What is GPT-Rosalind-6?
OpenAI published a system card addendum for GPT-Rosalind-6 on 30 October 2026. The document calls it "a frontier reasoning model for biology, drug discovery, and translational medicine." The product is offered as GPT-Rosalind-6 Research. It is available to qualified scientists, research institutes, companies and government partners.
The Rosalind series is not new. OpenAI introduced the first version in April 2026. GPT-Rosalind-5.5 followed in June and was built on the GPT-5.5 generation. On 11 September, OpenAI said the series was leaving research preview. Eligible organisations worldwide could then apply through its trusted-access programme. Published pricing took effect on 5 October.
This release is less a product launch than a policy decision. OpenAI did not train a better biology model. It took the model behind its general flagship, then changed who may use it and what it will answer. That is a different kind of release, and it deserves a close read.
The commercial context explains the interest. Drug discovery is slow and expensive, and large language models are now being sold into that work. OpenAI's June announcement named Novo Nordisk as a partner using the series for medical research. The pitch is that a model can connect evidence across literature, genomics, sequence and experimental results.
What researchers use it for is narrower than the label suggests. OpenAI's academic plan lists drug and protein design, disease detection, and vaccine and immune-response work. The model also connects to Codex plugins that run sequence analysis and retrieve literature. It is a research assistant for evidence-heavy work, not a laboratory robot.
Is GPT-Rosalind-6 a new model, or GPT-6 Astra behind a gate?
GPT-Rosalind-6 runs on the same weights as GPT-6 Astra, OpenAI's flagship reasoning model. The system card is explicit. "We did not add training data or perform additional post-training for this release," it states. The underlying data and training are described in the Astra system card, not this one.
So this is not a biology specialist trained on laboratory data. It is a general model with two changes on top. It refuses fewer dual-use biological questions. And it is available only to organisations that pass a review. OpenAI says the model "has fewer refusals on dual-use biological queries." It also says the model still refuses requests for biological weaponisation.
That changes how a frontier lab packages a vertical product. Buyers are not paying for different weights. They are granted a different refusal boundary, under contract and monitoring. i-SCOOP makes this point directly. The approval, the obligations and the audit trail become the product.
The same analysis notes that OpenAI has used gated access before for sensitive domains. It cites a programme for GPT-5.5-Cyber and a legal variant of Astra. On that reading, Rosalind-6 is not an exception. It is a template applied to biology.
For anyone tracking model releases, the practical test changes. A leaderboard no longer describes what a general user will experience. One set of weights can produce two products with different safety behaviour, different customers and different prices.
The Astra card remains the reference for the parent model's training and broader evaluations. Rosalind's addendum repeats only what changes: the biological results, the refusal boundary and the deployment controls. That makes the two documents a matched pair for anyone auditing the release.
How much better is GPT-Rosalind-6 than GPT-Rosalind-5.5?
OpenAI reports gains on three of its own life-sciences benchmarks. All figures below come from the 30 October addendum. They use the highest reasoning budget tested.
The three tests measure different kinds of work. MedChemBench v7 covers chemical structure interpretation, structure-activity relationships, and predictions of drug potency and toxicity. GeneBench Pro v13 asks whether an agent can plan and carry out quantitative analyses of biological data. LifeSciBench Gold uses research tasks contributed by practising life scientists.
The scoring rules matter too. OpenAI averages responses within each problem and then weights problems equally. MedChemBench allowed up to nine scored responses per problem at each reasoning budget. GeneBench estimated single-attempt success from seven responses per problem.
- •MedChemBench v7, medicinal chemistry, 99 problems: 49.6% for GPT-Rosalind-6 against 28.9% for GPT-Rosalind-5.5.
- •GeneBench Pro v13, quantitative biology, 129 problems, single attempt: 37.7% against 16.7%.
- •LifeSciBench Gold, expert-written research tasks, 94 problems: 61.3% against 44.0%.
Why does OpenAI allow fewer refusals on dual-use biology?
Dual-use biology is the hard case. A question about how a virus enters a cell can help a vaccine team and a bad actor alike. General models tend to refuse more of these questions. Rosalind answers more of them, but only for vetted users.
The refusal numbers show the trade. On OpenAI's biorisk knowledge test, GPT-Rosalind-6 refused 9.4% of questions. GPT-Rosalind-5.5 refused 1.8%. GPT-6 Astra refused 29.2%. That test covers tacit laboratory knowledge and troubleshooting across five stages of the biothreat creation process.
Answering more often is not the same as answering better. OpenAI adjusts scores by treating refusals as correct answers. That estimates capability which safety training might otherwise conceal. After the adjustment, GPT-Rosalind-6 scored 85.0% and GPT-6 Astra scored 90.0%. The newer model's advantage comes from answering more, not from knowing more.
The biosecurity content evaluations record the share of responses that pass OpenAI's safety grader on sensitive prompts. The benign set tells the other side of the story. GPT-Rosalind-6 was fully helpful on harmless biology questions 100% of the time. GPT-6 Astra managed 91.6%. Labs get fewer unhelpful refusals, while the public model keeps the stricter line. That split is the argument for a gate.
The safety layers are also kept apart on purpose. OpenAI says it trains refusals separately from its classifiers and offline mitigations. The stated aim is to decorrelate the safeguards, so one failure does not take the others with it.
The gate is not the only safeguard. OpenAI says approved customers must apply "qualified human review before model outputs inform experiments, publications, or consequential decisions." That clause moves part of the safety burden onto the customer.
- •Biosecurity - Sensitive: 79.0% for GPT-Rosalind-6, 99.8% for GPT-6 Astra.
- •Biosecurity - Select Sequences: 83.8% against 95.6%.
- •Biosecurity - Dual-Use: 84.6% against 97.8%.
- •Biosecurity - Benign: 100% for GPT-Rosalind-6, 91.6% for GPT-6 Astra.
Who can use GPT-Rosalind-6?
Access is limited to approved organisations. OpenAI reviews four things: a legitimate life-sciences mission, a credible use case, research and operational governance, and the ability to control access. Non-government applicants also face business verification and compliance screening.
Government bodies have a separate route. OpenAI says that pathway covers biosecurity, biosafety, public-health preparedness and biodefense work. Approved customers must restrict access to authorised users with a genuine need. They must apply least-privilege controls, onboarding checks and insider-risk controls.
The release does not widen the pool. OpenAI states that it "does not broaden eligibility beyond prior announcements." An academic route already exists. Under the Rosalind Academic Plan, announced on 15 October, eligible labs can receive up to 30 free Business Standard seats. Those seats last up to 12 months. Model access still depends on trusted-access approval. Research data shared under the plan is not used to train OpenAI's models by default.
OpenAI describes four safeguard components. They cover trusted access for verified organisations and model-level limits on harmful biological and cyber help. Monitoring, enforcement and extra contractual security requirements complete the set. The model also keeps the real-time cyber blocking used by Astra.
Enforcement continues after approval. OpenAI says it can restrict or revoke access for misuse. It monitors classifiers, organisation-level signals, customer information and, where available, specialist review. Customers must also run identity and access management and remove access when a user no longer needs it. Data-retention terms are approved separately from the security review.
The gate has distribution costs. AI Weekly's editor's note argues that the vetting criteria will structurally exclude non-Western and smaller institutions, whatever their research intent. That is commentary, not a finding in the system card. It is still the central open question about the programme.
What are the limits of the evidence?
The card is unusually detailed, and it shows where the model falls short. On ProtocolQA Open-Ended, which tests troubleshooting of published lab protocols, GPT-Rosalind-6 scored 42.0%. The indicative High capability threshold is 54%. GPT-6 Astra scored 41.4% on the same 108 adapted questions.
The questions come from an outside dataset. OpenAI rewrote 108 multiple-choice items from FutureHouse's ProtocolQA into open-ended short answers. That dataset is part of LAB-Bench, a 2,400-question biology benchmark published by Laurent and colleagues in 2024.
OpenAI still rates the release High for biological and chemical capability. Its stated reason is that the model beats the indicative thresholds on three of the four evaluations, once refusals are adjusted. The three are TroubleshootingBench at 59.0%, virology troubleshooting at 59.9%, and biorisk knowledge at 85.0%. That is a threshold-based judgment, not a proof of safety.
The two tiers measure different things. High evaluations test wet-lab knowledge and troubleshooting. Critical evaluations test biological design capabilities that could help an expert develop a highly dangerous new threat. The four Critical tests covered capsid packaging, protein function, cell entry and co-evolution.
"None of the four Critical capability evaluations met its indicative threshold," the card states. The margins vary. AAV capsid packaging reached a Spearman correlation of 0.529 against a 0.600 threshold. SHP2 protein function reached 0.38 against 0.60. Coronavirus-ACE2 entry prediction reached 0.42 against 0.75. Phage-plasmid co-evolution scored 13.41 against a required 9.40 or lower.
The card also limits what those results mean. The evaluations "provide evidence about specific capabilities rather than a complete test of the ability to cause biological harm." The Critical thresholds are described as preliminary estimates based on expert judgment. They may change as the tests are refined.
Cybersecurity is a different story. OpenAI treats GPT-Rosalind-6 as Critical in that domain, inherited from Astra. It adds a more conservative cyber refusal boundary. Of nine replayed jailbreak attacks, seven produced usable results. Across those, the model completed 14.3% of ExploitBench tasks on average with real-time blocking switched off. Astra completed 15.7%.
One gap is procedural. OpenAI says biosecurity red-teaming was run on GPT-Rosalind-5.5 before launch. It is repeating that work for GPT-Rosalind-6, which is already deployed. The details are not public. Until those results appear, the strongest evidence on misuse resistance is OpenAI's own grading.
Independent checks are also missing. The benchmarks are small, with roughly one hundred problems each. OpenAI wrote, ran and graded them. i-SCOOP notes that they are internal and have not been independently reproduced. A GeneBench score measures whether an analysis was planned and executed correctly. It says little about whether a drug candidate will work.
What the gains show, and what to watch next
Two caveats keep the benchmark gains in proportion. First, OpenAI re-ran GPT-Rosalind-5.5 on the same benchmark versions for this comparison. It says the new scores differ from those reported at the 5.5 launch. In June, OpenAI reported MedChemBench at 27.5% for Rosalind against 25.1% for GPT-5.5. It reported GeneBench at 21.6% against 20.4%. Mixing the two documents would compare different test sets.
Second, the weights are Astra's. The improvement over Rosalind-5.5 therefore comes from the newer base model. It does not come from biology-specific training, because none happened for this release. If the advantage is the base model, every future Astra update can lift Rosalind without a biology release.
Competitors are taking a different route. i-SCOOP notes that Anthropic's Claude Science and Google's Gemini for Science build a tooling layer around general models. OpenAI is gating a specialised one. If that holds, buyers face an architectural choice, not just a benchmark comparison.
For biologists, the near-term effect is practical. Vetted labs get a model that answers more of their questions. On OpenAI's tests, it also performs better than the previous Rosalind release. Everyone else keeps the stricter general model. Whether that split protects the public or moves risk behind a contract is the next question to answer.
The wider question is whether other domains follow. If a lab can ship one set of weights under several refusal policies, product differences move from model quality to governance. Buyers would then compare approval processes, audit rights and liability terms as closely as benchmark scores.
For regulated buyers, that shift is already visible. i-SCOOP maps the access conditions onto controls that European firms run anyway. It cites identity management and access controls under NIS2 and ISO 27001. For those buyers, the new cost is proof rather than tooling.
- •The red-team disclosure for GPT-Rosalind-6, especially on the sensitive biosecurity sets where it trails Astra.
- •Independent replication of MedChemBench v7 and GeneBench Pro v13, which currently rest on about one hundred internal problems each.
- •Access decisions. OpenAI has not published how many organisations are approved, which ones, or what triggers revocation.
- •Pricing. i-SCOOP found no separate row for the new model on OpenAI's pricing page on 31 October. The page listed two earlier Rosalind models at $5 per million input tokens and $25 per million output tokens.