OpenAI adds cross-conversation safety context to ChatGPT with 'safety summaries'

What the update actually changes in the conversation flow

OpenAI's core claim is narrow and specific: ChatGPT now weighs the accumulated context of a conversation, not just the latest message, when deciding how to respond in acute scenarios—suicide, self-harm, and harm-to-others. A request that reads as ordinary in isolation can carry different meaning after earlier signs of distress, and the model is trained to escalate caution when those signals compound.

The response actions named are concrete: de-escalating, refusing harmful details, or redirecting toward safer alternatives. This extends OpenAI's existing 'safe completion' approach, which refuses the unsafe parts of a request while answering what it safely can, rather than blanket-refusing an entire message.

'Safety summaries' are a persistence layer, not memory

The most engineering-relevant piece is how OpenAI handles risk that spans separate conversations. Rather than reading full chat history, a model trained for safety-reasoning tasks writes 'safety summaries'—short, factual notes about earlier safety-relevant context. These are generated by a dedicated model, kept only for a limited time, and invoked only when a serious safety concern is in play.

They are designed to capture factual safety context, not to serve as general personalization or long-term memory.Montana Labs

That boundary is the design decision worth noting. OpenAI is building a purpose-scoped persistence path that runs parallel to the ChatGPT memory feature, with its own generation model, retention window, and trigger conditions. It answers a real product problem—warning signs distributed across sessions look benign one chat at a time—without folding safety context into the general memory that shapes everyday replies.

The numbers are strong where the feature is aimed

OpenAI reports internal evaluations built to emulate high-risk conversations where danger clarifies over time. In long single-conversation tests, safe-response performance rose 50% for suicide and self-harm and 16% for harm-to-others. On GPT-5.5 Instant, the current default model, the gains were 52% for harm-to-others and 39% for suicide and self-harm. Across more than 4,000 evaluations of the summaries themselves, they scored 4.93 out of 5 for safety relevance and 4.34 out of 5 for factuality.

Two caveats sit inside the framing. These are internal evaluations against scenarios OpenAI designed, and the percentages are relative improvements, not absolute safe-response rates—so a large gain does not tell us how often the model was already safe. The factuality score of 4.34 also trails the relevance score, meaning summaries are more consistently on-topic than they are consistently accurate, which matters when a note is meant to alter how the model reads a later message.

OpenAI tested for the cost this adds to ordinary chats

A recurring risk with safety layers is that they leak caution into normal use—flattening tone, over-refusing, or injecting warnings where none are warranted. OpenAI addressed this directly by testing whether adding safety context degraded everyday conversations, and reports responses remained broadly comparable, with no meaningful user preference between replies produced with or without safety summaries.

Combined with expert input from psychiatrists and psychologists in OpenAI's Global Physicians Network—who helped set when summaries are created and how long context should be considered—the update reads as an attempt to raise sensitivity in rare cases without paying an everyday tax. Whether that holds outside internal benchmarks is the open question, but the evaluation was at least scoped to ask it.

The precedent: a scoped, expiring context store for high-stakes signals

The durable idea here is architectural. OpenAI has built a context mechanism that is defined by its constraints—a separate reasoning model, a limited retention window, and activation only under serious safety concerns—rather than by maximizing recall. That is the opposite of the general trend toward broader, longer-lived memory, and it exists specifically because unrestricted persistence would be the wrong tool for this problem.

OpenAI signals it may extend the same method to biology and cyber safety, with safeguards. If it does, the reusable template is not 'give the assistant more memory'—it is a tightly-bounded, purpose-built context channel that surfaces only when a defined risk class is triggered. For teams building conversational products, the takeaway is that safety-relevant state can be a distinct, expiring layer, kept apart from the personalization state that shapes ordinary interactions.