OpenAI

GPT-5

Published evidence on capabilities, behavioral tendencies and observed actions.

First public availability: 2025-08-07
Parameters: Not disclosed
Metadata updated: 2026-10-27

Evidence overview

Published risk evidence is organized by assessment and protocol. Missing evidence is not a low-risk finding.

NUWA curates and interprets these sources. Experiments are attributed to their original executors; this page does not claim NUWA has independently replicated them.

MODEL MONITORING

Representative benchmark coverage

Results by protocol and configuration; gaps show records awaiting collection or linkage.

AgentCyberRange →

No eligible measurement linked to this model version.

Cybench →

1 measurements

73.5%NIST / CAISI · CAISI ReAct-style agent; Inspect

CyberGym →

2 measurements

60.2%Not disclosed · SageAgent
39.4%Not disclosed · OpenHands

METR Time Horizons →

2 measurements

203.01 minMETR · mtb/start_metr_task,triframe_inspect/triframe_agent; ai_rd_fix_embedding/init_solver,use_tools,triframe_inspect/triframe_agent; re_bench_common/init_solver,use_tools,triframe_inspect/triframe_agent; metr_tasks_swaa/init_solver,generate; triframe_inspect/triframe_agent
38.31 minMETR · mtb/start_metr_task,triframe_inspect/triframe_agent; ai_rd_fix_embedding/init_solver,use_tools,triframe_inspect/triframe_agent; re_bench_common/init_solver,use_tools,triframe_inspect/triframe_agent; metr_tasks_swaa/init_solver,generate; triframe_inspect/triframe_agent

SEC-bench Pro →

No eligible measurement linked to this model version.

MASK →

No eligible measurement linked to this model version.

Attempt to Persuade Eval (APE) →

No eligible measurement linked to this model version.

DeceptionBench →

No eligible measurement linked to this model version.

PersuSafety →

No eligible measurement linked to this model version.

All linked measurements

Each result retains its protocol and unit.

9 observations

Measurements and source conditions
System / model	Result	Condition status	Task / conditions	Evaluator / report	Dates
GPT-5 · SageAgentGPT-5	60.2%CyberGym · Success rate	Incomplete	level1score_10SageAgent	Not disclosedCyberGym official leaderboard and machine-data extraction	Release 2025-08-07Report —
GPT-5 · OpenHandsGPT-5	39.4%CyberGym · Success rate	Incomplete	level1score_10OpenHands	Not disclosedCyberGym official leaderboard and machine-data extraction	Release 2025-08-07Report —
OpenAI GPT-5GPT-5	73.5%Cybench · Reported benchmark performance	Incomplete	Cybenchmedium reasoning effort500,000 weighted tokens per agentic task (Appendix A2)CAISI ReAct-style agent; Inspect	NIST / CAISIEvaluation of DeepSeek AI Models	Release 2025-08-07Report 2025-09-30
GPT-5	88%Shutdown resistance in reasoning models · bypass rate: No Shutdown Instructions (A)	Incomplete	Shutdown Resistancebypass rate: No Shutdown Instructions (A)—	Palisade ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2025-08-07Report 2026-05-29
GPT-5	99.5%Shutdown resistance in reasoning models · bypass rate: Instructed to Resist — Baseline Competence (K)	Incomplete	Shutdown Resistancebypass rate: Instructed to Resist — Baseline Competence (K)—	Palisade ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2025-08-07Report 2026-05-29
GPT-5	88.4%Shutdown resistance in reasoning models · bypass rate: A / K	Incomplete	Shutdown Resistancebypass rate: A / K—	Palisade ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2025-08-07Report 2026-05-29
GPT-5	0%Shutdown resistance in reasoning models · bypass rate: Instructed to allow shutdown — Disambiguated (E)	Incomplete	Shutdown Resistancebypass rate: Instructed to allow shutdown — Disambiguated (E)—	Palisade ResearchEvaluating DeepSeek v4 Pro for Frontier Risks	Release 2025-08-07Report 2026-05-29
GPT-5 · METR scaffoldGPT-5	203.01 minMETR Time Horizons · 50% task-completion horizonSource 95% CI [112.641357, 405.551565] min	Incomplete	METR-Horizon-v1.1mtb/start_metr_task,triframe_inspect/triframe_agent; ai_rd_fix_embedding/init_solver,use_tools,triframe_inspect/triframe_agent; re_bench_common/init_solver,use_tools,triframe_inspect/triframe_agent; metr_tasks_swaa/init_solver,generate; triframe_inspect/triframe_agent	METRMETR Time Horizon 1.1 — source data	Release 2025-08-07Report —
GPT-5 · METR scaffoldGPT-5	38.31 minMETR Time Horizons · 80% task-completion horizonSource 95% CI [19.184874, 70.093125] min	Incomplete	METR-Horizon-v1.1mtb/start_metr_task,triframe_inspect/triframe_agent; ai_rd_fix_embedding/init_solver,use_tools,triframe_inspect/triframe_agent; re_bench_common/init_solver,use_tools,triframe_inspect/triframe_agent; metr_tasks_swaa/init_solver,generate; triframe_inspect/triframe_agent	METRMETR Time Horizon 1.1 — source data	Release 2025-08-07Report —

Developer disclosures

Update to GPT-5 System Card: GPT-5.2 →

Developer documentation covering GPT-5, GPT-5.2.

2025-12-11

Section map only

External assessments

Neo Research

Evaluating DeepSeek v4 Pro for Frontier Risks →

The report separates task capability from pressure-induced behavior and notes format dependence in persuasion assessment.

2026-05-29

NIST / CAISI

Evaluation of DeepSeek AI Models →

Reported differences depend on task, scaffold and scoring; institutional judgments are retained as source judgments rather than NUWA findings.

2025-09-30

METR

METR Time Horizon 1.1 →

Estimated task difficulty at 50% and 80% success, measured in human-expert minutes.

Publication date not established

CyberGym official snapshot →

Published evaluation results collected from CyberGym, retaining the reported systems and configurations.

Publication date not established

Evidence by risk topic

Autonomy 5 protocol results

METR Time Horizon 1.1 →

External evaluation · Executed by METR

50% task-completion horizon: 203.01 min
80% task-completion horizon: 38.31 min

Task counts/weights vary with source tasks and scaffold coverage; see methodology.

Shutdown resistance →

Reused result · Executed by Palisade Research · Original executor Palisade Research

bypass rate: No Shutdown Instructions (A): 88%

Per-result sample size not disclosed

Shutdown resistance →

Reused result · Executed by Palisade Research · Original executor Palisade Research

bypass rate: Instructed to Resist — Baseline Competence (K): 99.5%

Per-result sample size not disclosed

Shutdown resistance →

Reused result · Executed by Palisade Research · Original executor Palisade Research

bypass rate: A / K: 88.4%

Per-result sample size not disclosed

Shutdown resistance →

Reused result · Executed by Palisade Research · Original executor Palisade Research

bypass rate: Instructed to allow shutdown — Disambiguated (E): 0%

Per-result sample size not disclosed

Deception No structured result linked

A gap in this collection is not evidence of low risk. Consult the linked reports for unextracted findings and protocol scope.

Cybersecurity 3 protocol results

CyberGym · level1 · score_10 →

External evaluation · Executed by

Success rate: 60.2%

Per-result sample size not disclosed

CyberGym · level1 · score_10 →

External evaluation · Executed by

Success rate: 39.4%

Per-result sample size not disclosed

Cybench →

External evaluation · Executed by NIST / CAISI

Reported benchmark performance: 73.5%

Source denominator: 40 (unit not disclosed)

CBRN No structured result linked

A gap in this collection is not evidence of low risk. Consult the linked reports for unextracted findings and protocol scope.

Disinformation No structured result linked

A gap in this collection is not evidence of low risk. Consult the linked reports for unextracted findings and protocol scope.

Autonomous physical harm No structured result linked

A gap in this collection is not evidence of low risk. Consult the linked reports for unextracted findings and protocol scope.

Source review and evidence gaps

CyberGym →

Published evaluation results collected from CyberGym, retaining the reported systems and configurations.

The site reports submitted systems under different configurations. Per-row task counts, budgets and execution dates are not fully disclosed. Undefined metrics and unresolved identity rows are excluded. Raw JSON fractions are shown as percentages using ×100 and one-decimal rounding, matching the official renderer.

Evaluating DeepSeek v4 Pro for Frontier Risks →

Source-specific extraction of Neo Research · DeepSeek V4 Pro. Findings and measurements retain their original attribution.

Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.

Evaluation of DeepSeek AI Models →

Source-specific extraction of CAISI · DeepSeek models. Findings and measurements retain their original attribution.

Source transcription is not experimental replication. Unknown dates, evaluator roles and configuration details remain unknown. Source groups are not verified rankings.

Missing scores may reflect unextracted sections, undisclosed configurations, unresolved identity or an absent experiment. These are separate research questions; none implies a zero result.

Interpretation and open questions

Differences between reports can reflect task selection, model endpoints, prompts, budgets, judges and publication dates. Evidence is grouped by the protocol actually used; no model-wide safety grade is inferred.

References

[1] OpenAI — introducing gpt 5 ; Publication date and availability section; Parameter counts not disclosed in launch article
[2] METR Time Horizon 1.1 — source data ; results.gpt_5_2025_08_07_inspect
[3] Evaluating DeepSeek v4 Pro for Frontier Risks. 2026-05-29. v1.1 · 29 May 2026 ; PDF p. 24; Shutdown Resistance; bypass rate: No Shutdown Instructions (A); PDF p. 24; Shutdown Resistance; bypass rate: Instructed to Resist — Baseline Competence (K); PDF p. 24; Shutdown Resistance; bypass rate: A / K
[4] Evaluation of DeepSeek AI Models. 2025-09-30. 30 September 2025 ; p. 24, Table 4.1, row Cybench, column OpenAI GPT-5
[5] Update to GPT-5 System Card: GPT-5.2. 2025-12-11
[6] CyberGym official leaderboard and machine-data extraction ; /level1/58/score_10; /level1/73/score_10