OpenAI publishes gpt-oss model card and worst-case open-weight risk estimate

Alongside releasing gpt-oss-120b and gpt-oss-20b as open-weight models, OpenAI published a companion paper and model card addressing a problem specific to open weights: once published, a model cannot be patched, monitored or withdrawn if it turns out to be dangerous, unlike an API-gated model whose access OpenAI controls directly.

The paper’s method was to deliberately try to make gpt-oss as dangerous as possible before release, rather than simply testing the model as shipped. Researchers ran “malicious fine-tuning” on gpt-oss in two domains: for biological risk, they trained it with tasks related to threat creation and gave it web-browsing access; for cybersecurity, they trained it in an agentic coding environment against capture-the-flag challenges. The resulting maximally-tuned models were then compared against OpenAI’s closed frontier models under the company’s Preparedness Framework thresholds.

OpenAI reported that the adversarially fine-tuned gpt-oss underperformed its own o3 model — itself rated below the framework’s “High” capability threshold for biological and cyber risk — on both domains, and did not substantially advance the capability frontier already available from other open-weight models. The company said the exercise was intended partly as a methodological template for other developers weighing open-weight releases, and partly as evidence supporting its own decision to publish gpt-oss’s weights despite the irreversibility concern. The paper’s conclusions rested on OpenAI’s own fine-tuning effort standing in for what a determined external attacker could achieve — a proxy critics of open-weight release have argued may understate real-world adversarial capability, since it cannot rule out more effective attacks that OpenAI’s own team did not find.