ai-research-survey

scan.json (20796B)

---

 {
   "paper": {
     "title": "ChatGPT Agent System Card",
     "authors": ["OpenAI"],
     "year": 2025,
     "venue": "OpenAI Technical Report"
   },
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No source code or repository is released. The paper describes internal evaluation infrastructure but provides no public code."
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "No evaluation datasets are released. The paper references internal benchmarks, production benchmarks, and proprietary evaluation sets without providing download links."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No environment specifications, dependency lists, or setup instructions are provided."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No reproduction instructions are included. Most evaluations use internal infrastructure and proprietary data that cannot be replicated externally."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.1.3.2 states: 'We calculate 95% confidence intervals for pass@1 using the standard bootstrap procedure.' Confidence intervals are reported for SWE-bench results."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes many comparative claims (e.g., 'ChatGPT agent generally outperforms o3') but no statistical significance tests are reported for these comparisons."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Results are reported with absolute scores and baselines (e.g., specific percentages for ChatGPT agent vs o3 on multiple benchmarks), providing context for the magnitude of differences."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "Sample sizes are stated (e.g., n=477 for SWE-bench Verified, 97 multiple-choice questions) but no justification or power analysis is provided for why these sizes are adequate. One exception: Section 5.2.2.5 mentions 'we explicitly considered the statistical power reflected in our study design' for the novice uplift study, but no power analysis details are given."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "Most results are reported as single point estimates. The SWE-bench section mentions averaging over 4 tries per instance but does not report standard deviation or variance across runs for most benchmarks."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "OpenAI o3, o4-mini, and GPT-4o are consistently used as baselines across nearly all evaluations."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": false,
         "justification": "All baselines are OpenAI's own models (o3, o4-mini, GPT-4o). No external baselines from competing systems (Claude, Gemini, Llama) are included, making it impossible to assess performance relative to the broader landscape."
       },
       "ablation_study": {
         "applies": true,
         "answer": false,
         "justification": "No ablation study isolates the contribution of individual components (deep research, Operator browsing, terminal tool, connectors). The system is evaluated as a whole."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Multiple metrics are used across different evaluation domains: not_unsafe scores, accuracy, pass@1, SimpleQA accuracy, hallucination rates, BBQ bias scores, and various safety-specific metrics."
       },
       "human_evaluation": {
         "applies": true,
         "answer": true,
         "justification": "Human evaluation is used in several places: human red-teamers for biosecurity (Section 5.2.2.5), human graders for biorisk questions (Section 5.2.1.1), and the novice uplift study with 59 human participants."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "No explicit discussion of held-out test sets vs development sets. The paper does not clarify whether reported results are on data used for any tuning or selection decisions."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by category extensively: disallowed content by category (hate, sexual, etc.), biosecurity by threat creation stage, CTF by difficulty tier, coding by benchmark type."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Several failure modes are discussed: SimpleQA accuracy lower than o3 due to search behavior (Section 2.3), agent failing to recover from tool failures in biosecurity tasks (Section 5.2.1.3), and specific CTF failure patterns."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Negative results are reported: ChatGPT agent scores lower than o3 on SimpleQA accuracy, shows a drop vs o3 on some biosecurity hard questions with safety mitigations, and 'no model is able to solve the scenario unaided' in certain cyber evaluations."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The introduction's claims about combining deep research, Operator, and terminal capabilities with safety protections are supported by the detailed evaluation sections that follow."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes causal claims about safety mitigations (e.g., mitigations reduce harmful outputs) but does not provide controlled ablation of specific mitigations to support these claims rigorously. Results are shown with and without mitigations in some cases but the study design is not clearly controlled."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims the system has 'our strongest suite yet of end-to-end safety protections' but evaluations cover limited scenarios. The generalization from specific benchmarks to real-world safety is not explicitly bounded."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No substantive discussion of alternative explanations for the results. For example, when ChatGPT agent outperforms o3 on some biosecurity tasks, the paper does not discuss whether this is due to browsing capability, model improvements, or other confounds."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper refers to 'ChatGPT agent', 'OpenAI o3', 'o4-mini', and 'GPT-4o' without specific version identifiers, snapshot dates, or API version strings."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "No actual prompts or system instructions used in evaluations are provided. Evaluation methodology is described in natural language only."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameters (temperature, top-p, max tokens) are reported for any of the evaluations."
       },
       "scaffolding_described": {
         "applies": true,
         "answer": true,
         "justification": "The agentic scaffolding is described at a high level: browsing via Operator, terminal tool, connectors, deep research capability. Section 5.1.3.2 mentions 'an internal tool scaffold designed for efficient iterative file editing and debugging' for o3/o4-mini. The system's multi-layered safety stack is described in detail."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "Data preprocessing for evaluation datasets is not documented. For example, how production benchmark conversations were selected and processed is not described."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.3 ('Remaining Risks') serves as a limitations section, discussing residual risks including unknown jailbreaks, incremental information leaking, and trajectory visibility."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Specific threats are discussed: 'there is a risk of previously unknown universal jailbreaks' (Section 5.3), limitations of confidence intervals for SWE-bench (sampling variance vs problem-level variance), and limitations of the novice uplift study design."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not explicitly state what the evaluations do NOT show. There is no equivalent of 'what the evidence does not demonstrate' — the Remaining Risks section discusses potential failures but does not bound the scope of safety claims."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw evaluation data is available for independent verification. All results are reported in aggregate."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Data collection is described for several evaluations: SWE-bench Verified uses a validated subset of n=477, production benchmarks are described as representative of production data, biorisk rubric was developed collaboratively with external biosecurity organizations."
       },
       "recruitment_methods_described": {
         "applies": true,
         "answer": true,
         "justification": "For the novice uplift study (Section 5.2.2.5), recruitment is described: 59 participants across two rounds, with 179 total submissions, though selection criteria for participants are not detailed. Red team participants from external biosecurity organizations (Gryphon Scientific, SecureBio) are named."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "The full pipeline from raw evaluation outputs to reported metrics is not documented. Processing steps, filtering criteria, and any exclusions are not described."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding disclosure or acknowledgments section is present in the paper."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "The paper is authored by 'OpenAI' and this is clearly stated. The conflict — OpenAI evaluating its own product — is self-evident from the authorship."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "OpenAI is evaluating its own commercial product (ChatGPT Agent). The funder/producer has a direct financial interest in the outcome of these safety evaluations."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "No training data cutoff date is stated for ChatGPT agent or the comparison models."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether benchmark data (SWE-bench, SimpleQA, BBQ, etc.) appeared in the model's training data."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": false,
         "justification": "Several benchmarks used (SWE-bench, BBQ, SimpleQA) are publicly available and may have been in training data. This is not discussed."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": true,
         "answer": false,
         "justification": "The novice uplift study (Section 5.2.2.5) involves 59 human participants but no pre-registration is mentioned."
       },
       "irb_or_ethics_approval": {
         "applies": true,
         "answer": false,
         "justification": "No IRB or ethics board approval is mentioned for the novice uplift study involving human participants."
       },
       "demographics_reported": {
         "applies": true,
         "answer": false,
         "justification": "No demographic information is provided about the 59 participants in the novice uplift study beyond being described as 'novices'."
       },
       "inclusion_exclusion_criteria": {
         "applies": true,
         "answer": false,
         "justification": "No inclusion or exclusion criteria are described for participant selection in the novice uplift study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "The novice uplift study is not a randomized controlled experiment comparing treatment vs control; it tests whether participants can achieve harmful outcomes with the model."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "Blinding is not feasible for a study where participants knowingly interact with a specific AI system to test its safety."
       },
       "attrition_reported": {
         "applies": true,
         "answer": false,
         "justification": "59 participants submitted 179 submissions but no attrition data is reported — it is unclear if any participants dropped out or were excluded."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference costs, token usage, or latency figures are reported for any of the evaluations despite extensive use of multiple models across many benchmarks."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total computational budget, GPU hours, or API costs are stated for the evaluation campaigns."
       }
     }
   },
   "claims": [
     {
       "claim": "ChatGPT agent performs at parity with OpenAI o3 on the standard disallowed content evaluation and generally outperforms o3 on the more challenging production benchmark set.",
       "evidence": "Tables 1 and 2 in Section 2.1 show detailed per-category not_unsafe scores comparing ChatGPT agent to o3.",
       "supported": "moderate"
     },
     {
       "claim": "ChatGPT agent scores lower on SimpleQA accuracy than o3 but has a lower hallucination rate.",
       "evidence": "Section 2.3 reports accuracy and hallucination scores, with manual investigation attributing the gap to search behavior and grading rubric edge cases.",
       "supported": "moderate"
     },
     {
       "claim": "ChatGPT agent significantly outperformed o3 on hard biosecurity questions that o3 typically answers incorrectly.",
       "evidence": "Section 5.2.1.3 reports SecureBio evaluation: agent answered 4 hard questions correctly vs o3's average of ~0 across 10 runs. However, with safety mitigations the agent shows a performance drop.",
       "supported": "moderate"
     },
     {
       "claim": "The model does not provide meaningful uplift to novices attempting to create biological threats.",
       "evidence": "Section 5.2.2.5 describes a novice uplift study with 59 participants across two rounds. Of 179 submissions, 16 were flagged as concerning but none were assessed to demonstrate significant uplift.",
       "supported": "weak"
     },
     {
       "claim": "ChatGPT Agent performs comparably to o3 and o4-mini across CTF challenge tiers.",
       "evidence": "Section 5.1.2 reports CTF results with 12 attempts per task showing comparable performance across difficulty tiers.",
       "supported": "moderate"
     }
   ],
   "methodology_tags": ["benchmark-eval", "case-study"],
   "key_findings": "This is OpenAI's system card for ChatGPT Agent, a unified agentic system combining deep research, web browsing (Operator), and terminal access. Safety evaluations show the model performs at parity or slightly better than o3 on most safety benchmarks while demonstrating enhanced capabilities on challenging tasks. OpenAI chose a precautionary 'High' classification under their Preparedness Framework for biological risks, despite not having definitive evidence of meaningful novice uplift. The paper describes a multi-layered safety stack including safety training, automated monitors, user confirmations, and a rapid remediation protocol.",
   "red_flags": [
     {
       "flag": "Company evaluating own product",
       "detail": "OpenAI is the sole evaluator of its own commercial product. While some external organizations (Gryphon Scientific, SecureBio) contributed to biosecurity evaluations, the vast majority of evaluations are entirely internal with no independent verification."
     },
     {
       "flag": "Only internal baselines",
       "detail": "All comparison baselines are OpenAI's own models (o3, o4-mini, GPT-4o). No external competing models are included, making it impossible to contextualize performance within the broader landscape."
     },
     {
       "flag": "No raw data or reproduction path",
       "detail": "No evaluation code, datasets, prompts, or raw data are released. Results cannot be independently verified or reproduced."
     },
     {
       "flag": "Contamination risk unaddressed",
       "detail": "Multiple public benchmarks are used (SWE-bench, BBQ, SimpleQA) without any discussion of whether the model was trained on this data."
     },
     {
       "flag": "Weak novice uplift study design",
       "detail": "The key safety claim — no meaningful novice uplift for bioweapons — rests on a study with 59 participants, no pre-registration, no IRB approval, no demographic reporting, and no clear inclusion criteria. The paper acknowledges limitations of the safety system but still concludes low risk."
     }
   ],
   "cited_papers": [
     {
       "title": "A StrongREJECT for Empty Jailbreaks",
       "authors": ["A. Souly", "Q. Lu", "D. Bowen"],
       "year": 2024,
       "arxiv_id": "2402.10260",
       "relevance": "Benchmark for evaluating jailbreak resistance in LLMs, directly relevant to AI safety evaluation methodology."
     },
     {
       "title": "BBQ: A hand-built bias benchmark for question answering",
       "authors": ["A. Parrish", "A. Chen", "N. Nangia"],
       "year": 2021,
       "arxiv_id": "2110.08193",
       "relevance": "Bias evaluation benchmark used to assess fairness in LLM outputs."
     },
     {
       "title": "Building an early warning system for LLM-aided biological threat creation",
       "authors": ["T. Patwardhan", "K. Liu", "T. Markov"],
       "year": 2023,
       "relevance": "Foundational work on evaluating biological risks from LLMs, directly relevant to AI safety methodology."
     },
     {
       "title": "Lab-Bench: Measuring capabilities of language models for biology research",
       "authors": ["J. M. Laurent", "J. D. Janizek"],
       "year": 2024,
       "relevance": "Benchmark for evaluating LLM capabilities in biology, relevant to dual-use risk assessment."
     },
     {
       "title": "Introducing SWE-bench Verified",
       "authors": ["N. Chowdhury", "J. Aung", "C. J. Shern"],
       "year": 2024,
       "relevance": "Key benchmark for evaluating AI coding agents on real-world software engineering tasks."
     },
     {
       "title": "PaperBench: Evaluating AI's ability to replicate AI research",
       "authors": ["G. Starace", "O. Jaffe", "D. Sherburn"],
       "year": 2025,
       "relevance": "Benchmark evaluating AI agents' ability to replicate research papers, relevant to AI capability assessment."
     }
   ]
 }