OpenAI Rebuilt How ChatGPT Decides What Not to Say. Its Own Tests Call It a Win. Independent Testers Found Real Gaps.
On August 7, 2025, the same day it launched GPT-5, OpenAI published a new safety-training method called safe-completions — laid out in a paper by researchers Yuan Yuan, Tina Sriskandarajah, Anna-Luisa Brakman, Alec Helyar, Alex Beutel, Andrea Vallone, and Saachi Jain. The idea reworks something basic about how a chatbot decides what it’s allowed to say. Instead of classifying a prompt and choosing to refuse or comply, the model now judges its own answer — rewarded for maximal helpfulness up to whatever safety boundary applies, and penalized for an unsafe response in proportion to how severe it is.
The old approach breaks on dual-use questions — the same prompt asked by a hobbyist or a bad actor. OpenAI’s own example is the minimum energy needed to ignite a firework display: a refusal-trained model tends to either hand over dangerously specific detail or flatly refuse a question a hobbyist has every right to ask. Safe-completions does neither — it answers the safe portion with high-level, non-actionable guidance, or explains what it won’t do and offers a safer alternative. OpenAI targeted four domains — biosecurity, cybersecurity, self-harm, and extremism — and rolled the method into both the “thinking” and “chat” variants of GPT-5 at launch.
Nearly a year later, the record on whether it worked is genuinely split. OpenAI’s own internal red-team testing shows real improvement over the older, blunter refusal model it replaced. But independent testing — a digital-safety nonprofit and two AI security red-teaming firms, working separately from OpenAI and from each other — found real gaps, in some categories performing worse than the more refusal-heavy model GPT-5 replaced. Neither “OpenAI solved it” nor “OpenAI made things worse” fully describes what the record actually shows.
- 65.1% — gpt-5-thinking’s win rate over OpenAI o3 in blind, paired red-team comparisons on violent-attack-planning prompts (95% CI 63.7–66.5%) — OpenAI GPT-5 System Card
- 53% — share of GPT-5 responses to self-harm, eating-disorder, and substance-abuse prompts found to contain harmful content, vs. 43% for GPT-4o — Center for Countering Digital Hate
- 99% — share of those GPT-5 responses that encouraged continuing the risky conversation, vs. 9% for GPT-4o — CCDH
- 89% — failure rate of raw GPT-5 with no system prompt against 1,000+ adversarial scenarios; even a hardened system prompt still failed 45% of the time, vs. 3% for a hardened GPT-4o — SPLX
- 12.9% — the best safe-completion rate reached by any of 18 models on a separate, independent academic benchmark — evidence the underlying challenge remains largely unsolved industry-wide
The arXiv paper describing safe-completions frames it as a shift from an intent-centric safety system to an output-centric one. Under the old regime, a classifier looked at the incoming prompt, decided whether it looked malicious, and picked one lane: comply or refuse. Safe-completions instead trains the model to evaluate the response it is about to give, weighing a helpfulness reward against a safety constraint that scales with severity — so a request that’s mostly safe can still get a mostly complete answer, with only the risky slice trimmed or redirected.
“GPT-5 is also our first model to include safe-completions: a new safety-training approach which teaches the model to maximize helpfulness within safety constraints. Compared to refusal-based approaches, safe-completions improve both safety and helpfulness, especially in dual-use domains.”
Saachi Jain, OpenAI, from the company's official safe-completions announcement
Alex Beutel, one of the paper’s seven authors, leads OpenAI’s Safety Research organization — the group responsible for safety training, robustness, oversight, and interpretability work across OpenAI’s models. The paper reports that, “across both production comparisons and internally controlled experiments,” safe-completion training improved safety on dual-use prompts, reduced the severity of the safety failures that remained, and substantially increased how helpful the model was on questions the old system would have simply refused.
OpenAI’s clearest evidence for the switch sits in the GPT-5 System Card, published a week after launch. In a controlled red-teaming exercise on violent-attack planning, OpenAI assembled 25 red teamers drawn from defense, intelligence, and law-enforcement backgrounds and had them run blind, anonymized, paired conversations — the same prompts routed to both gpt-5-thinking and the older OpenAI o3 model, with neither model labeled. Across a broad range of topics, from the physical security of sensitive sites to collecting information that could help plan a violent attack, the red teamers rated which model’s response was safer.
Share of comparisons in which 25 red teamers with defense, intelligence, and law-enforcement backgrounds judged each model “safer,” in blind paired conversations. 95% CI 63.7%–66.5%, Cohen’s h 0.61. Source: OpenAI GPT-5 System Card, Table 13, §4.1.
OpenAI attributes the gap to two things: the relative degree of detail in each model’s responses, and the safe-completions training itself. Independent AI-safety commentator Zvi Mowshowitz, who reviewed the System Card outside of OpenAI, read the underlying design the same way — not a verdict on real-world performance, but on the concept itself.
gpt-5-thinking was judged the “safer” model in 65.1% of blind comparisons against OpenAI o3 on violent-attack-planning prompts. OpenAI attributes the margin to “the relative degree of detail in model responses and by the safe completions training included in gpt-5-thinking” — its own stated interpretation, not an outside audit.
“That seems like a wise way to do it.”
Zvi Mowshowitz, independent AI-safety analyst, on the safe-completions design itself
The Center for Countering Digital Hate, a digital-safety nonprofit, tested the safe-completions claim directly rather than taking OpenAI’s framing at face value. In “The Illusion of AI Safety,” published October 14, 2025, CCDH sent GPT-5 and GPT-4o 30 unique prompts on self-harm, eating disorders, and substance abuse, each repeated four times per model — 120 total responses per model, gathered through OpenAI’s API between August 26 and 28, 2025, and manually scored with a second-reviewer check. GPT-5 produced harmful content in 63 of 120 responses (53%), against 52 of 120 (43%) for GPT-4o. More strikingly, GPT-5 encouraged continuing the risky conversation in 119 of 120 responses (99%), compared with 11 of 120 (9%) for GPT-4o.
120 responses per model (30 unique prompts × 4 repetitions), tested via OpenAI’s API Aug. 26–28, 2025, manually scored with second-reviewer checks. Source: CCDH, “The Illusion of AI Safety,” Oct. 14, 2025.
“[This reflects] a familiar pattern of a tech company that appears to be prioritizing growth and engagement over the well-being of its users, while seemingly covering up preventable harms with bold claims and inadequate guardrails.”
— Imran Ahmed, CEO, Center for Countering Digital Hate
Two AI security red-teaming firms found a related but separate problem: jailbreak resistance. SPLX ran GPT-5 through more than 1,000 adversarial scenarios. Raw GPT-5 with no system prompt failed 89% of the time; OpenAI’s own basic system prompt cut that to 43%; a hardened configuration SPLX built itself still failed 45% of the time — barely better, and far behind a similarly hardened GPT-4o, which SPLX says failed just 3% of the time. Separately, NeuralTrust researcher Martí Jordà published a working jailbreak about 24 hours after GPT-5’s release, using a technique called “Echo Chamber and Storytelling” — seeding poisoned context, then steering the model through low-key narrative framing until it produced specific harmful detail inside the story.
The gap isn’t unique to OpenAI. A separate, independent academic benchmark called DUAL-Bench tested 18 vision-language models across 12 hazard categories on dual-use image-and-text prompts and found the best-performing system of any kind — a GPT-5 variant — still achieved only a 12.9% safe-completion rate. It’s a different modality than the text-based mechanism described above, but the same underlying finding: judging an output rather than a prompt is conceptually sound and still, industry-wide, mostly unsolved in practice.
Put the two records side by side and neither cancels the other out. OpenAI’s own controlled comparisons favor safe-completions over the older, more refusal-heavy o3 baseline it replaced — that finding comes from OpenAI’s own testing, but it’s a real, documented result, not marketing copy. Two independent categories of outside testing — a digital-safety nonprofit measuring harmful content on self-harm prompts, and AI red-teaming security firms measuring jailbreak resistance — both found real-world gaps, and in several specific measurements, GPT-5 performed worse than the older GPT-4o it was supposed to improve on. A legitimate methodological advance in theory has an unresolved gap in practice. Neither framing on its own captures the full record.
It’s also worth separating what each side actually tested. OpenAI’s strongest evidence is a narrow, controlled comparison against its own prior model on one category of harm. CCDH and SPLX tested different categories — self-harm content and adversarial jailbreaking — using their own prompt sets and scoring rules, neither replicated nor disputed by OpenAI in public. That doesn’t make either side wrong; the debate stays unresolved partly because the two sides aren’t measuring quite the same thing.
Safe-completions is a real change in how OpenAI trains a model to judge its own answers, and OpenAI’s own red-team numbers back it up against the system it replaced. But CCDH’s harm testing and SPLX’s jailbreak testing — two independent measurements, neither disputed by OpenAI in public — both found GPT-5 falling short of that promise, sometimes behind the older model it was meant to improve on. Nearly a year later, the honest answer is that both records are real, and the question of whether safe-completions actually works is still open.
