GPT-Rosalind-6: OpenAI's Biology Model and Trusted Access

OpenAI has a new model for biology labs, and it comes with a gate. On October 30, 2026, the company published a system card for GPT-Rosalind-6, a reasoning model for biology, drug discovery and translational medicine.

The model shares its weights with GPT-6 Astra. The big change is behavior. It answers more "dual-use" biology questions, the kind that could help a cure or a weapon, but only approved groups can use it. Here's what's confirmed, what the benchmark numbers really mean, how much the model costs and what life sciences data teams should do before they apply for access.

Disclosure and scope: Van Data Team builds data and AI systems with several model providers. We use Anthropic's Claude, an OpenAI rival, and we drafted this article with help from Claude. We have no business ties to OpenAI.

All benchmark scores below are OpenAI's own. We label our own math as ours. This article covers safety at a policy level only, and it isn't medical or investment advice.

Key Takeaways

• What: GPT-Rosalind-6 is OpenAI's new model for biology, drug discovery and translational medicine, announced through a system card addendum on October 30, 2026.
• Same brain, new rules: it uses the same weights as GPT-6 Astra. What changes is how often it refuses dual-use biology questions, and who can use it.
• Big jumps on OpenAI's tests: MedChemBench v7 rose from 28.9% to 49.6%, GeneBench Pro v13 from 16.7% to 37.7% and LifeSciBench Gold from 44.0% to 61.3%.
• Risk ratings: High in biology and chemistry, below Critical. Critical in cybersecurity, carried over from GPT-6 Astra.
• Gated access: only vetted groups get in, through OpenAI's trusted-access program.
• Price: $15 per million input tokens and $75 per million output tokens on OpenAI's list, which is 1.5 times the price of GPT-6 Astra for the very same weights.
• For data teams: the hard part is data, access control and human review. The model is the easy part.

GPT-Rosalind-6 at a Glance

Item	What's known so far
Announced	October 30, 2026, in a system card addendum
Purpose	Biology, drug discovery and translational medicine
Base model	Same weights as GPT-6 Astra
Main difference	Fewer refusals on dual-use biology questions
Who can use it	Approved organizations only, through trusted access
Biology risk rating	High, below Critical
Cyber risk rating	Critical, same as GPT-6 Astra
API list price	$15 input, $1.50 cached input, $75 output, per million tokens

What OpenAI Announced on October 30

OpenAI didn't hold a launch event. It posted a system card addendum on its deployment safety site. A system card is the document where a lab reports how a model was tested and what safety steps come with it.

The addendum calls GPT-Rosalind-6 "a frontier reasoning model for biology, drug discovery, and translational medicine." It lists test scores, risk ratings and the rules for access. OpenAI's API pricing page also gained a new gpt-6-rosalind row.

This is the latest step in a series. OpenAI first launched GPT-Rosalind in April 2026 as a research preview for life sciences. At the time, it named Amgen, Moderna, the Allen Institute and Thermo Fisher Scientific among the groups it was working with. The version just before this one was GPT-Rosalind-5.5.

How GPT-Rosalind-6 Relates to GPT-6 Astra

Here's the surprising part. OpenAI says GPT-Rosalind-6 "uses the same weights as GPT-6 Astra," its flagship model from September.

Weights are the learned numbers inside a model. Same weights? Same core skills.

So what's different? Two things change, and both matter a lot for labs: how often the model refuses risky biology questions, and who is allowed to use it at all. OpenAI says GPT-Rosalind-6 "has fewer refusals on dual-use biological queries but is only made available via trusted access."

In plain words, Astra is built for everyone, so it plays it safe on risky biology topics. GPT-Rosalind-6 is built for vetted labs, so it says yes more often. It still refuses requests that would meaningfully help someone build a bioweapon.

We covered the base model in our GPT-6 Astra explainer. If you've read that, you already know most of what GPT-Rosalind-6 can do, because its knowledge and reasoning skills come straight from the same model that OpenAI shipped in September. This article focuses on what's new: the gate, the ratings and the price.

GPT-Rosalind-6 Benchmarks: The Numbers

OpenAI tested the model at its highest reasoning setting. It compared the scores with GPT-Rosalind-5.5 on three life sciences tests that it calls "beneficial capability" benchmarks.

Benchmark	GPT-Rosalind-5.5	GPT-Rosalind-6	Change (our math)
MedChemBench v7	28.9%	49.6%	+20.7 points
GeneBench Pro v13	16.7%	37.7%	+21.0 points
LifeSciBench Gold	44.0%	61.3%	+17.3 points

These are large jumps. GeneBench Pro more than doubled. MedChemBench rose by about 72% in relative terms, by our math. LifeSciBench Gold, the test with the highest starting score, gained the least, which is normal because there is less room left to grow once a model already solves almost half.

How to Read Vendor Benchmarks

Big numbers deserve a careful read. Four checks help.

• OpenAI ran these tests. No outside lab has published matching results yet, so for now there is no way to know whether other testers would see the same big jump.
• The names are OpenAI's. We couldn't find public details for every test, so it's hard to know how close each one is to real lab work.
• The setting was the highest. Scores at lower reasoning budgets, which cost less and run faster, may be lower.
• The baseline is old. The comparison is with GPT-Rosalind-5.5, not with rival models.

Benchmarks guide. They don't decide. The only test that truly counts is how a model does on your own tasks. We explain how to build that kind of test in our guide to AI agent evaluation.

Why the "High" Biology Rating Matters

OpenAI grades risky skills under its Preparedness Framework. Each area gets a level. "High" means a model could give real help to people trying to cause serious harm. "Critical" is the top level, where the risk is severe and new.

For this launch, OpenAI says it is "treating this launch as High capability in the Biological and Chemical domain, below the threshold for Critical." So the model is strong enough to need extra safeguards, but not so strong that OpenAI would hold it back.

The system card shows how close some tests came:

• Biorisk knowledge: 78.3% raw, just under the 80% warning line. Close call. After adjusting for its 9.4% refusal rate, the score rose to 85.0%.
• TroubleshootingBench: 491 of 832 tasks right, about 59.0%, well above the 36.4% warning line.
• Overall: after the refusal adjustment, it passed the High warning line on three of four tests.

OpenAI also ran four harder tests tied to the Critical level, in areas like protein function prediction. None reached its Critical line. OpenAI calls the results compared with GPT-Rosalind-5.5 "mixed."

GPT-Rosalind-6 and the Critical Cyber Rating

Biology isn't the only risk area. GPT-6 Astra was OpenAI's first model rated Critical in cybersecurity. Since GPT-Rosalind-6 has the same weights, OpenAI says it will "treat GPT-Rosalind-6 as Critical in Cybersecurity."

That's the twist worth noticing. OpenAI loosened the model's limits on biology, but it tightened them on hacking. The system card describes a "more conservative cyber refusal boundary" on top of GPT-6 Astra's usual cyber safeguards, including real-time blocking.

One test shows the effect. With real-time blocking turned off, past jailbreak attempts on cyber tasks worked 14.3% of the time, versus 15.7% for GPT-6 Astra. Lower is better here. Small gap. Right direction.

For AI self-improvement, the third risk area, the model sits below High. GPT-6 Astra didn't reach High there either.

What "Fewer Refusals" Really Means

"Fewer refusals" can sound alarming. It helps to picture the questions involved. Many normal research tasks touch dual-use topics, because the same biology that explains a disease is often the biology that someone else could, in theory, misuse. Think of how a virus gets into a cell, how a toxin sticks to a protein or how to fix a failed lab step.

A general chatbot often says no to these, even for a real scientist. That slows down real work. OpenAI's answer is to check the user first, then let the model help more.

Of course, the line still exists. OpenAI says the model is tuned to "refuse or safely respond to requests that would continue to meaningfully enable severe biological weaponization." The trade is simple. Trust the user more, and keep the hardest limits in place.

Who Can Get GPT-Rosalind-6 Access

You can't just switch it on in the API. Access runs through OpenAI's trusted-access program, and OpenAI reviews each applicant.

According to the system card, the review covers:

• Use case: what you plan to do with the model.
• Governance: who oversees the work and how.
• Security: how you protect the model, your data and the outputs, including who can log in, where results are stored and what happens if an account is stolen.

Companies go through business checks and screening. Government groups have a separate path for biosecurity, biosafety, public health readiness and biodefense.

Approval comes with duties. Customers must keep security controls in place.

They must also follow least-privilege access, which means each person gets only the access they need. And qualified people must review outputs before those outputs shape experiments, papers or decisions. OpenAI says it enforces these rules through monitoring and review, and it can take access away.

For university labs, OpenAI runs a separate Rosalind Academic Plan. It offers approved US university labs up to 30 free ChatGPT Business seats, and the lead scientist applies for the whole lab.

GPT-Rosalind-6 Pricing vs GPT-6 Astra

OpenAI's API pricing page lists the new model as gpt-6-rosalind. Here's how it compares, per million tokens on the Standard tier.

Model	Input	Cached input	Output
gpt-6-rosalind	$15.00	$1.50	$75.00
gpt-6-astra	$10.00	$1.00	$50.00
gpt-rosalind-research	$5.00	$0.50	$25.00

So GPT-Rosalind-6 costs 1.5 times as much as GPT-6 Astra for the same weights, by our math. You're paying for the looser biology limits and the vetting, not for a smarter model. The older gpt-rosalind-research model still costs a third of the new one.

The pricing page notes that access "is limited to approved internal research through the trusted-access program." It also adds a 10% charge for regional data processing on newer models.

What a Real Workload Might Cost

Here's a simple example, using our own math and list prices. Say a team runs a paper review task that sends 50,000 tokens in and gets 5,000 tokens back.

• GPT-Rosalind-6: 50,000 input tokens cost $0.75 and 5,000 output tokens cost $0.375. Total: about $1.13 per run.
• GPT-6 Astra: $0.50 plus $0.25. Total: $0.75 per run.

At 1,000 runs a month, that works out to about $1,125 for GPT-Rosalind-6 versus $750 for GPT-6 Astra, a gap of roughly $375 that is small for most drug companies. But reasoning models can write long hidden reasoning that also counts as output, so real bills often run higher.

Cached input changes the picture too. If many runs share the same long prompt or document, cached tokens cost a tenth of the full price. Good prompt design can cut the bill more than the choice of model.

The Debate: Safety Tool or Loosened Guardrails?

The launch raises a fair debate, with two sides.

The case for is that this is how risky tools should work. Labs get a model that really helps with real science, and bad actors face a vetting wall. It's similar to how labs control access to dangerous samples. Identity comes first.

The case against is about direction. A model that OpenAI itself rates High in biology now refuses fewer risky questions, and much of the safety now rests on a vetting process that outsiders can't inspect. Vetting can fail, accounts can be stolen and insiders can misuse access. The safety of the whole setup rests on OpenAI's checks and on each customer's security.

Both sides have a point. The trusted-access model only works if the checks hold up over time. That's why we've argued before that AI safety culture matters as much as any single rule.

What GPT-Rosalind-6 Means for Life Sciences Data Teams

If your company might apply, the model is the easy part. The work is in everything around it. OpenAI's access rules read like a data checklist: security, least privilege and human review.

Most life sciences firms keep data in many places: lab systems, lab notebooks, test databases and shared drives. A powerful model connected to messy data gives confident answers built on bad inputs. Worse, it may see data that some users shouldn't.

So the teams that get the most from GPT-Rosalind-6 won't be the ones that apply first, but the ones with clean, well-governed data and clear rules for who can ask what.

Get Your Data Ready Before You Apply

Start with the data the model will touch.

• Map your sources. List every system the model might read from, and who owns each one.
• Label sensitive data. Tag patient data, partner data and dual-use work so access rules can follow it.
• Fix the basics. Remove copies, match IDs across systems and note where each record came from.
• Build one clean path in. Feed the model through a pipeline you control, not through ad hoc file uploads.

We cover this groundwork in our guide to data platform modernization for AI readiness. The same steps apply here, with tighter access rules.

Build Human Review Into the Workflow

OpenAI requires qualified human review before outputs shape experiments, papers or decisions. Design for it.

• Decide who reviews what. A chemist reviews chemistry. A biosafety lead reviews anything near dual-use work, such as work on pathogens or toxins, or any experiment that your own biosafety committee already treats as sensitive.
• Make review easy. Show the reviewer the question, the answer, the sources and the model version on one screen.
• Record every decision. Log who approved each output and why. That record protects you in an audit.

Our playbook on human review loops for production AI agents shows how to set this up without slowing the team to a crawl.

Lock Down Access and Logs

Least privilege sounds simple. Doing it isn't.

• Named accounts: give each user their own login, not a shared key.
• Narrow scope: limit the model's tools and data to what each project needs.
• Full logs: keep every prompt and response, stored where only the right people can read them.

Also, plan for the worst day. If an account is stolen, you need to know what it asked and what it saw. If OpenAI flags misuse, you need to answer fast, with logs that show who asked what, when they asked it and which data the model could reach at the time. Our AI agent incident response playbook covers that first hour.

Test GPT-Rosalind-6 on Your Own Tasks

Don't trust the benchmark table alone. Test it yourself.

• Pick 30 to 50 real tasks your scientists already solved, with known good answers.
• Run each model on the same tasks: GPT-Rosalind-6, GPT-6 Astra and whatever you use today.
• Use expert scorers. Automatic checks miss subtle science errors.
• Track cost and time, not only accuracy.

If GPT-6 Astra handles most of your tasks well, you may not need the higher price. If your work hits Astra's refusals often, GPT-Rosalind-6 may pay for itself quickly.

What Not to Do

A few mistakes are easy to make in the rush.

• Don't skip the vetting story. Sloppy or vague answers about governance, security and review can slow down an application, or sink it entirely, because that is exactly what OpenAI says it checks.
• Don't connect everything at once. Start with one project and one clean data source.
• Don't treat outputs as results. A model answer is a lead to test in the lab, not a finding.
• Don't share accounts. One shared login breaks least privilege and makes logs useless.
• Don't forget cyber limits. The model is stricter on security topics, so don't plan IT security work around it.

What to Watch Next

• Independent tests. Outside results on MedChemBench, GeneBench Pro or similar tests would show whether OpenAI's gains hold up.
• Red-team results. AI Weekly reports that OpenAI is repeating its biosecurity red-teaming for this model. Public findings would help.
• Who gets approved. The mix of companies, universities and governments in the program will show how strict the gate really is.
• Rival moves. Other AI labs may follow with their own gated science models.
• Rules from regulators. Governments may set standards for trusted access to dual-use AI, much like the select agent rules that already control who can work with dangerous pathogens in US labs.

GPT-Rosalind-6: Our Take

GPT-Rosalind-6 isn't a new brain. It's GPT-6 Astra with different rules, a gate and a higher price. That's still important. It's one of the clearest tests yet of a simple idea: check the user, then let the model do more.

The benchmark jumps look strong, but they're OpenAI's own numbers. For most life sciences teams, the real work starts before access. Clean data, tight permissions and real human review will decide who gets value from this model, and who just gets a bigger bill.

How Van Data Team Helps Life Sciences Teams Use AI Safely

We help data teams get ready for powerful AI models. That means clean pipelines, safe data access, audit logs, test sets built from real work and human review steps that fit the way scientists already work.

If you're weighing GPT-Rosalind-6 or any other science model, start with a look at your data. Our AI agent development and data pipeline development teams can help you build the base, or you can get in touch for a quick review.

Sources: OpenAI's GPT-Rosalind-6 system card addendum, OpenAI API pricing, Introducing GPT-Rosalind, Rosalind Academic Plan, OpenAI's GPT-6 Astra safety overview, AI Weekly.