OpenAI Drops Apache-Licensed 120B Reasoning Model, Daring the World to Break Its Safety

OpenAI just threw a very large, very open wrench into the reasoning model race. The company released gpt-oss-120b and its smaller sibling gpt-oss-20b under the permissive Apache 2.0 license, a move that feels less like a product launch and more like a gauntlet thrown at the feet of the open-source community. These are text-only models built specifically for agentic workflows—we’re talking tool use, web search, Python execution—with the ability to dial reasoning effort up or down depending on the task. Full chain-of-thought is exposed, Structured Outputs are supported, and they slot right into the Responses API. It’s a direct shot across the bow of models like DeepSeek-R1, but with a licensing model that lets you fine-tune and ship it commercially without a legal headache.

This release comes with a candid, almost blunt safety preamble that reads like OpenAI is bracing for impact. The company draws a hard line between these open weights and its API-served models, spelling out what everyone in security already knows: once the weights are out, a determined attacker can strip the safeguards. No take-backs, no revoking access. They’re calling the documentation a model card, not a system card, explicitly because they can’t control the systems you build around it. The subtext is clear—developers and enterprises are now on the hook for implementing the kind of system-level protections that are baked into ChatGPT. OpenAI is handing you a very sharp knife and a pamphlet that says “please be careful.”

So how sharp is the knife, really? OpenAI’s Safety Advisory Group ran the 120B model through its Preparedness Framework gauntlet, testing for high capability in bio/chemical threats, cyber attacks, and AI self-improvement. The default model didn’t trip any High-risk alarms. But the more unnerving test was the adversarial one. The team aggressively fine-tuned the model, simulating what a bad actor with OpenAI’s own training stack could do. The SAG’s conclusion: even after that robust fine-tuning, gpt-oss-120b didn’t reach the High-capability threshold in bio/chem or cyber risk. That’s the headline number. The fine print is that for most evaluations, existing open models already come close to matching the adversarially fine-tuned performance of this new release.

The company seems to be betting that the frontier has already moved beyond what this model can do, even when abused. If you’re a security researcher reading between the lines, the message is this: the real danger isn’t some unique capability jump, but the sheer accessibility. An Apache 2.0 license on a 120B reasoning model doesn’t just democratize agentic AI—it removes the last friction for integrating it into any pipeline, no matter how sketchy. OpenAI’s reaffirming its commitment to safety standards, but this launch is ultimately a live-fire exercise in ecosystem responsibility. The question isn’t really whether the model is safe. It’s whether the world it’s being released into is.