Sora spent months with red teamers before its public release

A preview, then months of testing, then a product

OpenAI first showed Sora publicly in a technical report posted 15 February 2024, describing a diffusion transformer trained on 'spacetime patches' of video and image data that could generate up to a minute of video, and calling the result a step toward 'general purpose simulators of the physical world'. The model reached general release as a standalone product on 9 December 2024, alongside a product announcement and a separate system card. In between, the system card states an early-access artist programme ran for about nine months, gathering feedback across more than 500,000 requests from over 300 users in more than 60 countries, before a formal external red-teaming effort with testers in nine countries reviewed more than 15,000 generations between September and December 2024.

What was measured, and what changed for release

The February report is explicit that it covers 'qualitative evaluation of Sora's capabilities and limitations' rather than full model or implementation detail. The system card supplies some of the missing quantitative detail: for one specific risk category, deceptive election-related content, it reports a classifier reaching 98.23 percent recall and 88.80 percent precision at blocking generation, evaluated on roughly 500 synthetic test prompts rather than on organically generated attempts. The released Sora Turbo model is described as faster than the February preview but still limited, with the launch post stating it 'often generates unrealistic physics and struggles with complex actions over long durations'.

What the provenance stack does and does not settle

The system card describes a layered provenance approach for release: C2PA metadata attached to every generated asset, a visible animated watermark shown by default, and an internal reverse-video-search tool for investigators, while noting that paying users can remove the visible watermark but the underlying C2PA metadata remains. A signed manifest of this kind records what a tool asserts about a file, not an independent guarantee that the metadata survives every re-export or platform re-encode, and the system card itself frames provenance as one layer among several rather than a complete solution, stating there is 'not a single solution to provenance'.

Questions to carry into your own evaluation

• Is a capability claim drawn from the February research report, which explicitly excludes implementation detail, or from the December system card's evaluations?
• Does a safety metric such as the election-content classifier's precision and recall come from synthetic test prompts or from real adversarial attempts?
• Has C2PA metadata survived the specific platform or re-export path the video in question actually travelled through?

Sora's public record separates a research claim about scaling video generation from a later, narrower set of measured safety evaluations tied to a specific release. Treating the February world-simulator framing as a capability guarantee, or the provenance stack as tamper-proof, both overstate what the primary documents say.