OpenAI publishes o3-mini system card detailing safety work

OpenAI has classified its o3-mini reasoning model as Medium risk overall, and for the first time in the company's Preparedness Framework history, a model has reached Medium risk specifically on Model Autonomy. The rating appears in the o3-mini System Card, published by OpenAI's Safety Advisory Group, which recommended the Pre-Mitigation classification before the model's deployment.

The scorecard breaks down like this:

• CBRN (chemical, biological, radiological, nuclear): Medium
• Cybersecurity: Low
• Persuasion: Medium
• Model Autonomy: Medium

Under OpenAI's own rules, those numbers matter. Only models with a post-mitigation score of Medium or below can be deployed, and only models scoring High or below can continue in development. A Critical rating anywhere on the card would stop the model entirely. o3-mini cleared the deployment bar — but only after mitigation brought the pre-mitigation assessment into the deployable range.

Why does the Model Autonomy rating matter?

The Model Autonomy category tests whether an AI system can operate, plan, and improve itself without human oversight. OpenAI states the reason for the first-ever Medium rating plainly: improved coding and research engineering performance. o3-mini is simply more capable at the kinds of technical work that autonomy evaluations probe.

There is a ceiling, though. OpenAI reports that o3-mini "still performs poorly on evaluations designed to test real-world ML research capabilities relevant for self improvement, which is required for a High classification." In other words, the model can code and engineer, but it cannot yet do the machine-learning research needed to make itself smarter. That gap is the difference between Medium and High — and between a deployable model and one that would face stricter limits.

The company draws its own lesson from the result. "Our results underscore the need for building robust alignment methods, extensively stress-testing their efficacy, and maintaining meticulous risk management protocols," the system card states.

What is deliberative alignment?

The o-series models, which include o3-mini, are trained with large-scale reinforcement learning to reason using chain of thought — the model works through a problem step by step before answering. OpenAI argues this architecture is not just a capability upgrade. It is a safety mechanism too.

The system card describes this as deliberative alignment: the model reasons about OpenAI's safety policies in context when it receives a potentially unsafe prompt, rather than relying only on pattern-matching against a blocklist. According to the document, this approach brings o3-mini "to parity with state-of-the-art performance on certain benchmarks" covering three specific risk areas:

• Generating illicit advice
• Choosing stereotyped responses
• Succumbing to known jailbreaks

That is the trade-off at the center of the release. Chain-of-thought reasoning, in OpenAI's words, "has the potential to unlock substantial benefits, while also increasing potential risks that stem from heightened intelligence." The same capability that lets the model refuse a dangerous request intelligently also makes it more capable generally.

What risks did OpenAI evaluate?

The system card organizes its safety work around three specific areas of risk, each with its own evaluation regime:

• Disallowed content — whether the model produces outputs that violate usage policy
• Jailbreaks — whether known techniques can bypass the model's safety training
• Hallucinations — whether the model generates false information with confidence

Beyond internal evaluations, the report covers external red teaming — independent testers attacking the model before release — and the formal Preparedness Framework evaluations that produced the scorecard. OpenAI's Preparedness Framework uses a four-tier rating scale for each risk category: Low, Medium, High, and Critical. o3-mini's post-mitigation profile sits at Medium or below across every category, which is what allowed deployment to proceed.

Where does this fit in the bigger picture?

The Medium Persuasion and Medium CBRN ratings carry their own weight. Persuasion risk measures whether a model can manipulate human beliefs or behavior at scale — a growing concern as AI-generated content floods online platforms. CBRN risk measures whether a model can meaningfully assist in chemical, biological, radiological, or nuclear harm, a category regulators in Washington and Brussels watch closely. OpenAI judged o3-mini's residual risk in both categories as manageable, but not negligible.

The Cybersecurity rating of Low is the card's most reassuring number. It signals that OpenAI's testers did not find the model meaningfully raises the bar for offensive cyber operations relative to what already exists.

The stakes here go beyond one model. Frontier AI developers publish system cards under pressure from regulators, researchers, and the public to demonstrate that capability gains come with verifiable safety work. OpenAI's Preparedness Framework, with its explicit deploy/develop thresholds tied to numeric risk tiers, has become one of the industry's most-cited templates for that kind of self-regulation. Each new card is a data point in an ongoing argument about whether voluntary frameworks are enough.

What comes next?

The Model Autonomy milestone sets the trajectory. OpenAI's own evaluation logic says the next threshold — a High rating on Model Autonomy — arrives when a model demonstrates real-world ML research capability relevant to self-improvement. o3-mini is not there yet, and the company says its results argue for robust alignment methods, extensive stress-testing, and meticulous risk management protocols as capability climbs. Every future OpenAI system card will now be read against this baseline: the first model the company judged capable enough, at least partially, to work on its own.