GPT-5 profile

    GPT-5 — security & risk dashboard

    Known weaknesses, safety and security advisories, and documented real-world incidents for GPT-5 — collected automatically and re-checked every few hours, so teams building on it can see what to design around.

    Last checked 18 Oct 2026

    Ask the Advisor about this model
    Known flaws

    5

    Security risks

    5

    Real-world incidents

    0

    Advisories logged

    0

    Security, safety & abuse risks

    • Malicious instructions embedded in documents or tool responses can attempt to redirect application behavior or expose data.
    • Unreviewed errors can cause harm in medical, legal, financial, and other consequential decisions.
    • Coding and automation capabilities can be misused for malicious software development or social engineering.
    • OpenAI applied heightened biological and chemical safeguards under its Preparedness Framework.
    • Broad tool permissions can amplify damage from mistaken or manipulated actions.

    Known flaws & limitations

    • Can still generate incorrect facts, fabricated references, and faulty technical explanations.
    • Prompt-injection resistance remains incomplete when handling untrusted content.
    • Benchmark results depend on reasoning effort, tools, evaluation scaffolding, and task conditions.
    • The gpt-5 API model does not natively support audio or video input or output.
    • Strong benchmark results do not establish reliable autonomous performance on unfamiliar, long-running tasks.

    Security advisories & risk updates

    No risk advisories logged since this profile started being tracked. New ones appear here automatically.

    What this means if you are building on it

    • Unsupervised high-stakes decisions requiring guaranteed factual correctness.
    • Autonomous execution of irreversible actions with unrestricted credentials.
    • Applications requiring native audio or video processing.
    • Workflows that treat instructions inside untrusted documents as authoritative.

    Everything here comes from published documentation, advisories and reporting, with links to the original sources. It is not a complete vulnerability database — always check the provider's own security notices before shipping.