Yesterday, we published our analysis of DeepSeek V4.
In this article, we focus our analysis on the system card for OpenAI’s GPT-5.5, the newest frontier model. The 45-page document is dense, technical, and—if you read between the lines—reveals just how fast the capability curve is steepening and how much harder the safety problem is becoming. GPT-5.5 is not just another incremental release. It is a model designed for complex, real-world work: writing code, researching online, analyzing information, creating documents and spreadsheets, and moving across tools to get things done. OpenAI describes it as a model that “understands the task earlier, asks for less guidance, uses tools more effectively, checks its work and keeps going until it’s done.”
We will walk through the key findings from the system card, focusing on what the benchmarks actually tell us, the cybersecurity implications that should concern every CISO, the biological risk evaluations, the alignment and safety innovations, and the broader trajectory of agentic AI.
GPT-5.5 was trained on diverse datasets—publicly available internet data, third-party partnerships, and user/trainer-generated information—with rigorous filtering to reduce personal information and harmful content. Like other models in the GPT-5 series, it is trained to reason through reinforcement learning. The model produces a long internal chain of thought before responding, and through training, it learns to refine its thinking, try different strategies, and recognize its mistakes.
There is also GPT-5.5 Pro, which is the same underlying model but uses parallel test-time compute—more time to think. OpenAI generally treats GPT-5.5’s safety results as strong proxies for GPT-5.5 Pro, but separately evaluates the Pro version where additional compute could materially change the risk profile.
Before release, OpenAI subjected the model to its full suite of predeployment safety evaluations and its Preparedness Framework, including targeted red-teaming for advanced cybersecurity and biology capabilities. Nearly 200 early-access partners provided feedback on real use cases before launch.
OpenAI evaluated GPT-5.5 against “Production Benchmarks”—challenging examples drawn from real production data where previous models gave non-ideal responses. These are deliberately difficult cases, not representative of average traffic.
On most disallowed content categories, GPT-5.5 performs on par with GPT-5.4-Thinking. Violent illicit behavior compliance rose to 0.979 from 0.971. Harassment compliance improved to 0.822 from 0.790. However, there were regressions: extremism dropped to 0.925 from 1.000, and hate dropped to 0.868 from 0.943—though OpenAI notes the hate regression was caused by translation requests that do not actually violate their policies. Most regressions are not statistically significant, but they illustrate the challenge of maintaining safety across every category simultaneously.
On representative production traffic, approximately 0.056% of conversation turns would be marked as potentially violating the harassment policy. These numbers do not account for other safety stack layers, so actual production rates should be lower.
One of the most practically important improvements in GPT-5.5 is its ability to avoid accidental data-destructive actions. When agents operate in complex workspaces—deleting files, reverting changes, cleaning up—they can easily destroy user work. This is not a theoretical concern. In real-world agentic deployments, models frequently operate deletion-inducing tasks like file reversion and cleanup in complex workspaces where users or even other agents are making concurrent changes.
GPT-5.5 scores 0.90 on destructive action avoidance, up from 0.86 for GPT-5.4-Thinking and 0.88 for GPT-5.3-Codex. More impressively, the “perfect reversion” score—where the model reverts only its own changes while preserving user work—jumped to 0.52 from 0.18. That is nearly a threefold improvement. The “user work preserved” metric also improved to 0.57 from 0.53.
OpenAI specifically trained their agents to revert their own changes after long rollouts while protecting implicit, simulated user work. This matters because as AI agents take on longer, more complex tasks in shared environments, the ability to distinguish between “my work” and “the user’s work” becomes critical. A model that aggressively cleans up its own mess but accidentally deletes your uncommitted code changes is worse than useless. GPT-5.5 is significantly better at this than any predecessor.
GPT-5.5 was evaluated on HealthBench, HealthBench Hard, HealthBench Consensus, and HealthBench Professional. OpenAI now reports length-adjusted scores to account for the fact that longer responses can artificially inflate benchmark results.
The length-adjusted HealthBench score is 56.5, a 2.5-point improvement over GPT-5.4. HealthBench Hard improved by 2.4 points to 31.5. HealthBench Professional—which evaluates clinician use cases—saw the largest gain, rising 3.7 points to 51.8. HealthBench Consensus remained flat at 95.6.
OpenAI also ran dynamic multi-turn evaluations for mental health, emotional reliance, and self-harm using adversarial user simulations that evolve in response to the model’s outputs. GPT-5.5 achieved 0.981 compliance on mental health and emotional reliance scenarios, and 0.937 on self-harm—a notable regression from GPT-5.4’s 0.977 that warrants attention.
On conversations that users had flagged as containing factual errors—deliberately hallucination-prone cases, not representative of all traffic—GPT-5.5’s individual claims were 23% more likely to be factually correct compared to GPT-5.4. Responses contained a factual error 3% less often. However, GPT-5.5 tends to make more factual claims per response than GPT-5.4, which explains the gap between claim-level and response-level improvements. More claims per response means more chances to get something wrong, even if each individual claim is more reliable. This is a trade-off inherent to more verbose, more detailed models.
The cybersecurity section of the GPT-5.5 system card is, without exaggeration, the most consequential part of the document. OpenAI rates GPT-5.5 as “High” capability in cybersecurity—the same rating as GPT-5.4-Thinking—but the underlying numbers tell a story of rapid capability escalation. Under OpenAI’s Preparedness Framework, “Critical” cybersecurity capability is defined as a model that can “identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention” or “devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high level desired goal.” GPT-5.5 does not meet this threshold. But it is getting closer.
