Menu
SUBSCRIBE
SUBSCRIBE
Menu

biological weapons

A glowing orange sun and a blue crescent moon in a starry sky, for an article on OpenAI's GPT-6 Sol and GPT-6 Luna ratings

OpenAI Rates New GPT-6 Models High Risk For Cyberattacks And Biological Weapons

, , , , , , , , , , , ,

GPT-6 Sol and GPT-6 Luna, now available in ChatGPT for free and paid users, carry the same rating as the GPT-5.6 models they replace, and OpenAI is applying the same safeguards.

 

In a safety report published Oct. 7, OpenAI rated both versions of its new GPT-6 model, GPT-6 Sol and GPT-6 Luna, as “High” risk for cyberattacks and biological and chemical weapons attacks. By OpenAI’s definition, a model at that level could carry out an attack on well-protected computer systems largely on its own, or give someone with only basic scientific training real help in making a known biological or chemical weapon. OpenAI’s stated worry is more cyberattacks and more terror attacks. The company released both models to ChatGPT users on free and paid plans worldwide the same day.

The rating matches the one OpenAI gave GPT-5.6 Sol and GPT-5.6 Luna, the models GPT-6 now replaces in ChatGPT. OpenAI said it gave the new models the same safeguards it described in its earlier safety report on the GPT-5.6 models.

What OpenAI’s High rating means

OpenAI rates its models under its own internal risk rules, which it calls the Preparedness Framework. The rules set two danger levels. “High” covers abilities that could help people cause serious harm in ways already known. “Critical” covers abilities that could create new ways to cause harm. OpenAI’s rules say it will not release a model rated High until its safeguards “sufficiently minimize” the risk of severe harm. A group of OpenAI’s own safety leaders decides case by case. It looks for evidence that the model refuses dangerous requests and resists attempts to trick it, and that OpenAI’s monitoring would catch misuse before it causes large-scale harm. OpenAI’s leadership makes the final call.

GPT-6 tested at OpenAI’s High level but below Critical

On OpenAI’s automated hacking tests, GPT-6 Sol performed about the same as GPT-5.6 Sol, with no clear improvement, and GPT-6 Luna showed less hacking ability than Sol. In one test, Sol turned known software flaws into working attacks 82.6% of the time, against 44.7% for Luna. OpenAI said the score may be inflated because the flaws are public and the model may have seen them before.

In biology, both models scored above OpenAI’s High bar on a test that asks a model to work out why a virology lab experiment went wrong. OpenAI counts any score above 31% on that test as High-level ability. GPT-6 Sol scored 51.7% and GPT-6 Luna 48.1%.

Both models scored below OpenAI’s Critical bar on all three of its harder biology tests, which include predicting what a protein does from its makeup.

OpenAI reused the safeguards it built for GPT-5.6

OpenAI said it gave GPT-6 Sol and Luna “the same set of safeguards” as their GPT-5.6 counterparts. The new report does not list them. It says the details are in an internal report that OpenAI keeps private because the details could help attackers. OpenAI’s Safety Advisory Group, a team of its own safety leaders, and the company’s leadership concluded the safeguards are enough for a public launch.

One safeguard the report does give numbers for is built into the model itself: OpenAI trains each model to turn down dangerous requests. To measure it, OpenAI switched off its other protections and counted how often each model’s answers to dangerous requests stayed within OpenAI’s safety rules. On the most dangerous biology questions, GPT-6 Sol stayed within the safety rules 98% of the time, up from 95.4% for GPT-5.6 Sol. On cybersecurity requests, GPT-6 Sol did so 97.3% of the time, against 98.2% for GPT-5.6 Sol, which OpenAI called broadly comparable. GPT-6 Luna’s scores moved the same way.

The ratings put GPT-6 Sol and Luna one level below GPT-6 Astra, a separate OpenAI model that the company rated Critical for cybersecurity in September, the first at that level. Under OpenAI’s rules, a Critical rating requires stronger safeguards while a model is still being built, not only before release.

Researcher pipetting beside automated biohazard-labeled lab equipment, illustrating biological attack risk from AI tools

RAND Says AI Is Eroding The Barriers That Kept Biological Attacks Out Of Reach

, , , , , , , , , ,

An attacker had to know a great deal, be good at lab work, and get into a laboratory, and RAND says AI weakens all three at once, putting a pandemic-scale attack within reach of people who could not have attempted one.

Key Takeaways

  • AI expands the number of people who could carry out a successful biological attack, RAND said. Three practical things have limited who could try: knowing enough, being good enough at lab work, and getting into a lab.
  • Cloud laboratories run experiments for customers who are never in the room. The machines do the steps, so customers no longer need years of practice to get them right.
  • Every existing control is physical: entering a lab, buying material, handling a pathogen. Work that AI moves onto a screen passes none of them.
  • Most attackers cannot make accurate genetic material themselves, so they buy it from commercial DNA suppliers, who compare each order against a list of known dangerous sequences. RAND said AI can design a sequence that still does the dangerous thing but looks different enough to get through.
  • Frontier AI companies decided their mid-2025 models might give real help to someone with no experience. RAND noted OpenAI and Anthropic called those decisions precautionary, not a response to evidence that the models had helped anyone.

The three things that previously made a biological attack hard to carry out are weakening at once, and the defenses built around them have not moved, according to a RAND Corporation report published on August 18.

Before, an attacker needed expert-level scientific knowledge, lab access, the skills to run physical experimentation, and access to physical materials. Current biosecurity controls are physical. They govern who can enter a lab, who can buy material, and who can handle a pathogen. Work done with AI circumvents all of these, expanding the number of people who could carry out a successful biological attack.

 

AI lowers the knowledge barrier 

RAND said a model can pull together technical information that would normally take an expert to find, and can talk a novice user through a failed experiment the way a senior scientist would.

Models also close the time between running an experiment and understanding what went wrong, moving the need for physical experimentation to a later stage of development.

 

Cloud labs remove the need to ever be in a laboratory and are more vulnerable to assisting in bio-weapon development

Cloud laboratories run experiments for customers who are never in the room. A user sends a design, the lab runs it, and the results come back. RAND said this lets someone go from a design on a screen to a physical test without ever setting foot in a lab.

The machines also do the steps, so the user does not need years of practice to get them right. Some services now cover the whole sequence: designing the experiment, writing the instructions, ordering the material, and running it. Work that used to require a trained researcher gets done by the service.

Current virtual lab security can’t necessarily detect if it’s developing a biohazard. AI models that design genetic material that never existed can bypass virtual lab security protocols because the lab has nothing on record to match the material against a list of known threats.

 

AI can order dangerous bio-material

Building a pathogen takes physical starting material, and most bad actors cannot make accurate genetic material themselves, so they could buy it from commercial companies that make DNA to order. Those companies check an order by comparing it against a list of known dangerous sequences. RAND said AI can now design a sequence that still does the dangerous thing but looks different enough from anything on the list to get through company checks. Now, the check has to move from comparing sequences to working out what a sequence might actually do.

Benchtop DNA machines make it harder. These are laboratory-grade devices that synthesize, sequence, and/or analyze DNA on a standard work desk. As more labs buy their own, RAND said the check has to be built into the machine itself.

 

Frontier developers already flagged their own models

Several frontier AI companies decided their mid-2025 models might help someone with no experience build a biological weapon, and added refusals and detection software in response. RAND noted that OpenAI and Anthropic called those decisions precautionary, not a response to evidence that the models had helped anyone.

Those safeguards can be worked around by someone with enough time, money, and technical skill. For open-weight models, whose files anyone can download, there are no safeguards at all. The main method for taking a capability out of a model after training can be reversed by training it back in.

 

What happens next

RAND’s AI biosecurity strategy names nine measures. Four can be built with what already exists. They are: 

  1. Checking DNA orders across more suppliers
  2. Setting rules for who can use the riskiest biological AI tools
  3. Watching what users ask AI models and reporting the concerning cases
  4. Expanding environmental testing to catch pathogens early. 

RAND wants those four running by early 2028

Two of the nine do not exist in any form. Nobody knows how to safeguard an open-weight model, and nobody can trace a designed pathogen back to the person or the model that made it. Both need research before anyone can build them.

The remaining three, including a shared system for pooling flagged customer activity across AI companies and DNA suppliers, need new legal authority and federal money first.

RAND’s case for moving now comes down to timing. The defenses take years to build, and AI keeps improving while they are being built. Waiting for proof that a model helped someone make a weapon means starting those years of work against a threat that has already arrived. 

 

Methodology

RAND looked at events roughly ten times the scale of the COVID-19 pandemic or larger, and at prevention only, meaning what can be done before a pathogen is released. It broke the process into seven stages, from deciding to create a pathogen through design, building, testing, and weaponization, and said AI helps most in the early stages.