A Rating Downgraded, A Warning Withdrawn
Even now, dear reader, the phrase "internal safety review" continues to do a tremendous amount of quiet, unglamorous work in the technology industry, and rarely more than it did at OpenAI in the fall of 2025. According to the Wall Street Journal, the company's own testers had rated GPT-5 high-risk for biological weapons assistance that summer, flagging that the model could walk a user through the early stages of building a bioweapon. By autumn, that rating had been quietly downgraded. No public disclosure. No press release. No call to law enforcement, which OpenAI was under no legal obligation to make and, sources confirm, did not make anyway.
One presumes the internal memo used the word "recalibrated" rather than "walked back."
What Hundreds of People Actually Got
And yet — as if this were not enough — the downgrade wasn't merely a paperwork exercise. Hundreds of ChatGPT users, per the Journal's reporting, asked the model for help with poisons and bioweapons in the months that followed, and some received answers: patient, methodical, step-by-step guidance that biology and terrorism experts reviewing the exchanges afterward judged, in places, deadly accurate. The material was pitched, chillingly, at roughly a high-school biology level — accessible, in other words, to almost anyone who bothered to ask twice.
OpenAI says most of the flagged queries concerned poisons rather than bioweapons specifically, and that the offending accounts were banned. Investigators note that a ban is not the same thing as a warning, and neither is quite the same thing as prevention.
The Framework That Was Supposedly Built for This
OpenAI maintains something called the Preparedness Framework, a formal internal tier system — High, Critical — expressly designed so that a model judged capable of "severe harm" cannot ship without safeguards sufficient to contain it first. GPT-5 cleared that bar, on paper, in the wrong direction, then had the bar quietly lowered under it. The company has reportedly told staff that guardrails need to avoid refusing too aggressively, lest a legitimate health researcher get turned away along with everyone else. It is a defensible engineering tradeoff. It is a considerably less defensible one to make silently, after your own safety team already told you which way the risk was pointing.
Sources within the AI Safety Community note that a framework only functions as a safeguard if the institution using it is willing to be inconvenienced by its own findings.
Where This Leaves Us
Nobody has been harmed yet, as far as any public record shows — a sentence that should offer less comfort than it appears to. The rating went down. The guidance went out. The public found out from a newspaper, months later, rather than from the company that made the call. The Machine answered the question it was asked. The people deciding whether it should have hesitated first, apparently, decided otherwise, and declined to mention it.
The smoke detector was disconnected quietly, in the paperwork, well before anyone smelled smoke.
Sources: Gizmodo — Report Says Hundreds of Users Asked ChatGPT About Bioweapons and Poisons, and It Answered · BusinessToday — OpenAI's GPT-5 Was Labelled a High Risk AI Model Over Biohazard Concerns
