GPT-Rosalind-6 uses GPT-6 Astra's weights with no extra training, its system card addendum says

GPT-Rosalind-6, OpenAI's new model for life-sciences labs, is not a separately trained model. Its system card addendum on OpenAI's Deployment Safety Hub says so in two sentences: "GPT-Rosalind-6 uses the same weights as GPT-6 Astra, our flagship reasoning model," and "We did not add training data or perform additional post-training for this release."

That changes how to read our report from October 31, when we found the release only through a changelog line and a help-center article, and no system card. The addendum is dated October 30; it drew attention on Hacker News on November 2. In it, OpenAI spells the name GPT-Rosalind-6, while the changelog calls it GPT-6 Rosalind.

Same model, different boundaries

What a Rosalind customer gets, then, is GPT-6 Astra with a different refusal policy and much tighter access. OpenAI describes it as having "fewer refusals on dual-use biological queries", available only to vetted organizations through its trusted-access program. It is meant to handle "some dual-use topics" that Astra "may refuse in General Access", while still refusing help with biological weaponization, and it applies "a more conservative cyber refusal boundary" than Astra on top of Astra's own cyber safeguards, including real-time blocking.

The addendum doesn't explain how identical weights end up with different refusal behavior. The obvious candidates are deployment-side: instructions, policies and classifiers around the model. That is our inference, not something OpenAI states. One sentence in the safeguards section muddies it further: "We still tune the model to refuse or safely respond to requests that would continue to meaningfully enable severe biological weaponization." Read next to "no additional post-training", that most likely refers to the tuning Astra already received.

The one table that shows the effect directly is the Biorisk knowledge evaluation, a tacit-knowledge and troubleshooting test built with Gryphon Scientific:

Astra refuses about three times as often, and that is most of the gap in its raw score. Once refusals are counted as correct answers, the method OpenAI uses to estimate capability that safety behavior hides, Astra scores higher than Rosalind. On this test the product difference is mostly about what the model is allowed to answer, not what it knows.

As we reported, gpt-6-rosalind costs $15 input and $75 output per million tokens at standard short-context rates, against $10 and $50 for GPT-6 Astra. Customers pay 1.5 times as much for the same weights, and what the extra buys is access to answers Astra would refuse, plus the vetting and monitoring that come with it.

What OpenAI measured

Against the previous model, GPT-Rosalind-5.5, the addendum reports large gains on three of OpenAI's life-sciences benchmarks, all at the highest reasoning budget tested and with the older model re-run on the same problem sets:

• MedChemBench v7 (99 medicinal-chemistry problems): 49.6% vs 28.9% mean rubric score.
• GeneBench Pro v13 (129 quantitative-biology tasks for agents): 37.7% vs 16.7% single-attempt success, in a configuration OpenAI says differs from production.
• LifeSciBench Gold (94 research tasks from practicing scientists, after six flagged problems were dropped): 61.3% vs 44.0%.

These are OpenAI's own benchmarks and numbers, with no outside replication.

Under its Preparedness Framework, OpenAI treats the launch as High capability in biology and chemistry, below Critical. After the refusal adjustment, the model exceeds the indicative High threshold on three of four wet-lab evaluations; on TroubleshootingBench it scored 491 of 832 (59.0% by our arithmetic; nine failed attempts counted as wrong) against a 36.4% threshold. None of the four Critical evaluations, which test things like predicting AAV capsid packaging or coronavirus cell entry, reached its threshold. For cybersecurity, OpenAI carries over Astra's assessment and treats GPT-Rosalind-6 as Critical, the top tier of its framework. That is why the extra cyber refusal boundary matters.

The behavioral tables compare the two deployments of the same weights. Most numbers are close, with a few small splits: Rosalind circumvented a restriction after a warning in 21.7% of cases versus 18.9% for Astra, and performed a planted unauthorized action from an external agent's message in 2.5% of cases versus 0.0%. OpenAI notes that evaluation versions, settings and sample coverage differ across some runs, so treat these as descriptive.

OpenAI also says it tested its monitoring and enforcement process with a biosecurity red-teaming exercise on GPT-Rosalind-5.5, and is "in the process of repeating this for GPT-Rosalind-6 now that it is deployed." For this release, that red-team test came after launch.