjusted scores exceed the indicative High thresholds on three of four High evaluations.

Reading this carefully: the model is treated as High-risk, which is why the access gate exists. The gate is the primary control, with model-level boundaries, monitoring and enforcement, and contractual security requirements layered behind it. OpenAI withholds monitoring details and can restrict or revoke access for misuse.

The refusal policy is the real design choice

GPT-Rosalind-6 refuses less on dual-use biological queries than general-access models, which is the point for working scientists: questions about pathogens, toxins or assays that look alarming to a general filter are routine in a lab. It still refuses or responds safely to requests that would meaningfully enable severe biological weaponization. Cyber refusals are stricter, covering malware, credential theft, exfiltration and other unauthorized or destructive activity, and the standard GPT-6 Astra cyber safeguards, including real-time blocking, remain in place.

This is a different trade-off from a general chatbot: instead of one refusal policy for everyone, access is tiered by verified identity and purpose.

Safety measures that moved the wrong way

The page also reports comparisons with GPT-6 Astra where some alignment measures are worse:

Because the weights are shared and no new post-training was added, differences here likely reflect the deployment configuration and evaluation setup, though the page does not state the cause. Differences of a few tenths of a point on small evaluations may be within noise.

What to watch

1. Independent evaluation. Whether third-party scientists reproduce the benchmark gains on real discovery tasks.
2. Access expansion. The page says eligibility is not widened by this release; changes to that policy would be the signal to follow.
3. Rival approaches. Other labs are also building domain-specific science tooling, and tiered access may become a pattern.
4. Regulatory attention. A model classed High in biology with a lower refusal threshold is a natural subject for policy review.

For teams that mix general and specialist models, a workspace like Metir that lets users switch between providers makes it easier to match each task to the right tool, subject to each provider's access rules.

OpenAI

Sources:

• GPT-Rosalind-6 deployment-safety page, OpenAI, October 30, 2026
• AI News Today, AI Weekly, November 1, 2026 (partner list and summary)

Image credits

• DNA Helix CPK, by Ude (own work, ray-traced from PDB 2EDZ), via Wikimedia Commons, public domain. Generic illustration; reviewed visually.