News follow-up · Frontier models
Frontier model risk ratings: what happened since
The "medium" rating that made news in August 2024 came from a four-category scorecard. The scorecard was rewritten in April 2025, one category was dropped, and a year after GPT-4o the same company rated its next model "High" in one category and shipped it with safeguards.
What this site reported
On 15 August 2024 the earlier version of this site reported that OpenAI's system card had rated GPT-4o a "medium" risk and asked what the label meant.
What the record shows now
The system card of 8 August 2024 explains the label. The company's Preparedness Framework then covered four categories: cybersecurity; chemical, biological, radiological and nuclear; persuasion; and model autonomy.[1] The internal Safety Advisory Group rated GPT-4o before mitigations as "borderline medium" for persuasion and low in the other three, and because the overall score is the highest of the four, the model was classified medium.[1] The card also states the rule the label served: a model that passes a high threshold is not deployed "until mitigations lower the score to medium".[1]
Version 2 of the framework, dated 15 April 2025, changed the scorecard. It tracks three categories, biological and chemical, cybersecurity, and AI self-improvement, and treats long-range autonomy and autonomous replication as research categories rather than tracked ones.[2] Persuasion is out: the document says persuasion risks "do not fit the criteria for inclusion", because the framework is now limited to harms that meet a definition of severe harm, which it sets as the death or grave injury of thousands of people or hundreds of billions of dollars of economic damage.[2] So the category that produced GPT-4o's medium rating no longer exists in the framework.
The GPT-5 system card, dated 13 August 2025 on its first page, applies the new version. The company says it "decided to treat gpt-5-thinking as High capability in the Biological and Chemical domain" and activated the associated safeguards, while stating that it did not have "definitive evidence" that the model could help a novice create severe biological harm and that it chose "a precautionary approach".[3] The card also records that early access was given to the U.S. Center for AI Standards and Innovation under an updated agreement and to the U.K. AI Security Institute, both of which evaluated the model's cyber, biological and chemical capabilities and its safeguards.[3]
| Document | Categories tracked | Rating or change |
|---|---|---|
| GPT-4o, 8 August 2024 | Cybersecurity, CBRN, persuasion, model autonomy | Medium (persuasion borderline medium; the rest low) |
| Framework version 2, 15 April 2025 | Biological and chemical, cybersecurity, AI self-improvement | Persuasion removed from the tracked list |
| GPT-5 (gpt-5-thinking), 13 August 2025 | As in version 2 | Treated as High in biological and chemical, as a precaution |
What it means for public bodies
A rating such as "medium" or "High" is a term defined inside one company's framework, and the framework changes: the 2024 and 2025 ratings were made against different category lists and different thresholds.[1][2][3] An agency that writes a model's rating into a procurement record should write the framework version and date next to it. The one external check named in these documents is the pre-release testing by the U.S. and U.K. institutes, whose results are described in the card but not published as numbers there.[3]
See also: Frontier model safety: what happened since and Generative AI in government.
Sources
- OpenAI, GPT-4o System Card, 8 August 2024. Read 29 October 2026.
- OpenAI, Preparedness Framework, version 2, 15 April 2025. Read 29 October 2026.
- OpenAI, GPT-5 System Card, 13 August 2025. Read 29 October 2026.
How this page was checked: the three documents were read from the company's file server on 29 October 2026, and the dates given are the dates printed on each document's first page. The company's web pages were not consulted; the record used is the three documents alone.