“Guardrails (a la ChatGPT) may be in place, but the guardrails will teeter between being too weak (beaten by “jailbreaks”) and too strong (rejecting some perfectly reasonable requests).”
Our reading, the sentence that was checked:
Guardrails like ChatGPT's may be in place for GPT-5, but they will teeter between being too weak (beaten by jailbreaks) and too strong (rejecting some perfectly reasonable requests).
Assessment: Supported Settled before its deadline on 2026-10-29 Evidence as of
Where and when Gary Marcus wrote it
Marcus on AI, What to Expect When You’re Expecting … GPT-5, paragraph 5.
- Said
- Source observed
- live page, full text, public
- Evidence as of
- the cutoff for this assessment
- Assessment recorded
- assessment marcus-what-to-expect-when-youre-expecting-62e-05ddec-a2
We recorded 15 claims from this post. See every claim from this post.
The wording above is the version this site observed on 2026-10-28. The source may have been edited after 2025-07-27. This page does not claim the wording was captured then.
What the claim commits to
- Kind
- Forecast
- Deadline, as the speaker wrote it
- None stated. This site does not add one.
- Deadline state when assessed
- Settled before its deadline
- Deadline state on 2026-10-29
- Settled before its deadline (the release’s reference date)
Conditions
- guardrails (a la ChatGPT) may be in place (qualifier, stated by the speaker)
From the speaker
- Guardrails (a la ChatGPT) may be in place
- the guardrails will teeter
- beaten by “jailbreaks”
- rejecting some perfectly reasonable requests
Our interpretation
- The target is the original GPT-5 system and its main and thinking models, not every later GPT-5-branded successor.
- The plain reading predicts coexistence of successful safety bypasses and unwarranted refusals. It does not specify a failure rate or require deterioration relative to GPT-4.
- I interpret 'teeter' as exhibiting both failure types, rather than requiring a measured sequence of oscillating policy changes.
- I treat the presence of guardrails as a condition and check it separately.
Counts as supported if: Dated evaluations of GPT-5 document both successful jailbreaks and refusals of requests reasonably classified as benign.
Counts as contradicted if: Direct evaluations establish that one of the asserted failure types does not occur across the claimed operating scope. Improvements or perfect scores on a limited test do not establish this.
Retrospective: these criteria were written after the outcome was public.
Current assessment
Did the forecast come true?
Outcome: Supported
The dated evidence matches what the claim committed to, under the criteria frozen before grading.
Scored on a plain reading. The speaker named no measure for this claim, so it was judged on the reading an informed reader would take, stated below under our interpretation. Both reviews had to find that reading fair.
- Evidence as of
- Deadline state when assessed
- Settled before its deadline
- Assessment recorded
- Policy version
- 2026-10-28.7
Rationale
OpenAI's system card, public by August 13, 2025, documents GPT-5-thinking safeguards and a jailbreak that bypassed all mitigation layers [e1, e2]. A study published January 25, 2026, reports GPT-5 refusals on health prompts classified as benign by majority agreement among seven moderation models [e3]. Together, these establish both failure types under the contract's coexistence reading of 'teeter' [e1, e2, e3]. OpenAI also reported improved safety and helpfulness relative to o3 in a biological-risk evaluation published August 12, 2025; those improvements do not negate the documented failures [e4, e2, e3].
Limitations
- The evaluations do not establish temporal oscillation, ordinary-user failure rates, or persistence in one unchanged deployment [e2, e3].
- The benign-request study uses generated boundary prompts, automated benignness judgments, and keyword-based refusal detection rather than human review of every refusal [e3].
- The jailbreak evaluation included privileged access to prototype safeguards and internal information, limiting comparisons with ordinary attackers [e2].
Evidence (4 items)
Supports the claim: OpenAI,
These system level protections are a form of defense in depth.
Why it matters here: The surrounding section describes monitoring of GPT-5-thinking traffic alongside model refusals. The guardrails-present condition is met.
- Publisher
- OpenAI
- Kind of source
- Company disclosure: the company describing itself, not an independent finding
- Describes events of
- Public from
Supports the claim: OpenAI,
One of the jailbreaks evades all layers of mitigations and is being patched.
Why it matters here: OpenAI reports that UK AISI found GPT-5-thinking jailbreaks, including one bypassing every mitigation layer. This establishes the bypass component without claiming that most attacks succeed.
- Publisher
- OpenAI
- Kind of source
- Company disclosure: the company describing itself, not an independent finding
- Describes events of
- Public from
Supports the claim: Zhihao Zhang and colleagues, arXiv,
including GPT-5 and GPT-OSS achieve the highest safety for toxic prompt rejection but reject most benign prompts
Why it matters here: The published finding establishes GPT-5 refusals on the study's benign health prompts. Benign labels come from majority agreement among seven moderation models; the event date marks publication of the finding because exact test dates are unstated.
- Publisher
- Zhihao Zhang and colleagues, arXiv
- Kind of source
- Preprint, not peer reviewed
- Describes events of
- Public from
Context only: OpenAI,
substantially outperforms o3 on both safety and helpfulness metrics.
Why it matters here: This counters an interpretation that the trade-off prevented improvements in both dimensions. It does not negate the documented existence of either failure type.
- Publisher
- OpenAI
- Kind of source
- Preprint, not peer reviewed
- Describes events of
- Public from
Where it was said (1)
Said once in the sources this register covers.
: Marcus on AI, What to Expect When You’re Expecting … GPT-5
Guardrails (a la ChatGPT) may be in place, but the guardrails will teeter between being too weak (beaten by “jailbreaks”) and too strong (rejecting some perfectly reasonable requests).
- Where
- paragraph 5
- Published
- 2025-07-27
- Source observed
- , live page
- Access
- full text, public
History
Assessment versions
- Assessment marcus-what-to-expect-when-youre-expecting-62e-05ddec-a2: Current. Outcome: Supported. Evidence as of 2026-10-28. Public date not recorded.
Recorded events
Assessment publishedBy this site
First assessment published after both reviews and the final-text check passed.
About assessment marcus-what-to-expect-when-youre-expecting-62e-05ddec-a2.