OpenAI drops Deep research safety system card

Giving an AI the keys to browse the open web, read random PDFs, and execute its own code sounds like the ultimate productivity dream, or a security engineer's worst nightmare.

OpenAI just dropped the official System Card for Deep Research, revealing the safety evaluations and architectural details behind its new agentic research tool.

Powered by an early o3

Deep Research is not just another search wrapper. OpenAI confirmed it is powered by an early version of OpenAI o3 that has been specifically fine-tuned for web browsing.

Instead of single-turn lookups, the model conducts multi-step investigations. It can parse through massive amounts of text, images, and PDF documents, and it actually uses reasoning to pivot its search strategy on the fly when it hits a dead end.

On top of that, it can inspect user-uploaded documents and analyze complex data by writing and running Python code directly.

Browsing the web invites new threats

Putting an autonomous model on the live internet opens up a whole new attack surface. OpenAI ran external red teaming and frontier risk evaluations under its Preparedness Framework.

Across all four tracked frontier categories, CBRN, cybersecurity, persuasion, and model autonomy, Deep Research scored a Medium risk rating.

Beyond those high-level threats, OpenAI flagged prompt injections as a primary battlefield. When an agent reads unvetted web pages, malicious actors can plant hidden instructions to hijack the model's session.

To counter this, OpenAI put in extra safety mitigations before expanding access to Pro users. That included hardening the model against indirect prompt injections found in the wild and bolstering safeguards around personal information scraped from online sources.

Why it matters

For power users, researchers, and analysts, an autonomous agent that can read multi-page whitepapers and run code cuts hours of manual grunt work into minutes. It is easily one of the most compelling use cases for reasoning models today, though users still need to watch out for subtle hallucinations in long reports.

For the broader industry, this release makes one thing clear: reasoning plus tool use is the new frontier. Simple retrieval-augmented generation is no longer enough when models can plan, iterate, and verify across web sources.

We think OpenAI's decision to classify autonomy and cybersecurity at Medium shows how thin the line is between helpful agents and risky systems. While training the model to resist malicious web prompts is a smart first line of defense, securing an agent that executes arbitrary code while reading the wild web remains an unsolved challenge that the entire industry will have to grapple with.