OpenAI gpt-oss-safeguard: open-weight policy-following safety model family
gpt-oss-safeguard is an open-weight policy-following safety model family from OpenAI. It is open source under the Apache-2.0 license and is offered as: Self-hosted, Library.
Trust and safety teams that want to run an open model against their own written policy, and can afford the extra compute and latency of a reasoning model
Teams whose rules change often, such as a new spam or teen safety policy, and who want to edit a policy document instead of retraining a classifier
Consider instead if
You need a small model with a fixed taxonomy, or token-level checks while a reply streams, more than a policy you write yourself.
See Qwen3Guard.
You want a ready-made harm taxonomy that also checks groundedness and function calls.
See Granite Guardian.
What gpt-oss-safeguard does
gpt-oss-safeguard is OpenAI's pair of open-weight reasoning models, 20B and 120B, trained to read a safety policy you wrote, decide whether a piece of content breaks it and show the reasoning. The categories come from your policy text, which is the main difference from qwen3guard and granite-guardian. OpenAI's technical report names the costs. Classifiers trained on tens of thousands of labeled examples can still beat it, and it is slow and compute heavy, so OpenAI puts smaller classifiers in front or runs it asynchronously. In the same report's chat tests, both sizes resisted prompt injection hijacking less well than base gpt-oss, so feed it hostile content in a test before relying on it. It needs the harmony format; the weights are Apache-2.0.
This summary is our own wording of the sourced facts on this page.
Key facts
Each value links to the page that states it, with the date we checked it.
Where gpt-oss-safeguard fits in our AI security layers
Our analysis
Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document.
How the model works.
AI security layers that gpt-oss-safeguard covers, with the role, how each applies and what it rests on
Screen what goes into and comes out of a model in live traffic, and limit abuse of the model endpoint.
Follows its category, LLM firewalls & guardrails
OWASP LLM Top 10 mapping
Our analysis
The risk list is OWASP's (Top 10 for LLM Applications, 2025).
The mapping is our analysis, and each row rests on a capability the sources document.
No OWASP LLM risk is mapped to this tool in our analysis.
Not mapped in our analysis: LLM01, LLM02, LLM05, LLM07, LLM09, LLM10.
These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.
Routes LLM traffic through Kong with prompt guards, PII sanitization, spend limits and observability.
Best for: Teams that already run Kong as an API gateway and want LLM routing and prompt controls on the same data plane
65Coverage Score 65 out of 100
LLM01 Prompt Injection
LLM02 Sensitive Information Disclosure
LLM10 Unbounded Consumption
Reviewed
gpt-oss-safeguard FAQ
Is gpt-oss-safeguard open source?
The model card says Apache 2.0, and the weights are on Hugging Face. The code and example policies are in the openai/gpt-oss-safeguard repository.
How do I define what counts as unsafe?
You write your own policy and send it with the content to classify. The cookbook guide suggests about 400 to 600 tokens, and you can ask for a plain 0 or 1, or JSON with the rule IDs and a short rationale.
What are its limits?
OpenAI's technical report says classifiers trained on tens of thousands of labeled examples can still classify better, and that the models are time and compute intensive, so OpenAI uses smaller classifiers first or runs its own version asynchronously. The models only work correctly with the harmony response format.
How accurate is it?
In OpenAI's report the 120B model reaches 46.3% multi-policy accuracy and 82.9% F1 on OpenAI's 2022 moderation set. These are OpenAI's own figures on its policies, so they do not compare directly with Qwen3Guard's numbers on the same public sets.
Key facts you can cite
gpt-oss-safeguard is released under the Apache-2.0 license.
Last reviewed . We compile from the vendors' own public
pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.
We may use analytics and, later, show ads. They stay off until you choose, wherever you are. Declining
never limits what you can read. See our privacy policy and
cookie policy.
Privacy settings
Choose what you allow. Your choice is stored on this device for 13 months. You can change it later from the
"Privacy choices" link in the footer.