I don't get it, is this the gimped or non-gimped version of GPT?

They have different versions: internal research versions, one with restricted access access for cyber stuff, and the public version, right?

If it's the one with safety off (e.g. like the ones that kept breaking out of containment this year), then it shouldn't be refusing anything, right? And if it's the one with safety on, then how can they expect to use it for safety research? What am I missing here?