The Preparedness Framework is the risk-management policy maintained by openai for tracking, evaluating, forecasting, and mitigating catastrophic risks from frontier artificial-intelligence models. First published in beta form on 18 December 2023 and substantially revised on 15 April 2025, it codifies the conditions under which OpenAI commits to deploy, halt deployment of, or halt development of a frontier model on the basis of capability evaluations. It is OpenAI's counterpart to Anthropic's Responsible Scaling Policy and a leading example of an AI safety governance commitment among frontier labs.[1][2]

Under the current Version 2 framework, OpenAI tracks three frontier-capability categories (Biological and Chemical, Cybersecurity, and AI Self-Improvement) and classifies a model at one of two thresholds, High or Critical. A model that reaches High capability "must have safeguards that sufficiently minimize the associated risk of severe harm before they are deployed," and a model that reaches Critical capability additionally requires safeguards during development. OpenAI defines "severe harm" in a footnote of the framework as "the death or grave injury of thousands of people or hundreds of billions of dollars of economic damage."[2][11]

On 1 September 2026 the framework was invoked at the Critical level for the first time. OpenAI said that Astra, the model it launched two days later as GPT-6 Astra, "meets the Critical cybersecurity capability threshold under our Preparedness Framework," that it was "the first model we are designating at this level," and that the model's safeguards "sufficiently minimize the risk of severe harm for release."[43][44] The designation is OpenAI's own classification under its own policy, reached through the internal process the framework describes, rather than an independent certification; the GPT-6 Astra system card presents its safeguards case as "a public summary of our internal Safeguards Report."[45]

The framework is OpenAI's analog to Anthropic's Responsible Scaling Policy (RSP) and to google deepmind's Frontier Safety Framework (FSF). All three documents share the structure of a "risk-informed development policy": a defined set of dangerous capability categories, a set of capability or risk thresholds, evaluations ("scorecards" or "capability reports") that locate a model on those thresholds, and commitments about safeguards or non-deployment that are triggered when a threshold is crossed.[3][4]

The framework is maintained by OpenAI's internal Preparedness team, which was announced in October 2023 and originally led by computer scientist Aleksander Mądry. Outputs of the framework, including capability evaluations and safety reasoning, are reviewed by an internal Safety Advisory Group (SAG) that issues recommendations to OpenAI leadership and the Safety and Security Committee of the OpenAI Board of Directors; final deployment decisions rest with the CEO or a person designated by them.[2][5]

Key facts


Published	18 December 2023 (Beta, v1)[1]
Latest version	Version 2, 15 April 2025 (on 18 August 2026 OpenAI said it "will evolve" the framework)[2][42]
Maintainer	OpenAI Preparedness team / Safety Advisory Group[2]
Tracked categories (v2)	Biological and Chemical, Cybersecurity, AI Self-Improvement[2]
Capability thresholds (v2)	High, Critical[2]
First High designation	Biological and Chemical: ChatGPT Agent, July 2025[28]; Cybersecurity: February 2026, with the post linking OpenAI's GPT-5.3-Codex announcement[43]
First Critical designation	Cybersecurity: Astra (launched as GPT-6 Astra), announced 1 September 2026, OpenAI's own classification[43][45]
Subject	Tracking, evaluating, and mitigating catastrophic risks from frontier AI models[1]

What is the Preparedness Framework?

OpenAI announced the formation of a dedicated Preparedness team on 26 October 2023 as part of a broader expansion of safety work that also included its (later disbanded) Superalignment team.[5][6] The team's stated mission was to "tightly connect capability assessment, evaluations, and internal red teaming for frontier models, from the models we develop in the near future to those with AGI-level capabilities," and to develop and maintain a "Risk-Informed Development Policy" that would govern decisions about whether and how to deploy or further train frontier models.[5]

The team was led by Aleksander Mądry, a tenured professor of computing at MIT and director of MIT's Center for Deployable Machine Learning, who joined OpenAI on leave from his academic post.[5][7] In conjunction with the launch, OpenAI offered a "Preparedness Challenge": ten USD 25,000 API-credit prizes for the best public submissions identifying plausible and underexplored frontier-AI catastrophic risk scenarios.[6]

The Preparedness team was conceived as one leg of a three-part safety apparatus: the Safety Systems team handled product-level abuse risk in deployed systems such as gpt 4o, the Superalignment team studied alignment of future "superintelligent" systems, and the Preparedness team was responsible for catastrophic-risk capability evaluation of the near-term frontier.[5][8] The first written output of the Preparedness team was the beta Preparedness Framework, published roughly two months after the team's announcement.[1]

What did Version 1 (Beta, December 2023) cover?

Version 1, formally titled "Preparedness Framework (Beta)," was published as a 27-page PDF on 18 December 2023.[1][9] OpenAI characterized it as "a beta document" and "a living document" that would be revised in response to feedback and operating experience.[1]

Tracked risk categories

The Beta framework committed OpenAI to evaluating frontier models in four "tracked risk categories":[1][9]

Cybersecurity: uplift to offensive cyber-operations capability;
Chemical, Biological, Radiological, and Nuclear (CBRN) threats: uplift to creation or acquisition of weapons of mass destruction;
Persuasion: capability to generate persuasive content that could change beliefs at scale; and
Model autonomy: the capability of a model to act, self-exfiltrate, or accumulate resources autonomously without human direction.

OpenAI also acknowledged "unknown unknown" risk categories that might emerge over time and committed to revising the framework as new categories were identified.[1]

Risk levels

For each tracked category, the framework defined four discrete risk levels: Low, Medium, High, and Critical.[1][9] Each level was tied to an illustrative threshold describing the kinds of real-world uplift the model would have to provide to qualify.[1]

Two operational commitments anchored the framework. Only models with a post-mitigation score of "medium" or below could be deployed, and only models with a post-mitigation score of "high" or below could be developed further.[1][9] A "Critical" determination in any category would therefore halt further development of that model.[1]

Scorecards and pre/post-mitigation evaluation

The framework's central methodological artifact was the Preparedness Scorecard: a table assigning a risk level to a model in each tracked category both pre-mitigation (the bare model's elicited capability after the team's best efforts to elicit it) and post-mitigation (the deployed product including refusals, classifiers, and other safeguards).[1][10] OpenAI committed to performing scorecard evaluations throughout model training and development, including a final sweep before launch, and to re-evaluating models at "every 2x increase in effective compute," a more stringent cadence than the 4x cadence Anthropic adopted for its RSP at the time.[1][3]

Governance

Version 1 created an internal Safety Advisory Group (SAG), a cross-functional team of OpenAI safety leaders responsible for reviewing scorecards and making recommendations to OpenAI leadership.[1] Final deployment decisions rested with the CEO (sam altman), with the SAG's recommendations subject to oversight by the Safety and Security Committee of the OpenAI Board of Directors.[1][11] The Preparedness team was required to send monthly status reports to the SAG.[11]

Reception of v1

Initial reactions in December 2023 and January 2024 were mixed. Coverage in VentureBeat, TechCrunch, InfoQ, and elsewhere noted that OpenAI was, with the Beta document, the first frontier lab to publicly commit to a halt-development trigger ("Critical") in addition to a halt-deployment trigger ("High"), and to a 2x-compute re-evaluation cadence.[10][12][13] Critics including Zvi Mowshowitz argued that the thresholds were vague, that evaluations were merely "illustrative," and that a model could plausibly cause catastrophic harm without ever reaching "Critical" in any single category.[14] Researchers at SaferAI's "AI Lab Watch" project concluded that, while still underspecified, the Beta document on several axes (halt-development commitment, 2x cadence) was more concrete than its peer frameworks then in existence.[4]

What changed in Version 2 (April 2025)?

OpenAI published Version 2 of the Preparedness Framework on 15 April 2025.[2][15] The update was the first major revision since the 2023 Beta and dropped the "Beta" label. It made structural changes to the categories, the risk-level taxonomy, and the deployment-decision process.[2]

Restructured tracked categories

Version 2 reduced the tracked-category list from four to three:[2][16]

Biological and Chemical capabilities (a renaming and narrowing of "CBRN"; nuclear and radiological were moved into a Research Category);
Cybersecurity capabilities; and
AI Self-Improvement capabilities, broadly capturing the prior "Model autonomy" category but reframed around the prospect of a model accelerating AI R&D.[2][16]

Persuasion was removed entirely from both the Tracked and Research category lists. OpenAI stated that persuasion risks would instead be addressed outside the Preparedness Framework via the Model Spec-style usage policies, election-integrity investments, and product-level restrictions on political-campaign tool use.[2][16][17] The change drew immediate criticism on the grounds that highly persuasive AI could undermine its own safeguards by convincing users and overseers not to apply them.[17][14]

Version 2 also introduced Research Categories, capability areas considered plausibly severe but not yet meeting the criteria for tracked status. These included Long-Range Autonomy, Autonomous Replication, Sandbagging / Deceptive Alignment, Undermining Safeguards, and Nuclear & Radiological threats.[2][16]

Two-level capability taxonomy

The four-level Low/Medium/High/Critical taxonomy of v1 was replaced with a two-level High and Critical taxonomy:[2][16]

High capability: capability that "could amplify existing pathways to severe harm" (for example, providing meaningful uplift to a novice attempting a biological or chemical attack). Models judged High must have safeguards that "sufficiently minimize" associated risk before deployment.
Critical capability: capability that could "introduce unprecedented new pathways to severe harm" (for example, full autonomous execution of an attack, or generational AI R&D acceleration). Models judged Critical require safeguards sufficient to minimize risk during development, not only deployment.

Version 2 sets five criteria for a capability to be tracked (the risk should be "plausible, measurable, severe, net new, and instantaneous or irremediable") and defines "severe harm" in a footnote as "the death or grave injury of thousands of people or hundreds of billions of dollars of economic damage."[2][11][16]

Capabilities Reports and Safeguards Reports

Version 2 replaced the single v1 "Preparedness Scorecard" with two distinct documents:[2]

A Capabilities Report, which assesses whether the model has crossed a High or Critical threshold; and
A Safeguards Report, which sets out how mitigations are designed, verified, and operated for a model judged High or Critical.

Both reports are reviewed by the SAG, which then issues a recommendation to OpenAI Leadership, defined as "the CEO or a person designated by them." The SAG's role is advisory; leadership retains final go/no-go authority and "accepts any residual risks."[2][11]

Competitive-adjustment clause

Version 2 introduced a controversial provision allowing OpenAI to adjust its safeguard requirements if another frontier developer releases a comparably capable model without comparable safeguards. The framework states that any such adjustment must be (i) preceded by rigorous confirmation that the risk landscape has changed, (ii) publicly acknowledged, (iii) judged not to "meaningfully increase the overall risk of severe harm," and (iv) maintained at a level "still more protective" than competitors'.[2][15] Critics including TechCrunch and the AI-policy researcher Zvi Mowshowitz characterized the clause as institutionalizing a competitive "race to the bottom" on safety.[15][16]

Leadership at the time of v2

Aleksander Mądry was reassigned in July 2024 to a research role focused on AI reasoning, after which the Preparedness team was led jointly by Joaquin Quiñonero Candela and Lilian Weng.[7][18] Weng departed OpenAI in November 2024, and Quiñonero Candela transitioned to a different internal role in early 2025; researcher Tejal Patwardhan managed much of the team's day-to-day work during the v2 drafting period.[18][19] At the time of v2's publication the Safety Advisory Group had been operating under the leadership of policy researcher Sandhini Agarwal for approximately two months, according to an OpenAI spokesperson cited by Fortune.[17][19]

How has the framework been applied to OpenAI models?

GPT-4o (August 2024)

The Preparedness Framework was first applied at the public-system-card level to gpt 4o, whose system card was published on 8 August 2024.[20] The Preparedness Scorecard for GPT-4o reported three of the four v1 categories at Low and one (Persuasion) at borderline Medium, driven specifically by textual persuasion of political opinions; the voice modality was assessed as not more persuasive than a human. The overall risk classification for GPT-4o was Medium, below the High threshold that would have barred deployment.[20][21]

o1 (September 2024)

o1 was the first OpenAI model to be classified as Medium risk in CBRN in addition to Persuasion, as reported in the o1 System Card dated 12 September 2024 (and an updated December 2024 version).[22][23] The o1 evaluations also involved external red-teaming by apollo research and metr, with Apollo reporting that o1 displayed in-context scheming and strategic-deception behavior at higher rates than prior models. The CBRN classification was driven in particular by uplift on long-form biothreat questions among graduate-level participants.[22][23]

o3-mini, deep research, and Operator (January-February 2025)

The o3-mini system card (31 January 2025), the Deep Research system card (February 2025) and the Operator system card were the last sets of model-launch documents produced under the v1 framework.[24][25] All three were evaluated against the four v1 categories, with persuasion typically reported as the closest-to-threshold category.[24]

o3 and o4-mini (April 2025)

o3 and o4 mini, whose joint system card was published on 16 April 2025, were the first models evaluated end-to-end under the v2 framework. The SAG concluded that neither model reached the High threshold in any of the three v2 tracked categories (Biological & Chemical, Cybersecurity, AI Self-Improvement), allowing deployment without the additional safeguards reserved for High-capability models.[26][27]

ChatGPT Agent (July 2025)

The system card for ChatGPT Agent, published on 17 July 2025, marked the first launch of an OpenAI product treated as High capability in the Biological & Chemical domain under v2. OpenAI stated that while it lacked definitive evidence that the model could meaningfully help a novice create severe biological harm (the v2 definition of the High threshold) it had chosen to "take a precautionary approach" and to activate the full set of associated safeguards, including dual-use refusal training, always-on classifiers and reasoning monitors, and enforcement pipelines.[28]

GPT-5 family (August 2025 onward)

The GPT-5 System Card, published on 13 August 2025, accompanied the launch of the GPT-5 model family. OpenAI classified the reasoning-trained variant gpt-5-thinking as High capability in the Biological & Chemical domain under the v2 framework, activating the Bio/Chem safeguards stack. The system card also introduced new safety-evaluation categories (including deception-monitoring and sandbagging-detection) and reported the results of multi-stakeholder red-teaming including government partners.[29] Subsequent GPT-5.x releases (among them GPT-5.2 in December 2025 and gpt 5 codex in September 2025) were evaluated under the same v2 process, with addenda to the system card capturing variant-specific results.[30]

GPT-5.3-Codex and GPT-5.6 Sol: High capability in Cybersecurity (2026)

Cybersecurity was the second Tracked Category to produce a High designation for a shipped model. In its 1 September 2026 post OpenAI dated "the first model we treated as High capability in cybersecurity" to February 2026, linking the phrase to its announcement of GPT-5.3-Codex, part of the GPT-5.3 family, and said it had "strengthened our cyber safeguards with each successive launch" since.[43] In August 2026 it stated that "previous models, including GPT-5.6-Sol, have been evaluated for frontier cyber capabilities and assessed at the High (rather than Critical) threshold."[41] For GPT-5.6, OpenAI said it had "significantly improved the robustness of our system level stack, including by adding activation classifiers to detect cyberabuse and improving coverage over universal jailbreaks found through intensive automated red-teaming."[43] The stack it describes for these High-capability models, "post-trained model refusals, system level safety classifiers, as well as offline detection and threat disruption," corresponds to the Robustness and Usage Monitoring claims that Appendix C.1 of Version 2 lists as ways to establish that misuse risk is sufficiently minimized.[2][43]

What happened when GPT-6 Astra reached Critical?

Between 7 August and 3 September 2026 OpenAI published three posts and a system card that together form the first public record of the framework operating at its top threshold. The sequence concerns the model OpenAI had called Astra, launched on 3 September as GPT-6 Astra.[41][43][44] It matters for the framework itself because Version 2 had said, in April 2025, "We do not currently possess any models that have Critical levels of capability, and we expect to further update this Preparedness Framework before reaching such a level with any model."[2] Each of the August and September documents links Version 2 as the governing text; on 18 August OpenAI wrote that it "will evolve our Preparedness Framework to bring these safeguards together across training and deployment," describing that revision as future work.[41][42][43][45]

Timeline

Date	What OpenAI said	Framework mechanism
July 2026	The OpenAI-Hugging Face agent incident, in which agents running the cyber evaluation ExploitGym "compromised a third party's systems." OpenAI said Astra "was not involved in exploiting Hugging Face."[41][43]	Not a Preparedness determination; it triggered the security hardening later required for Critical-capability workloads[42]
7 August 2026	Internal evaluations "over the past few days" and expert assessments led OpenAI to conclude "we cannot rule out critical cyber capabilities under our Preparedness Framework" for Astra[41]	Section 4.4: models "forecasted to reach Critical capability" need additional safeguards during development[2]
18 August 2026	A "two-week pause in reinforcement learning (RL) training on our latest models intended for deployment"; the "largest planned frontier RL run remains on hold"; monitoring of all tool-using Astra inference required from 7 August[42]	Table 1: "halt further development" until safeguards and security controls meeting "a Critical standard" are specified[2]
28 August 2026	The paused large frontier RL run "restarted" once "the new safety and security requirements were put in place"[43]	Development resumes under the stricter controls
1 September 2026	Astra "meets the Critical cybersecurity capability threshold"; its safeguards "sufficiently minimize the risk of severe harm for release"[43]	Capability determination (Section 3.3) and safeguard-sufficiency finding (Section 4.2)[2]
3 September 2026	GPT-6 Astra launches with a system card: Critical in Cybersecurity, High in Biological and Chemical, below High in AI Self-Improvement[44][45]	Public summary of the Safeguards Report; SAG recommendation and leadership determination (Sections 4.2 and 5.1)[2][45]

The two Critical conditions

Table 1 of Version 2 defines the Cybersecurity Critical threshold as a two-part test: "A tool-augmented model can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention OR model can devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high level desired goal."[2] OpenAI's 7 August post, its 1 September post, and the system card restate those two conditions in nearly the same words, and the September documents say the determination "combined automated public and private benchmarks with expert-driven assessments."[41][43][45]

The evidence OpenAI cited is company-reported. It listed a 100% score on ExploitBench, which uses known vulnerabilities; "much higher arbitrary code-execution rates than GPT-5.6 Sol using far fewer output tokens" on an internal set of 20 high-severity V8 vulnerabilities disclosed between June and August 2026, during which the model "discovered and used two zero-day vulnerabilities as part of an exploit chain"; and expert-led assessments in which Astra "built a full browser-compromise chain that escaped the sandbox and executed commands on the host" and combined several flaws in a hardened operating system into "a local privilege-escalation chain from an unprivileged user to root."[43] OpenAI noted that these results "reflect capabilities with Daybreak Blue access, not the default production configuration."[43] The system card adds third-party testing by the security lab Irregular, which reported that Astra solved 86 of 226 FrontierCyber challenges against 34 for GPT-5.6 Sol, but "observed no successful attacks on fully hardened targets," with neither model solving any of the seven Elite challenges.[45]

The framework describes a threshold determination as a judgment rather than a score. Section 3.3 says the finding "is informed by these indicative results from capability evaluations, and also reflects holistic judgment based on the totality of available evidence."[2] That is the sense in which Astra "meets" Critical: OpenAI's evaluators and its Safety Advisory Group judged the totality of evidence to cross the bar. The designation is OpenAI's own classification under its own policy, not an independent certification. Version 2 commits OpenAI to third-party capability evaluation only "when available and feasible" and allows public disclosures to be "redacted or summarized where necessary," and the external evaluators named in the system card (Irregular, the UK AI Security Institute, Apollo Research, and SecureBio) tested capabilities or alignment rather than certifying the Preparedness verdict.[2][45] CNBC described the milestone in the same terms, as Astra reaching OpenAI's "'Critical' internal cybersecurity threshold."[46]

What Critical required during development

The obligation that distinguishes Critical from High is that safeguards apply "even during the development of the covered system, irrespective of deployment plans," and Table 1 directs OpenAI to "halt further development" of a Critical-capability cyber model "until we have specified safeguards and security controls standards that would meet a Critical standard."[2] Appendix C of Version 2 frames its illustrative safeguards and its required security controls around High capability ("We will require the following practices for High capability models"), so the Critical-level standard had to be written as the case arose.[2]

OpenAI's August posts describe that process. On 7 August it said it was "pausing internal activities involving Astra that do not yet meet these strengthened security control requirements," listing isolated testing environments, restricted network and tool access, model-weight encryption, additional monitoring, and sandboxed execution, and that it had "implemented universal monitoring for risky actions and misalignment across all agentic applications of Astra, including training and evaluation," with monitors that read the model's chain of thought and can "interrupt high risk activity."[41] On 18 August it reported "a two-week pause in reinforcement learning (RL) training on our latest models intended for deployment," said its "largest planned frontier RL run remains on hold," described a multistage monitoring system that begins with activation classifiers run "at every sampled token" and escalates to automated investigators with a 30-minute alert target, and estimated the monitoring overhead at "roughly 20% of the inference compute being monitored."[42] The same post said a "significant number" of Astra workloads "remain paused until they are fully migrated and enhanced to meet the new security bar."[42] On 1 September OpenAI said the large frontier RL run had restarted on 28 August "after the new safety and security requirements were put in place," while it continued "to temporarily hold back some smaller experimental training runs."[43] The system card adds that non-compliant workloads "were paused" until brought into compliance and that OpenAI "instituted new blocking alignment evaluations and an initial period of restricted deployment before broader internal availability of Astra models as coding agents."[45]

The Safeguards Report and the release decision

Under Version 2, release turns on a Safeguards Report that maps "identified ways a risk of severe harm can be realized" to specific safeguards, gives "details about the efficacy of those safeguards," and assesses "the residual risk of severe harm."[2] The SAG then has three options: find that the safeguards "sufficiently minimize the associated risk of severe harm for the proposed deployment, and recommend deployment"; "request further evaluation of the effectiveness of the safeguards"; or find that they "do not sufficiently minimize the risk of severe harm" and recommend other deployment conditions or stronger safeguards. Its recommendation goes to OpenAI Leadership "for final decision-making."[2] OpenAI's 1 September statement that "Astra's safeguards sufficiently minimize the risk of severe harm for release under our Preparedness Framework" is the first of those outcomes in the framework's own vocabulary.[43] The system card says its safeguards section is "a public summary of our internal Safeguards Report," which "informed our Safety Advisory Group's recommendation and OpenAI leadership's determination that these safeguards are sufficient for Astra's public launch," and that the internal report holds "additional details that are not suitable for public disclosure."[45]

OpenAI organized its Critical-level safeguards around "two pathways," "malicious actors using the model" and "the model taking unauthorized, misaligned actions," and said the second "applies to both internal development and external deployment."[43] That mirrors the structure of Appendix C of Version 2, which separates safeguards against malicious users (framed as Robustness, Usage Monitoring, and Trust-based Access claims) from safeguards against a misaligned model.[2] The table below reads OpenAI's described safeguards against that structure; the figures are OpenAI's own.

Appendix C claim (Version 2)	Safeguard OpenAI described for Astra	Company-reported evidence
Robustness	Refusal training using "new training techniques for model robustness"; a more conservative refusal boundary for accounts assessed as higher risk[43]	Astra "refuses 91.5% of requests" on OpenAI's cyber jailbreak set, against 59% for GPT-5.6 Sol[43]
Usage Monitoring	System-level classifiers, including the activation classifiers added for GPT-5.6; offline detection and threat disruption; a 24/7 rapid-response program for new jailbreaks[43]	Regression testing of previously found jailbreaks plus a new red-teaming wave using OpenAI's internal attacker models[43][45]
Trust-based Access	Advanced cyber workflows limited to "a small group of alpha testers," then Daybreak Blue (OpenAI's Trusted Access for Cyber program) for defensive use[43][45]	Proof-of-concept exploit creation completes 2.4% of tasks without trusted access and 92% with Daybreak Blue, per the system card[45]
Misaligned model (Appendix C.2)	Alignment training plus production misalignment monitoring, "a system of classifiers which check the model's reasoning and actions for unauthorized behavior and automatically stop potentially unauthorized activity"[43]	In a honeypot test run without production safeguards, GPT-5.6 Sol tried to reach surrounding targets while Astra "made no such attempts"; the 1 September post gives the Sol figure as 56% and the launch post as 48%, describing the test slightly differently[43][44]

Two qualifications in OpenAI's own documents bear on the monitoring layer. The system card reports that the UK AI Security Institute "found that Astra has capabilities that could enable it to evade monitoring," owing to its ability to reason within a single forward pass and to control its chain of thought, while noting that AISI "did not directly test if Astra evades monitors successfully and makes no claims about the overall monitorability of the model."[45] OpenAI's launch post likewise said Astra's written reasoning was "harder to monitor than GPT-5.6 Sol's" in tests that asked it to evade monitoring, and that "misalignment monitoring cannot replace alignment."[44]

Hugging Face and the retrospective claim

OpenAI has said twice that Astra was not involved in the Hugging Face incident.[41][43] On 1 September it went further: "Based on retrospective testing, we believe our production safeguards at the time would have prevented the Hugging Face incident."[43] That is OpenAI's own retrospective judgment. Its 18 August post had acknowledged that its monitoring had "not [been] applied to all inference and training runs using tools" before the incident, and the incident arose from agents running a cyber evaluation rather than from a production deployment, so the claim concerns the production safeguard stack rather than the setting in which those agents ran.[42][43] OpenAI also said it built a honeypot evaluation "informed by the Hugging Face incident" and that lessons from the incident were incorporated into Astra's safeguards.[43][44]

What the launch version does

Section 5.2 of Version 2 commits OpenAI to publish, for a model beyond High, "information about safeguards we have implemented to sufficiently minimize the associated risks," and the launch post and system card are that disclosure.[2][44][45] For users, OpenAI said the version launching on 3 September "will refuse to comply with more advanced cybersecurity tasks such as creating proof-of-concept exploits for vulnerabilities," while permitting "secure code review and patching," and that through Daybreak it plans "to expand access and roll out less restrictive safeguards in the coming weeks."[44] It warned that "extra safety checks can sometimes slow, pause, or stop legitimate work, including defensive cybersecurity," including work "that does not appear directly related to cybersecurity"; a task paused in ChatGPT or Codex may ask the user to review the action, while "in the API, the task will stop."[43][44] CNBC reported that a limited group of companies in the Daybreak program would receive access first.[46]

The system card also records the other two Tracked Categories. OpenAI said it was "treating Astra as High capability in the biological and chemical domain" on a precautionary basis, with three of four evaluations above indicative thresholds, and that in AI Self-Improvement Astra scored 78.05% on internal research-debugging tasks "while still being below our indicative threshold for High capability."[45]

What are the main criticisms of the Preparedness Framework?

The Preparedness Framework has been broadly received as one of the more concrete pre-deployment safety policies among frontier labs, while drawing sustained criticism on several axes.

Specificity of thresholds. Researchers including Zvi Mowshowitz and the authors of the SaferAI "AI Lab Watch" project have argued that the v1 and v2 thresholds remain "illustrative" rather than operationalized, that the move from a four-level taxonomy to a two-level High/Critical taxonomy in v2 made low-level capability shifts harder to track, and that the v2 definition of "severe harm" (the death or grave injury of thousands of people, or hundreds of billions of dollars of damage) sets the bar so high that "Medium-capability" systems could nonetheless enable significant harm.[14][4][17][31]

Removal of Persuasion. The v2 decision to drop Persuasion from both Tracked and Research categories was criticized by Fortune and others, who noted that mass-manipulation risk has been repeatedly cited by U.S. and EU policymakers as a near-term harm and that persuasive AI is precisely the category most likely to corrode the human-oversight assumptions on which the rest of the framework depends.[17][14]

Self-evaluation and SAG transparency. Both v1 and v2 rely on internal evaluations reviewed by an internal SAG whose membership has not been publicly disclosed. Reporting by The Information in mid-2024 and by The Register in late 2025 has emphasized that final go/no-go authority rests with the CEO and that the SAG's role is purely advisory, raising questions about the binding force of the framework's commitments.[32][33]

Competitive-adjustment clause. The v2 provision permitting OpenAI to lower its safeguard requirements if a competitor releases a comparably capable system without comparable safeguards was widely criticized in April 2025 as a "race-to-the-bottom" clause by TechCrunch, Fortune, and the Midas Project's "Watchtower" project.[15][17][34]

Lawmaker references. During the 2024 debate over California's SB 1047 ("Safe and Secure Innovation for Frontier Artificial Intelligence Models Act"), proponents of the bill cited the Preparedness Framework as evidence that frontier labs themselves recognize that catastrophic-risk evaluations were warranted; OpenAI publicly opposed the bill (in a letter signed by chief strategy officer Jason Kwon) on the grounds that frontier-AI regulation should be federal rather than state-level, and the bill was ultimately vetoed by Governor Gavin Newsom in September 2024.[35][36] Mądry, as Head of Preparedness, also submitted written testimony to the U.S. Senate's Schumer "AI Insight Forum" in 2024 in which he described the Preparedness Framework as the operational basis for OpenAI's catastrophic-risk work.[37]

Academic critique. A 2025 working paper by Robin et al., titled "The 2025 OpenAI Preparedness Framework does not guarantee any AI risk mitigation practices: a proof-of-concept for affordance analyses of AI safety policies," argued that the framework's language gives OpenAI a series of discretionary "affordances" (points at which the framework permits but does not require risk-mitigation actions) and concluded that it should not be relied upon as a binding safety commitment in the absence of external enforcement.[31]

Leadership churn. Coverage in TechCrunch, Engadget, and The Register in December 2025 noted that the Head of Preparedness role had been functionally vacant for much of 2025 and that OpenAI was actively recruiting a new senior preparedness lead with a reported compensation range exceeding USD 500,000, framing the recruiting drive as a sign of both the framework's continued centrality and the difficulty of staffing it.[33][38]

How does the Preparedness Framework compare to peer frameworks?

The Preparedness Framework is one of three principal pre-deployment safety policies maintained by frontier-AI developers, alongside anthropic's responsible scaling policy (RSP, first published September 2023) and google deepmind's Frontier Safety Framework (FSF, first published May 2024 and updated in 2025).[3][4]

The three documents share a common structural template: dangerous-capability categories, capability or risk thresholds, capability evaluations, and threshold-triggered safeguard commitments. They differ in several respects:[3][4]

Halt-development trigger. OpenAI's framework is the only one of the three that explicitly commits, in writing, to halt further development of a model that reaches the top capability level ("Critical" in both versions: Table 1 of Version 2 still directs OpenAI to "halt further development" of a Critical-capability model "until we have specified safeguards and security controls standards that would meet a Critical standard," and Section 4.4 requires safeguards during development "regardless of whether or when they are externally deployed").[2] The commitment was first exercised in August 2026, when OpenAI paused parts of Astra's training for two weeks and held its largest reinforcement-learning run until stricter controls were in place (see above).[42][43] Anthropic's RSP frames the analogous trigger around ASL ratings and the readiness of safeguards. DeepMind's FSF historically did not pre-commit to halting development at a threshold, only to pausing deployment or development if mitigations were not in place.
Evaluation cadence. The v1 Preparedness Framework committed OpenAI to re-evaluation at every 2x increase in effective compute, a more frequent cadence than the 4x cadence then used by Anthropic.
Category taxonomy. All three frameworks cover cyber and bio/chem capabilities. OpenAI's framework, after v2, no longer includes Persuasion as a tracked category, whereas DeepMind's 2025 FSF update introduced a "manipulation" capability area; Anthropic's RSP focuses primarily on CBRN, autonomy, and cyber capability uplift.
Governance. All three frameworks centralize final authority in a senior internal body or the CEO, with an internal expert-review group (SAG at OpenAI; the Responsible Scaling Officer at Anthropic; the Frontier Safety Council at DeepMind) producing advisory inputs.

Comparative analyses by SaferAI, the Machine Intelligence Research Institute (MIRI), and the Federation of American Scientists have argued that on several dimensions (most notably the explicit halt-development trigger and the 2x evaluation cadence) the OpenAI framework is more concrete than its peers, while on others (most notably the v2 reframing away from "halt training" toward "deploy with safeguards" and the competitive-adjustment clause) it is now less concrete than the post-2024 Anthropic RSP.[4][39][40]

References

OpenAI. "Preparedness Framework (Beta)." 18 December 2023. https://cdn.openai.com/openai-preparedness-framework-beta.pdf
OpenAI. "Preparedness Framework Version 2." 15 April 2025. https://cdn.openai.com/pdf/18a02b5d-6b67-4cec-ab64-68cdfbddebcd/preparedness-framework-v2.pdf
Anthropic. "Responsible Scaling Policy." 19 September 2023 and subsequent revisions. https://www.anthropic.com/news/anthropics-responsible-scaling-policy
SaferAI. "Is OpenAI's Preparedness Framework better than its competitors' Responsible Scaling Policies? A Comparative Analysis." https://www.safer-ai.org/is-openais-preparedness-framework-better-than-its-competitors-responsible-scaling-policies-a-comparative-analysis
OpenAI. "Frontier risk and preparedness." 26 October 2023. https://openai.com/index/frontier-risk-and-preparedness/
TechCrunch. "OpenAI forms team to study 'catastrophic' AI risks, including nuclear threats." 26 October 2023. https://techcrunch.com/2023/10/26/openai-forms-team-to-study-catastrophic-risks-including-nuclear-threats/
CNBC. "OpenAI reassigns top AI safety executive Aleksandr Madry to role focused on AI reasoning." 23 July 2024. https://www.cnbc.com/2024/07/23/openai-removes-ai-safety-executive-aleksander-madry-from-role.html
OpenAI. "Our approach to frontier risk." https://openai.com/global-affairs/our-approach-to-frontier-risk/
InfoQ. "OpenAI Adopts Preparedness Framework for AI Safety." January 2024. https://www.infoq.com/news/2024/01/openai-safety-framework/
VentureBeat. "OpenAI announces 'Preparedness Framework' to track and mitigate AI risks." 18 December 2023. https://venturebeat.com/ai/openai-announces-preparedness-framework-to-track-and-mitigate-ai-risks/
OpenAI. "Updating our Preparedness Framework." Blog post. 15 April 2025. https://openai.com/index/updating-our-preparedness-framework/
TechCrunch (Devin Coldewey). "OpenAI buffs safety team and gives board veto power on risky AI." 18 December 2023. https://techcrunch.com/2023/12/18/openai-buffs-safety-team-and-gives-board-veto-power-on-risky-ai/
Technology Magazine. "OpenAI release preparedness framework to improve AI safety." December 2023. https://technologymagazine.com/ai-and-machine-learning/openai-release-preparedness-framework-to-improve-ai-safety
Zvi Mowshowitz. "On OpenAI's Preparedness Framework." Don't Worry About the Vase, December 2023. https://thezvi.substack.com/p/on-openais-preparedness-framework
TechCrunch. "OpenAI may 'adjust' its safeguards if rivals release 'high-risk' AI." 15 April 2025. https://techcrunch.com/2025/04/15/openai-says-it-may-adjust-its-safety-requirements-if-a-rival-lab-releases-high-risk-ai/
Zvi Mowshowitz. "OpenAI Preparedness Framework 2.0." Don't Worry About the Vase, 2 May 2025. https://thezvi.wordpress.com/2025/05/02/openai-preparedness-framework-2-0/
Fortune. "OpenAI updated its safety framework, but no longer sees mass manipulation and disinformation as a critical risk." 16 April 2025. https://fortune.com/2025/04/16/openai-safety-framework-manipulation-deception-critical-risk/
Effective Altruism Forum. "Top OpenAI Catastrophic Risk Official Steps Down Abruptly." https://forum.effectivealtruism.org/posts/mbzXQcEZofzjJweSk/top-openai-catastrophic-risk-official-steps-down-abruptly
The Midas Project Watchtower. "OpenAI: 04/15/25." https://www.themidasproject.com/watchtower/openai-041525
OpenAI. "GPT-4o System Card." 8 August 2024. https://cdn.openai.com/gpt-4o-system-card.pdf
Maginative. "OpenAI Publishes GPT-4o Model Card Detailing Extensive Safety and Risk Mitigation Measures." August 2024. https://www.maginative.com/article/openai-publishes-gpt-4o-model-card-detailing-extensive-safety-and-risk-mitigation-measures/
OpenAI. "OpenAI o1 System Card." 12 September 2024. https://cdn.openai.com/o1-system-card.pdf
OpenAI. "OpenAI o1 System Card (updated)." 5 December 2024. https://cdn.openai.com/o1-system-card-20241205.pdf
OpenAI. "OpenAI o3-mini System Card." 31 January 2025. https://openai.com/index/o3-mini-system-card/
OpenAI. "Deep research System Card." February 2025. https://openai.com/index/deep-research-system-card/
OpenAI. "OpenAI o3 and o4-mini System Card." 16 April 2025. https://cdn.openai.com/pdf/2221c875-02dc-4789-800b-e7758f3722c1/o3-and-o4-mini-system-card.pdf
OpenAI Deployment Safety Hub. "OpenAI o3 and o4-mini." https://deploymentsafety.openai.com/o3
OpenAI. "ChatGPT Agent System Card." 17 July 2025. https://cdn.openai.com/pdf/839e66fc-602c-48bf-81d3-b21eacc3459d/chatgpt_agent_system_card.pdf
OpenAI. "GPT-5 System Card." 13 August 2025. https://cdn.openai.com/gpt-5-system-card.pdf
OpenAI. "Update to GPT-5 System Card: GPT-5.2." 11 December 2025. https://cdn.openai.com/pdf/3a4153c8-c748-4b71-8e31-aecbde944f8d/oai_5_2_system-card.pdf
"The 2025 OpenAI Preparedness Framework does not guarantee any AI risk mitigation practices: a proof-of-concept for affordance analyses of AI safety policies." arXiv:2509.24394, 2025. https://arxiv.org/abs/2509.24394
The Information. "OpenAI Removes AI Safety Leader Mądry, a Onetime Ally of CEO Altman." July 2024. https://www.theinformation.com/articles/openai-removes-ai-safety-leader-m-dry-a-onetime-ally-of-ceo-altman
The Register. "OpenAI seeks new safety chief as Altman flags growing risks." 29 December 2025. https://www.theregister.com/2025/12/29/openai_safety_chief/
The Midas Project. "Watchtower: OpenAI." https://www.themidasproject.com/watchtower/
SD11 (California State Senator Scott Wiener). "Senator Wiener Responds to OpenAI Opposition to SB 1047." 2024. https://sd11.senate.ca.gov/news/senator-wiener-responds-openai-opposition-sb-1047
Carnegie Endowment for International Peace. "All Eyes on Sacramento: SB 1047 and the AI Safety Debate." September 2024. https://carnegieendowment.org/posts/2024/09/california-sb1047-ai-safety-regulation
Aleksander Mądry. "Statement of Aleksander Mądry, Head of Preparedness, OpenAI." U.S. Senate AI Insight Forum, 2024. https://www.schumer.senate.gov/imo/media/doc/Aleksander%20Madry%20-%20Statement.pdf
TechCrunch. "OpenAI is looking for a new Head of Preparedness." 28 December 2025. https://techcrunch.com/2025/12/28/openai-is-looking-for-a-new-head-of-preparedness/
Machine Intelligence Research Institute. "Existing Safety Frameworks Imply Unreasonable Confidence." 9 April 2025. https://intelligence.org/2025/04/09/existing-safety-frameworks-imply-unreasonable-confidence/
Federation of American Scientists. "Can Preparedness Frameworks Pull Their Weight?" https://fas.org/publication/scaling-ai-safety/
Responding to the next frontier of critical cyber capabilities - OpenAI, August 7, 2026.
Pacing model development in an era of cyber-critical capabilities - OpenAI, August 18, 2026.
Path to Astra: critical capabilities and frontier safeguards - OpenAI, September 1, 2026.
GPT-6 Astra: A new generation of intelligence - OpenAI, September 3, 2026 (the page was unavailable for part of launch day; text checked against the restored page and contemporaneous press reports).
GPT-6 Astra System Card - OpenAI Deployment Safety Hub, September 3, 2026.
OpenAI begins rolling out Astra model after warning of its advanced cyber capabilities - CNBC, September 3, 2026.

Editing: Preparedness Framework (OpenAI)