OpenAI Release Notes

OpenAI is committing $1 billion in subsidized Daybreak access, training, technical support, and partnerships to help frontline defenders protect essential services.

Today OpenAI is introducing Daybreak for Frontline Defenders, a new global initiative to help frontline defenders use frontier AI cyber capabilities to protect essential services in the United States and around the world. The initiative includes:

• A $1 billion global commitment to expand subsidized access to Daybreak cyber models and products, training, technical support, and partnerships in the United States and internationally.
• Daybreak for America, bringing together all of OpenAI’s U.S. work to protect the systems Americans rely on every day—from water and electricity to local government and banking—including a new pilot with the Multi-State Information Sharing and Analysis Center (MS-ISAC).
• More than 35 enterprise products and partner-operated services through the Daybreak Defense Network, bringing Daybreak cyber models into the tools, services, and workflows enterprise defenders already use.

Every day, we depend on cyber defenders to protect the systems that keep communities running: the water coming from the tap, the electricity powering homes and businesses, the local government systems that deliver public services, and the financial institutions people trust with their money. Many operate with limited staff and budgets, while defending complex and aging systems.

In the coming months, AI-enabled cyber attacks will become far more widespread and sophisticated as models around the world become increasingly capable. That shift puts every organization on notice. Defenders need to act now: test systems, find weaknesses, and strengthen defenses before attackers do.

Frontier AI can help defenders move faster. We have a defender’s window: a narrowing opportunity to use AI to close security gaps before attackers seize them. Our role is to help put powerful tools in defenders’ hands so they can protect the systems, and the people, they are responsible for.

Last week, we called for collective action to seize that window, alongside more than 150 organizations across cybersecurity, technology, critical infrastructure, finance, and AI. No single company can secure the systems we all depend on. Every organization has a role to play, and defenders need the tools to move faster.

Today, OpenAI is making a major commitment to help. Daybreak for Frontline Defenders brings together $1 billion in subsidized access to frontier cyber capabilities, hands-on training and technical assistance, and new partnerships to get those capabilities to organizations that protect the services people depend on every day. We are starting where the gap is greatest: with defenders carrying enormous responsibility without the resources of the world’s largest companies. Our goal is to build a model that can protect the services Americans rely on and, with our partners, help put frontier cybersecurity in the hands of frontline defenders around the world.

$1 billion for frontline defenders

OpenAI is committing $1 billion in subsidized Daybreak access to help resource-constrained cyber defenders, starting with the United States, put frontier AI to work, targeting it to be consumed over the next six months. As part of our “Daybreak for America” commitment, we will prioritize operators of essential services—including water and wastewater systems and electric grid operators, alongside state and local governments, community and regional banks, nonprofits, open-source maintainers, and other organizations with limited security resources. Many of these teams defend complex and often aging systems against faster-moving threats without the budgets, tools, or specialized expertise available to large enterprises. Daybreak access can help them review legacy code, analyze suspicious activity, identify and validate vulnerabilities, prioritize the most serious risks, and develop and test fixes. In the coming weeks, we intend to expand this model to partner countries.

This commitment builds on support already provided to infrastructure defenders facing urgent threats. Following recent attacks on U.S. water systems, we offered affected states and utilities up to $1 million in no-cost API credits, Daybreak access, and technical assistance. Teams were able to use that support to review code and system configurations, validate findings, develop patches, and confirm fixes while water systems remained operational and communities continued receiving the services they depended on.

Expanded access to frontier AI and hands-on support for defenders

Earlier this year, we launched Daybreak, which enables verified public and private sector defenders to use advanced AI for authorized cyber defense. Daybreak Blue supports common defensive work with our mainline models; Daybreak Red gives approved organizations access to specialized cyber models for more sensitive and technically demanding work. Thousands of defenders across 2,000 approved organizations and workspaces already use Daybreak, including cybersecurity companies, defense organizations, and law enforcement organizations.

Alongside broader access, we are increasing hands-on support for frontline defenders in essential sectors. We have convened an ongoing series of meetings with frontline defenders, including utilities, state and local governments, community banks, and others, to learn from their work and help them use our tools to harden their systems, and we will continue those convenings as Daybreak for Frontline Defenders expands. This week’s second gathering of utility companies brought together participants representing 40 states and the District of Columbia that collectively provide essential services to more than half of the U.S. population.

New partnerships with defenders

Access to capable models is only useful if frontline defenders have the training and support to use them effectively. Today, we are announcing a public sector and water-focused pilot with the Multi-State Information Sharing and Analysis Center, or MS-ISAC, to train and support state, local, tribal, and territorial cyber defenders. The pilot will pair Daybreak access with guided training and hands-on assistance for an initial group of public sector and water system defenders, helping them validate and prioritize findings, coordinate remediation, and develop a repeatable approach that can be expanded over time.

MS-ISAC provides cyber-threat intelligence, incident-response support, real-time information sharing, and other shared defenses to thousands of public-sector organizations, including utilities, public hospitals, K–12 schools, and law-enforcement agencies. Its members protect many of the systems closest to Americans’ daily lives—from drinking water and public hospitals to schools, emergency services, and local governments. The pilot is intended to develop a model that could eventually benefit organizations across that broader community.

Support also needs to reach defenders through the tools and services they already use. Today, our partners across the Daybreak Defense Network are announcing more than 35 partner products and partner-operated services that bring OpenAI’s Daybreak cyber models into the hands of the enterprise. Our goal is collective action becoming operational, with products, services, and workflows defenders can use.

Ultimately, the goal is not just to find more vulnerabilities, but to fix them faster. This week, we published OpenAI’s approach to building a Defense Factory: a continuous, agent-first operation that builds on existing security and engineering tools to find and validate vulnerabilities and prepare tested fixes for review. We are sharing its architecture and lessons so other defenders can adapt the approach to their own environments.

Work with us

The defender’s window will not stay open indefinitely. The opportunity now is to make sure the advantages frontier AI can give defenders reach beyond the largest companies and best-resourced security teams—and into the communities and institutions whose security affects millions of people.

That means more than providing access to capable models. It means helping frontline defenders—water utilities, community banks, health systems, local governments—find vulnerabilities, turn them into tested fixes, and protect those they serve. Daybreak for Frontline Defenders is our commitment to putting that capability in the hands of the frontline defenders who need it most. Our goal is to use frontier AI to make the systems Americans depend on harder to attack and easier to repair.

Eligible state and local governments, critical infrastructure operators, nonprofits, open-source maintainers, and supporting organizations can visit the Daybreak website to learn more about access, technical assistance, training, and other cyber-defense support.

Today, we are releasing GPT‑6 Astra, the most capable model we have ever broadly deployed. Astra is our first model to reach the Critical level of cybersecurity capability under our Preparedness Framework.

The most important things to know about the safety of this launch are as follows:

1. GPT‑6 Astra is a significant step up in cyber capabilities and meets our Critical threshold. This means that, with the right tools and access, GPT‑6 Astra can find previously unknown security flaws and develop new ways to exploit them across many well-protected systems without a person guiding each step. Accordingly, we significantly strengthened our protections against the model taking harmful cyber actions, whether that’s due to misuse or misalignment. We also took steps to secure our internal development and deployment of Astra and similar models, including stricter isolation, checkpoint encryption, universal monitoring of full trajectories including chains of thought (CoT), and a blocking alignment evaluation process before internal use.

2. GPT‑6 Astra is significantly more robust than its predecessors. Incorporating new robustness safety training techniques, GPT‑6 Astra is significantly more robust to jailbreaks than GPT‑5.6 Sol, including across longer trajectories. We know this from offline tests and our program of rigorous internal and external jailbreak testing and remediation. For users flagged as potentially high risk, we have additionally trained in the ability to adjust the model’s refusal boundary to be more conservative and cover a broader range of dual use risks. We use regression testing to make sure Astra is robust against jailbreaks found in previous testing periods, and performed new rounds of automated red-teaming with our latest internal red-teaming attackers to validate our improvements.

3. GPT‑6 Astra is better aligned than GPT‑5.6 Sol. Astra is a significant step forward in model alignment, and includes alignment improvements spanning the composition of our pre-training data to our grading during reinforcement learning. We report a new suite of alignment evaluations⁠ (opens in a new window), and find that GPT‑6 Astra is stronger at respecting safety and security boundaries and staying within its authorized scope. In a simulation using more than 54,000 internal Codex tasks⁠ (opens in a new window), Astra also received roughly half as many flags for higher-severity misaligned behavior as Sol.

4. We are deploying misalignment monitoring broadly. We view model alignment as the primary lever to prevent potential misaligned behavior from our models. However, monitoring provides broad visibility into frontier model behavior, illuminating opportunities to further improve alignment and safety. In addition, monitoring serves as an additional layer of protection against misaligned behavior that is detected. For these reasons, we have additionally added misalignment monitoring to all tool-using inference involved in our external deployment of Astra, with significant compute cost. This system parallels our internal setup.

5. GPT‑6 Astra’s monitorability has decreased relative to GPT‑5.6 Sol. We have performed significant investigations on the monitorability⁠ (opens in a new window) and controllability⁠ (opens in a new window) of GPT‑6 Astra. We have found that GPT‑6 Astra is more capable of controlling its own CoT than GPT‑5.6 Sol, and less likely to include incriminating information in its CoT. In adversarial settings (where we push the model to evade our monitors) we find that the model is able to remain undetected when strategically underperforming in evaluations (sandbagging) and can sometimes evade our internal monitors when asked to perform certain sabotage tasks⁠ (opens in a new window). We have not seen evidence of steganographic CoT reasoning (e.g., concealing hidden reasoning within ordinary and seemingly unrelated text), indicating that the evasion risk may largely be bounded to lower reasoning tasks.

• These findings indicate that the Astra class models could evade our CoT monitors under adversarial conditions. Right now, these findings are largely based on adversarial evaluations (i.e., when we instruct the model to evade monitoring), and overall our alignment evaluations show that Astra is less likely than GPT‑5.6 Sol to violate security and safety restrictions overall.

• However, we take the trend seriously, and we are continuing to investigate these findings and their implications for monitorability as our models become more capable. OpenAI has worked to preserve and utilize chain of thought monitoring, and preserving CoT monitorability is a core goal of the research program. However, these results also underscore the importance of developing alignment auditing techniques beyond examining the model’s chain of thought.

1. GPT‑6 Astra more responsibly navigates browsing and workplace settings: GPT‑6 Astra is significantly more robust to prompt injections than GPT‑5.6 Sol. We have additionally tested the model’s behavior in realistic browsing and professional computer environments, and find that the model is significantly less likely to perform misaligned and potentially destructive actions (for instance unauthorized transactions, data loss, excessive access, or circumvention of controls) compared to GPT‑5.6 Sol. It also acts more safely when handling harmful requests in agentic settings, such as requests to assist with violent attack planning or commit fraud.

2. GPT‑6 Astra is significantly safer in higher-risk scenarios. GPT‑6 Astra responds more safely than GPT‑5.6 Sol to challenging requests drawn from production and adversarial human red-teaming. Astra achieves a Pareto improvement in safely completing unsafe requests and avoiding unnecessary refusals to harmless requests. These improvements extend to high-severity scenarios where the risk of harm emerges from the broader context rather than an explicit request. Astra also applies age-appropriate safety boundaries more consistently for users under 18.

For more information, see the full system card⁠ (opens in a new window).

Anything you can do on a computer, Astra can do for you. Fast.

GPT-6 Astra is the most intelligent and aligned model in the world, and sets a new state of the art for computer use, browsing, software engineering, cybersecurity, science, and professional work.

Introducing GPT-6 Astra, our most intelligent and aligned model yet, with state-of-the-art capabilities across computer use, coding, cybersecurity, and science.

Astra achieves state-of-the-art results on Agents’ Last Exam, AutomationBench, and ScreenSpot Pro, benchmarks for computer workflow tasks across professions.

Astra is our most aligned model, with substantial improvements in understanding user intent.

GPT-6 Astra is state-of-the-art on FrontierMath Tier 4, ARC-AGI 3, and TerminalBench-4.0.

GPT‑6 Astra is also a major advance for scientific discovery, with state-of-the-art performance on Terminal-Bench Science 0.1 and HealthBench Pro.

GPT-6 Astra is rolling out today to a limited set of organizations and over the coming days will become available to all ChatGPT Plus, Pro, Business, and Enterprise users, as well as through the OpenAI API and AWS.

Be ready to experience Astra at its best.

“Put That There” clip courtesy of MIT Media Laboratory, Chris Schmandt, and Eric Hulteen.

Link to the model card:

• 1,050,000 context window
• 128,000 max output tokens
• Apr 30, 2026 knowledge cutoff

Price per 1 million tokens:

Input $10.00

Cached input $1.00

Cache writes $12.50

Output $50.00

Highly recommended read:

Model guidance for GPT-6-Astra

Compare model features, migration guidance, and prompting best practices across OpenAI models.

Introducing GPT-6 Astra

Today we’re introducing GPT-6 Astra, with improvements in coding, research, computer use, and complex, multi-step work. Astra can create documents, spreadsheets, and presentations that follow your templates and instructions, and adapt when you add requirements or change direction.

Access is rolling out to a limited set of organizations. Astra is not yet generally available. Broader availability is planned over the coming days.

Astra includes additional safety monitoring to look for cases where agents may not have interpreted your instructions correctly. If a potential case is detected, the conversation may be paused or stopped as a precaution for you to review and decide how to proceed.

Zendesk & OneNote Plugins in ChatGPT and Codex [Beta]

Today, we added the Zendesk and OneNote plugins in the Plugin directory. The Zendesk plugin helps teams review support tickets and customer history, find relevant knowledge, and prepare replies in ChatGPT and Codex. Members connect their own Zendesk accounts to work with the support information they can access.

The OneNote plugin helps you find and summarize notes, gather decisions and action items, and create or update notes through supported actions in ChatGPT and Codex.

Read more:

• Zendesk Plugin
• OneNote Plugin

Share Sites with people outside your workspace

Eligible Site owners can now share a live ChatGPT Site with named people outside their workspace, without making the Site public. External viewers can use the shared Site but cannot edit or publish it.

To share, open the Site, select Share, enter the recipient’s email, and save their viewer access. The recipient signs in with the account that was granted access. You can review or remove viewers in the Site’s sharing controls. Learn more in Creating and managing ChatGPT Sites.

Today, we are releasing GPT-6 Astra, the most capable model we have ever broadly deployed. Astra is our first model to reach the Critical level of cybersecurity capability under our Preparedness Framework.

The most important things to know about the safety of this launch are as follows:

1. GPT-6 Astra is a significant step up in cyber capabilities and meets our Critical threshold. This means that, with the right tools and access, GPT-6 Astra can find previously unknown security flaws and develop new ways to exploit them across many well-protected systems without a person guiding each step. Accordingly, we significantly strengthened our protections against the model taking harmful cyber actions, whether that’s due to misuse or misalignment. We also took steps to secure our internal development and deployment of Astra and similar models, including stricter isolation, checkpoint encryption, universal monitoring of full trajectories including chains of thought (CoT), and a blocking alignment evaluation process before internal use.

2. GPT-6 Astra is significantly more robust than its predecessors. Incorporating new robustness safety training techniques, GPT-6 Astra is significantly more robust to jailbreaks than GPT-5.6 Sol, including across longer trajectories. We know this from offline tests and our program of rigorous internal and external jailbreak testing and remediation. For users flagged as potentially high risk, we have additionally trained in the ability to adjust the model’s refusal boundary to be more conservative and cover a broader range of dual use risks. We use regression testing to make sure Astra is robust against jailbreaks found in previous testing periods, and performed new rounds of automated red-teaming with our latest internal red-teaming attackers to validate our improvements.

3. GPT-6 Astra is better aligned than GPT-5.6 Sol. Astra is a significant step forward in model alignment, and includes alignment improvements spanning the composition of our pre-training data to our grading during reinforcement learning. We report a new suite of alignment evaluations, and find that GPT-6 Astra is stronger at respecting safety and security boundaries and staying within its authorized scope. In a simulation using more than 54,000 internal Codex tasks, Astra also received roughly half as many flags for higher-severity misaligned behavior as Sol.

4. We are deploying misalignment monitoring broadly. We view model alignment as the primary lever to prevent potential misaligned behavior from our models. However, monitoring provides broad visibility into frontier model behavior, illuminating opportunities to further improve alignment and safety. In addition, monitoring serves as an additional layer of protection against misaligned behavior that is detected. For these reasons, we have additionally added misalignment monitoring to all tool-using inference involved in our external deployment of Astra, with significant compute cost. This system parallels our internal setup.

5. GPT-6 Astra’s monitorability has decreased relative to GPT-5.6 Sol. We have performed significant investigations on the monitorability and controllability of GPT-6 Astra. We have found that GPT-6 Astra is more capable of controlling its own CoT than GPT 5.6-Sol, and less likely to include incriminating information in its CoT. In adversarial settings (where we push the model to evade our monitors) we find that the model is able to remain undetected when strategically underperforming in evaluations (sandbagging) and can sometimes evade our internal monitors when asked to perform certain sabotage tasks. We have not seen evidence of steganographic CoT reasoning (e.g., concealing hidden reasoning within ordinary and seemingly unrelated text), indicating that the evasion risk may largely be bounded to lower reasoning tasks.

These findings indicate that the Astra class models could evade our CoT monitors under adversarial conditions. Right now, these findings are largely based on adversarial evaluations (i.e., when we instruct the model to evade monitoring), and overall our alignment evaluations show that Astra is less likely than GPT-5.6 Sol to violate security and safety restrictions overall.

However, we take the trend seriously, and we are continuing to investigate these findings and their implications for monitorability as our models become more capable. OpenAI has worked to preserve and utilize chain of thought monitoring, and preserving CoT monitorability is a core goal of the research program. However, these results also underscore the importance of developing alignment auditing techniques beyond examining the model’s chain of thought.

1. GPT-6 Astra more responsibly navigates browsing and workplace settings: GPT-6 Astra is significantly more robust to prompt injections than GPT-5.6 Sol. We have additionally tested the model’s behavior in realistic browsing and professional computer environments, and find that the model is significantly less likely to perform misaligned and potentially destructive actions (for instance unauthorized transactions, data loss, excessive access, or circumvention of controls) compared to GPT-5.6 Sol. It also acts more safely when handling harmful requests in agentic settings, such as requests to assist with violent attack planning or commit fraud.

2. GPT-6 Astra is significantly safer in higher-risk scenarios. GPT-6 Astra responds more safely than GPT-5.6 Sol to challenging requests drawn from production and adversarial human red-teaming. Astra achieves a Pareto improvement in safely completing unsafe requests and avoiding unnecessary refusals to harmless requests. These improvements extend to high-severity scenarios where the risk of harm emerges from the broader context rather than an explicit request. Astra also applies age-appropriate safety boundaries more consistently for users under 18.

For more information, see the full system card.

New Features

• Vim mode now supports undo with u and redo with Ctrl+R, preserving complete drafts including pasted content and attachments. (#41941, #42140)
• The plugin CLI can list, install, and remove plugins from remote marketplaces. (#42150)
• Set tui.auto_recap = false to disable automatic recaps while keeping manual /recap available. (#42101)
• TUI history shows complete patches, input sent to background terminals, and individual completed commands. (#41893, #42107)
• Plus and Team users receive an earlier warning when less than half of their allowance remains in an approximately five-hour usage window. (#42142)

Bug Fixes

• TUI sessions reconnect after an external app-server connection drops, preserving drafts and transcripts while keeping uncertain or queued submissions paused for review. (#41911, #41916, #41918)
• Full Access skips Guardian reviews for confirmation-only actions. User approval mode skips background Guardian scoring and prewarming, while sensitive-action checks and requests for user input retain their existing handling. (#42147, #42256)
• Guardian review history survives compaction, restarts, and user-created forks while respecting rollback boundaries and isolating subagent history. (#41879, #42065)
• Remembered MCP tool approvals are scoped to the selected app account, and relative MCP executable paths start more reliably on macOS. (#42133, #42117)
• Rollout compression includes shared histories, codex exec resume handles compressed rollouts when selecting by working directory, and thread forks work with symlinked session roots. (#42039, #42135)

Configuration and API Updates

• App-server thread metadata includes nullable model and reasoningEffort fields. Structured asynchronous questions are supported through request_user_input_async when enabled by the model catalog. (#42151, #42178)
• tui.disable_paste_burst replaces the top-level setting, which remains supported as a fallback. (#41976)
• Adds the disabled-by-default features.context_management.experimental_mode configuration. When enabled for eligible ChatGPT Plus, Pro, or Pro Lite sessions using the Codex backend, it activates token-budget context, history notes, and the new_context tool. API-key sessions, custom providers, and temporary structured threads remain excluded. (#42385)

Changelog

Full Changelog

• #41870 Use shared transcript collection for Guardian reviews
• #41879 Preserve Guardian review evidence across compaction
• #41884 Add pinned native voice source preparation
• #41890 Add native voice dependency build recipe
• #41892 Retain the MCP client for event streams
• #41893 Show successful TUI commands individually
• #41894 Fix Windows native voice dependency builds
• #41897 Add the voice helper lifecycle foundation
• #41899 Keep MCP event subscriptions alive after task unloading
• #41901 Load bounded context after empty wake turns
• #41902 Add installed voice host lifecycle support
• #41906 Add a manager for MCP event streams
• #41908 Avoid scanning archived rollouts when archiving threads
• #41909 Make permission transforms aware of executor path context
• #41911 Preserve TUI drafts after app-server disconnects
• #41912 Persist response token usage in rollout history
• #41913 Preserve TUI status timing when the status row is hidden
• #41915 Move the config schema generator into a dedicated crate
• #41916 Reconnect TUI app-server sessions automatically
• #41917 Open the agents overview from an empty composer
• #41918 Restore agent navigation after TUI reconnects
• #41923 Allow per-call sideband endpoints for existing realtime calls
• #41924 Record realtime conversation history in Core
• #41925 Test repository-wide Rust formatter discovery
• #41928 Use executor path context for permission preapproval
• #41929 Open the agents overview directly in the reconnect test
• #41933 Report configured sandbox policy consistently
• #41934 Omit undersized WAV output from Code Mode
• #41936 Attach failed Guardian reviews to diagnostic reports
• #41937 Limit background terminal input previews
• #41938 Clarify resume guidance in exit summaries
• #41940 Preserve transcript layout caches during backtrack selection
• #41941 Add Vim undo to the TUI composer
• #41944 Emit turn cost telemetry for ChatGPT sessions
• #41946 Expand extension permission regression coverage
• #41949 Add plugin reconciliation app-server API
• #41950 Improve tracing for nested tool calls and exec processes
• #41953 Enforce marketplace source policy for curated plugins
• #41974 Track TUI starts by app server mode
• #41976 Move disable_paste_burst under [tui]
• #41980 Preserve raw response usage metadata
• #42003 Report turn trigger and source in turn analytics
• #42031 Share Guardian user-message retention logic
• #42033 Improve Guardian report diagnostics
• #42039 Include shared histories in rollout compression
• #42043 Tag Codex home size metrics with compression state
• #42047 Add per-account approval settings for apps
• #42054 Honor explicit account selectors for Apps tool calls
• #42056 Honor app link settings for MCP tool approvals
• #42065 Preserve Guardian history across thread reconstruction
• #42066 Remove selected core test cases
• #42068 Detect standalone installs from the macOS CLI bundle
• #42069 Remove redundant test coverage
• #42071 Detect Vite+-managed Codex installs
• #42076 Unify Guardian context section collection
• #42082 Attribute nested REPL reviews to their tool calls
• #42085 Centralize Guardian context composition
• #42086 Attribute Guardian reviews to OpenAI app tools
• #42094 Record Windows MXC availability
• #42096 Make diagnostic report uploads resilient to slow networks
• #42100 Prefer remote Sites over the bundled plugin
• #42101 Add a TUI setting to disable automatic recaps
• #42102 Extract OTEL trace WebSocket into a reusable crate
• #42104 Show recent sessions in the agent command center
• #42107 [...]

Healthcare plugins for ChatGPT and Codex

Eligible ChatGPT for Healthcare and HIPAA-enabled ChatGPT Enterprise workspaces can now use two healthcare plugins in ChatGPT and Codex:

• Healthcare Public Data: Search nine public healthcare sources for medical research, clinical trials, medication information, Medicare data, and provider records. The plugin is read-only and does not access patient charts.
• Epic: Review authorized patient information from your organization’s Epic electronic health record. Access is read-only and requires an administrator-configured Epic EHR app, an individual Epic sign-in, and existing patient-chart permissions.

Admins manage plugin availability and app access separately. Do not include protected health information in searches sent to public healthcare sources. Before using Epic with protected health information, confirm your organization has an applicable Business Associate Agreement and an approved workspace configuration.

Learn more: Using Healthcare Public Data in ChatGPT and Codex and Using the Epic plugin with ChatGPT and Codex.

Healthcare Public Data in ChatGPT for Clinicians

Eligible ChatGPT for Clinicians users in the United States can now use Healthcare Public Data in ChatGPT. The plugin brings together nine apps for searching public healthcare sources, including biomedical research, clinical trials, medication information, Medicare data, and provider records.

To get started, install the plugin from the Plugin directory, then connect the apps you want to use. These apps are read-only and do not access patient charts. Do not include protected health information in searches sent to public sources.

For details, see: Using Healthcare Public Data in ChatGPT and Codex.

Bring ChatGPT and EHR context together

A new Epic integration and Healthcare Public Data plugin help teams review authorized patient context and work with structured information from official sources in ChatGPT for Healthcare.

Healthcare organizations need AI that works across the systems and information central to care and operations. Patient context, medical evidence, public healthcare data, and organizational knowledge often live in different places. Connecting these sources in a governed workspace helps teams find the right information, understand it in context, and put it to work across the business.

Today, we’re introducing a new electronic health record integration that brings authorized patient context from Epic into ChatGPT for Healthcare, along with the Healthcare Public Data plugin for direct, structured access to official healthcare datasets like PubMed, DailyMed, and CMS Coverage. Together, these capabilities bring ChatGPT closer to the systems and sources healthcare teams trust, while supporting the controls and compliance healthcare work requires.

Healthcare organizations can now connect Epic environments to ChatGPT. Instead of searching across appointment notes, laboratory results, medications, and specialist documentation, clinicians can ask:

• What has changed since this patient’s last visit?
• Which recent lab results should I review before today’s appointment?
• Have there been medication changes or new specialist recommendations?
• What follow-ups, referrals, or unresolved issues should I be aware of?

ChatGPT brings together relevant information from the authorized patient record, summarizes important developments, and points back to supporting chart information.

The integration supports two complementary experiences:

• EHR context in ChatGPT: Bring authorized patient information from a supported EHR into ChatGPT to review patient history, identify changes, and prepare for appointments.
• ChatGPT in the EHR workflow: In supported deployments, ChatGPT can be integrated directly into an EHR layout, enabling AI assisted workflows without leaving the patient chart.

“As a pilot partner, we’re exploring how the new EHR integration with ChatGPT for Healthcare can help clinical teams understand what has changed and what matters most across a complex patient record. By bringing relevant information together more quickly and comprehensively, the technology has the potential to reduce time spent synthesizing data and give clinicians more time with patients. We’re also engaging frontline teams to validate these capabilities in practice and help shape where they can add the most value.”
—Suresh Gunasekaran, President and CEO, UCSF Health

Designed to complement existing EHR workflows, these experiences help clinicians review authorized patient information alongside other trusted sources in ChatGPT.

Work across nine official healthcare sources with one new plugin

Patient context is one part of the information healthcare teams rely on. They also draw on current research and official information about medications, coverage, clinical trials, and providers.

ChatGPT for Healthcare already helps teams answer clinical questions and synthesize medical research with trusted clinical search across thousands of medical sources. Building on that foundation, the Healthcare Public Data plugin brings together dedicated connectors to nine official public healthcare sources, including ClinicalTrials.gov, CMS Coverage, RxNorm, DailyMed, and PubMed. Teams can work with specific records, fields, identifiers, and versions while focusing the task on these authoritative sources. This makes it easier to compare and verify precise information such as trial eligibility criteria, medication identifiers, coverage policy versions, and provider records without searching each source separately.

A research team could use ClinicalTrials.gov to identify actively recruiting trials and compare eligibility criteria, while a pharmacy team could use DailyMed to confirm the latest label and warnings for a medication. A population health team planning a diabetes-prevention program could bring relevant research, active trials, and Medicare coverage information together in a source-backed view, helping program leaders evaluate options and identify open questions.

Evaluated on real healthcare work

Putting connected healthcare context to work depends on models that can interpret it accurately. OpenAI partners with hundreds of physicians across 60 countries, 49 languages, and 26 medical specialties to help us define, measure, and improve health responses in ChatGPT. To date, these physicians have reviewed more than 700,000 model responses across examples that reflect real-world healthcare questions. Their feedback improves model behavior and strengthens healthcare-specific tools.

To understand how ChatGPT performs when working with connected EHR context, physicians evaluated responses across 27 clinical use cases, including pre-visit review, clinical timelines, medication review, and handoff summaries. Across 4,363 ratings, physicians rated 99.1% of responses safe across all use cases.

In a separate two-round evaluation, physicians reviewed hundreds of ChatGPT responses to nuanced clinical questions based on large U.S. healthcare datasets. For each of the five connected data sources tested, more than 93% of responses were rated as having “good” or better accuracy.

These evaluations measure how ChatGPT works with healthcare context, from surfacing relevant information to citing supporting evidence and preparing work that clinicians and staff can review. We continue to invest in dedicated training and evaluation for healthcare to further improve ChatGPT’s performance and reliability.

Put healthcare and business information to work

The same governed workspace that helps teams find and understand healthcare information in context can also help them use it across research, operations, business, and technology. Clinical and business teams can use ChatGPT Work to turn information into reports, analyses, presentations, and plans for review. Technical teams can use Codex to build and improve software that supports care delivery and business operations.

Plugins for Microsoft SharePoint, Google Drive, Salesforce, Slack, and other enterprise systems expand the approved business context available in ChatGPT while preserving existing permissions.

“At AdventHealth, the value of AI starts with our people. By putting tools like ChatGPT Work, Codex, and connected business data in the hands of our team members, AI can reduce routine work and help practical innovations move more quickly into action. The goal is simple: give caregivers and teams more time for the human connection that enables our connected, whole-person care.”
—Robert Purinton, Chief AI Officer at AdventHealth

Get started with ChatGPT for Healthcare

ChatGPT for Healthcare gives clinical, research, and administrative teams a governed workspace for using AI. It combines healthcare-specific capabilities with enterprise controls such as role-based access, single sign-on, and audit logs. With an applicable Business Associate Agreement, customers can use ChatGPT Work, Codex, apps, and plugins in the same workspace to support HIPAA-compliant workflows.

• ChatGPT for Healthcare customers: Ask your workspace administrator to enable the EHR integration and Healthcare Public Data plugin.
• ChatGPT Enterprise customers: Contact your OpenAI account team to confirm eligibility and the right configuration for your Regulated Workspace.
• Individual clinicians: Eligible U.S. ChatGPT for Clinicians users can install the Healthcare Public Data plugin. The EHR integration is not available for individual accounts.

Healthcare organizations can start with the capabilities that fit their needs and expand over time, bringing more of the information central to care and operations into one governed workspace.

Ready to get started with ChatGPT for Healthcare? Contact our sales team⁠ to find the right solution for your organization.

OpenAI supports California Senate Bill 1119

OpenAI supports California Senate Bill 1119, legislation that establishes meaningful safeguards for how young people use AI while preserving their access to tools that can help them learn, create, and prepare for the future. This support builds off the commitment Sam Altman, OpenAI’s co-founder and CEO, made last year when outlining the company’s principles on teens.

In the absence of federal action, California has an opportunity to set a strong standard for youth AI safety.

In our letter to Governor Newsom⁠ (opens in a new window), we commend him, along with Senator Steve Padilla, Assemblymembers Buffy Wicks and Rebecca Bauer-Kahan, and the California Legislature for their leadership on this important issue. SB 1119 builds on youth safety measures that OpenAI has supported through our products, global policy principles, advocacy in California, and work on the Parents & Kids Safe AI Act. We encourage Governor Newsom to sign the bill into law.

Teens are the first generation growing up with AI. Nearly nine in ten teens who use ChatGPT turn to it for learning, information, skill-building, or productivity in a given week. That opportunity comes with a clear responsibility: teens should have experiences designed around their distinct developmental needs, with strong default protections and appropriate opportunities to learn, create, and explore.

Our newly launched ChatGPT for Teens reflects that approach. It is designed to help users under 18 learn, think critically, and build while promoting healthy use, providing built-in safeguards, and giving parents additional controls. If our system estimates someone is under 18 or they state their age is between 13 and 17, they are automatically placed into ChatGPT for Teens. Those protections are part of the baseline experience, not optional settings that users can turn off.

More broadly, we believe that teens can benefit from AI without sacrificing safety, a goal that is at the heart of SB 1119.

A strong framework for age-appropriate AI

SB 1119 pairs strong protections with continued access to useful AI tools. We strongly support these key requirements:

• Determine a user’s age;
• Identify and address safety risks before making a product available to young people;
• Undergo independent audits;
• Protect young people from harmful content, including self-harm, sexually exploitative content, and other high-risk interactions;
• Provide parents with tools to guide and limit their children’s use;
• Connect young people with crisis-support resources when serious safety risks arise; and
• Limit targeted advertising and protect young people’s personal information.

For users identified as ages 13 through 17, these protections should apply automatically. This legislation would combine meaningful accountability with safeguards that would help protect young people as they use AI.

SB 1119 also appropriately recognizes that AI is not social media. The bill establishes protections tailored to help young people use AI to learn, create, and explore. In developing this framework, policymakers sought to preserve access to educational and safety-critical features, including responsible uses of ChatGPT’s memory feature, while promoting safer, age-appropriate experiences for teens.

Building safer, more useful experiences for teens

ChatGPT for Teens includes a suite of features specifically tailored to help teens learn, like Quizzes, Learning Visualizations, and Study mode, developed with educators and learning experts to guide students through problems step by step. These tools are intended to deepen understanding and support stronger learning habits. Features that use context from prior conversations, including memory, help apply safeguards consistently, recognize concerning patterns, and provide more useful learning support over time.

Context also helps these safety and learning tools work more consistently over time. Through features such as memory, ChatGPT can carry forward relevant information and preferences from prior conversations, allowing teens to continue longer-term learning projects without starting over. That continuity can also help avoid reinforcing harmful patterns and support more effective responses when a young person may need additional help or resources.

Balancing safety and learning is not new to us. Over the last year, we’ve added parental controls, age prediction, our Teen Safety Blueprint, and Under-18 Principles to our Model Spec—the rules guiding how our models are intended to behave—to set new standards for how they should interact with young people. They prohibit romantic engagement, encouragement of emotional dependence, and claims that ChatGPT is human or sentient. We also offer parental controls that allow families to manage key settings for their teens and receive notifications in high-risk situations.

SB 1119 establishes a strong framework for youth AI safety in California. Continued study and collaboration during implementation can help improve key provisions and keep the framework effective as the technology evolves. OpenAI looks forward to supporting that work and to continuing to build AI experiences that treat teens like teens with stronger, automatic protections and meaningful opportunities to learn and grow.

New Features

• Vim mode supports / and ? searches within drafts, highlighted matches, and repeat navigation with n and N. (#41586)
• Rate-limit banners offer actions for checking usage, managing credits, resetting limits, and managing plans. (#41742)
• The terminal UI and codex exec show credential-refresh progress, including Amazon Bedrock reauthentication. (#41239)
• MCP server names can contain :, @, /, and ., supporting package-style names throughout CLI commands and authentication. (#41700)
• Individual MCP tools support an output_token_limit setting, with consistent truncation across session resumes. (#41421)
• App-server clients can configure thread/shellCommand timeouts, including deadlines longer than one hour. (#41384)

Bug Fixes

• Vim-enabled composers now start fresh drafts in Insert mode, including after submitting messages or dispatching slash commands. (#41921)
• Automatic approval reviews can retain longer messages and a larger conversation transcript. (#41931)
• Automatic approval reviews preserve user instructions, answers, and valid authorizations across history compaction. (#41660, #41846, #41852)
• Resumed threads restore their saved working directory when none is supplied, and client metadata updates preserve filesystem permissions. (#41567, #41464)
• MCP tools remain available through cache refreshes and remote plugin changes; authentication retries use refreshed helper-provided headers. (#41336, #41344, #41396, #41400)
• Opening the model picker refreshes available models without losing the highlighted choice. (#41467)
• Fixed Windows sandbox execution with Microsoft Store PowerShell, subprocess hangs on terminal queries, and cursor-related display corruption in older JediTerm terminals. (#41227, #41436, #41673)
• Cloud task requests reject untrusted backend URLs and disable redirects to protect saved credentials. (#41403)

Chores

• The planning tool is disabled by default; enable it with tools.update_plan.enabled = true. (#41744)
• Plugin recommendations begin loading during startup, reducing delays before the first turn. (#41375)

Changelog

Full Changelog: rust-v0.151.0...rust-v0.152.0

[followed by detailed changelog entries]