The GPT-5.3-Codex system card is OpenAI's deployment-safety document for GPT-5.3-Codex, published on OpenAI's deployment safety page in February 2026. GPT-5.3-Codex is described as OpenAI's most capable agentic coding model at the time of its release, combining GPT-5.2-Codex's coding performance with GPT-5.2's reasoning and professional knowledge. The card records two points OpenAI describes as firsts: it is the first model OpenAI designated High capability in Cybersecurity under the Preparedness Framework, and OpenAI states the model was instrumental in creating itself, which it frames as a recursive self-improvement milestone.
Capability designations
Under the Preparedness Framework, the card assigns the following capability designations:
| Category | Designation | Notes |
|---|---|---|
| Biology/Chemical | High | Same safeguards as other GPT-5 series models |
| Cybersecurity | High | First such designation by OpenAI; precautionary (no definitive evidence of threshold breach, but cannot rule it out) |
| AI Self-Improvement | Not High | Does not reach the threshold for this category |
OpenAI applied a precautionary approach to the Cybersecurity designation. It states it lacks "definitive evidence" the model crosses the High threshold but is designating it High because it "cannot rule out the possibility," rather than waiting for a confirmed breach.
Cybersecurity safeguards
For the High Cybersecurity designation, OpenAI describes a mitigation approach it calls a "layered safety stack," designed to impede threat actors while keeping capabilities available for defenders. Its components include:
- Sandboxed execution environments: isolated containers (cloud) and Seatbelt/seccomp/landlock policies (local).
- Default network access disabled, which OpenAI states reduces prompt injection and data exfiltration risk.
- File edits restricted to the current workspace.
- The ability for users to expand network access to specific domains with explicit consent.
Agentic safety
The card identifies destructive actions (such as rm -rf, git reset --hard, and push --force) as a safety challenge for coding agents. OpenAI states GPT-5.3-Codex was trained with a "user model" that made conflicting edits during rollouts, with the model receiving positive reinforcement for preserving user changes. Table 2 gives the destructive-action-avoidance score as 0.88, against 0.66 for GPT-5-Codex, 0.70 for GPT-5.1-Codex, 0.75 for GPT-5.1-Codex-Max and 0.76 for GPT-5.2-Codex; the card states no relative-improvement figure.
Production benchmark performance
In conversational safety evaluations, the card reports GPT-5.3-Codex performing on par with GPT-5.2-Thinking, scoring 0.986 on illicit violent activities (against a 0.979 baseline) and 1.000 on biological weapons (the same as baseline). The card reports regression in conversational mode on hate (0.936 versus 0.979) and extremism (0.978 versus 1.000); OpenAI notes that conversational evaluations are not representative of real-world risk for a coding-focused model.
Recursive self-improvement
The card states that GPT-5.3-Codex was instrumental in creating itself, meaning OpenAI used earlier Codex models as part of the development process for the model. OpenAI characterizes this as the first confirmed public case of a deployed AI model being materially used to build the next generation of itself.
Reported results
Evaluation results the document states for which there is no separate benchmark page; results on benchmarks that have a page are recorded there and cite this page. Scores and settings are as printed in the document.
| Evaluation | Model | Score | Setting | Section |
|---|---|---|---|---|
| Production Benchmarks (disallowed content, conversational setting) — illicit violent activities | GPT-5.2 Thinking | 0.979 | not_unsafe (higher is better); deliberately difficult production-derived conversational prompts; baseline is "the latest GPT-5.2-Thinking"; OpenAI says the model is not intended for conversational use; reported by OpenAI in the GPT-5.3-Codex system card | Baseline Model Safety Evaluations: Disallowed Content (Table 1) |
| Production Benchmarks (disallowed content, conversational setting) — illicit violent activities | GPT-5.3-Codex | 0.986 | not_unsafe (higher is better); deliberately difficult production-derived conversational prompts; baseline is "the latest GPT-5.2-Thinking"; OpenAI says the model is not intended for conversational use; developer-reported | Baseline Model Safety Evaluations: Disallowed Content (Table 1) |
| Production Benchmarks (disallowed content, conversational setting) — illicit non-violent harmful activities | GPT-5.2 Thinking | 0.923 | not_unsafe (higher is better); deliberately difficult production-derived conversational prompts; baseline is "the latest GPT-5.2-Thinking"; OpenAI says the model is not intended for conversational use; reported by OpenAI in the GPT-5.3-Codex system card | Baseline Model Safety Evaluations: Disallowed Content (Table 1) |
| Production Benchmarks (disallowed content, conversational setting) — illicit non-violent harmful activities | GPT-5.3-Codex | 0.928 | not_unsafe (higher is better); deliberately difficult production-derived conversational prompts; baseline is "the latest GPT-5.2-Thinking"; OpenAI says the model is not intended for conversational use; developer-reported | Baseline Model Safety Evaluations: Disallowed Content (Table 1) |
| Production Benchmarks (disallowed content, conversational setting) — self-harm | GPT-5.2 Thinking | 0.953 | not_unsafe (higher is better); deliberately difficult production-derived conversational prompts; baseline is "the latest GPT-5.2-Thinking"; OpenAI says the model is not intended for conversational use; reported by OpenAI in the GPT-5.3-Codex system card | Baseline Model Safety Evaluations: Disallowed Content (Table 1) |
| Production Benchmarks (disallowed content, conversational setting) — self-harm | GPT-5.3-Codex | 0.959 | not_unsafe (higher is better); deliberately difficult production-derived conversational prompts; baseline is "the latest GPT-5.2-Thinking"; OpenAI says the model is not intended for conversational use; developer-reported | Baseline Model Safety Evaluations: Disallowed Content (Table 1) |
| Production Benchmarks (disallowed content, conversational setting) — biological weapons | GPT-5.2 Thinking | 1.000 | not_unsafe (higher is better); deliberately difficult production-derived conversational prompts; baseline is "the latest GPT-5.2-Thinking"; OpenAI says the model is not intended for conversational use; reported by OpenAI in the GPT-5.3-Codex system card | Baseline Model Safety Evaluations: Disallowed Content (Table 1) |
| Production Benchmarks (disallowed content, conversational setting) — biological weapons | GPT-5.3-Codex | 1.000 | not_unsafe (higher is better); deliberately difficult production-derived conversational prompts; baseline is "the latest GPT-5.2-Thinking"; OpenAI says the model is not intended for conversational use; developer-reported | Baseline Model Safety Evaluations: Disallowed Content (Table 1) |
| Production Benchmarks (disallowed content, conversational setting) — chemical weapons | GPT-5.2 Thinking | 0.857 | not_unsafe (higher is better); deliberately difficult production-derived conversational prompts; baseline is "the latest GPT-5.2-Thinking"; OpenAI says the model is not intended for conversational use; reported by OpenAI in the GPT-5.3-Codex system card | Baseline Model Safety Evaluations: Disallowed Content (Table 1) |
| Production Benchmarks (disallowed content, conversational setting) — chemical weapons | GPT-5.3-Codex | 0.864 | not_unsafe (higher is better); deliberately difficult production-derived conversational prompts; baseline is "the latest GPT-5.2-Thinking"; OpenAI says the model is not intended for conversational use; developer-reported | Baseline Model Safety Evaluations: Disallowed Content (Table 1) |
| Production Benchmarks (disallowed content, conversational setting) — sexual/minors | GPT-5.2 Thinking | 0.991 | not_unsafe (higher is better); deliberately difficult production-derived conversational prompts; baseline is "the latest GPT-5.2-Thinking"; OpenAI says the model is not intended for conversational use; reported by OpenAI in the GPT-5.3-Codex system card | Baseline Model Safety Evaluations: Disallowed Content (Table 1) |
| Production Benchmarks (disallowed content, conversational setting) — sexual/minors | GPT-5.3-Codex | 0.991 | not_unsafe (higher is better); deliberately difficult production-derived conversational prompts; baseline is "the latest GPT-5.2-Thinking"; OpenAI says the model is not intended for conversational use; developer-reported | Baseline Model Safety Evaluations: Disallowed Content (Table 1) |
| Production Benchmarks (disallowed content, conversational setting) — sexual/exploitative | GPT-5.2 Thinking | 0.965 | not_unsafe (higher is better); deliberately difficult production-derived conversational prompts; baseline is "the latest GPT-5.2-Thinking"; OpenAI says the model is not intended for conversational use; reported by OpenAI in the GPT-5.3-Codex system card | Baseline Model Safety Evaluations: Disallowed Content (Table 1) |
| Production Benchmarks (disallowed content, conversational setting) — sexual/exploitative | GPT-5.3-Codex | 0.966 | not_unsafe (higher is better); deliberately difficult production-derived conversational prompts; baseline is "the latest GPT-5.2-Thinking"; OpenAI says the model is not intended for conversational use; developer-reported | Baseline Model Safety Evaluations: Disallowed Content (Table 1) |
| Production Benchmarks (disallowed content, conversational setting) — abuse | GPT-5.2 Thinking | 0.810 | not_unsafe (higher is better); deliberately difficult production-derived conversational prompts; baseline is "the latest GPT-5.2-Thinking"; OpenAI says the model is not intended for conversational use; reported by OpenAI in the GPT-5.3-Codex system card | Baseline Model Safety Evaluations: Disallowed Content (Table 1) |
| Production Benchmarks (disallowed content, conversational setting) — abuse | GPT-5.3-Codex | 0.770 | not_unsafe (higher is better); deliberately difficult production-derived conversational prompts; baseline is "the latest GPT-5.2-Thinking"; OpenAI says the model is not intended for conversational use; developer-reported | Baseline Model Safety Evaluations: Disallowed Content (Table 1) |
| Production Benchmarks (disallowed content, conversational setting) — extremism | GPT-5.2 Thinking | 1.000 | not_unsafe (higher is better); deliberately difficult production-derived conversational prompts; baseline is "the latest GPT-5.2-Thinking"; OpenAI says the model is not intended for conversational use; reported by OpenAI in the GPT-5.3-Codex system card | Baseline Model Safety Evaluations: Disallowed Content (Table 1) |
| Production Benchmarks (disallowed content, conversational setting) — extremism | GPT-5.3-Codex | 0.978 | not_unsafe (higher is better); deliberately difficult production-derived conversational prompts; baseline is "the latest GPT-5.2-Thinking"; OpenAI says the model is not intended for conversational use; developer-reported | Baseline Model Safety Evaluations: Disallowed Content (Table 1) |
| Production Benchmarks (disallowed content, conversational setting) — hate | GPT-5.2 Thinking | 0.979 | not_unsafe (higher is better); deliberately difficult production-derived conversational prompts; baseline is "the latest GPT-5.2-Thinking"; OpenAI says the model is not intended for conversational use; reported by OpenAI in the GPT-5.3-Codex system card | Baseline Model Safety Evaluations: Disallowed Content (Table 1) |
| Production Benchmarks (disallowed content, conversational setting) — hate | GPT-5.3-Codex | 0.936 | not_unsafe (higher is better); deliberately difficult production-derived conversational prompts; baseline is "the latest GPT-5.2-Thinking"; OpenAI says the model is not intended for conversational use; developer-reported | Baseline Model Safety Evaluations: Disallowed Content (Table 1) |
| Production Benchmarks (disallowed content, conversational setting) — violence | GPT-5.2 Thinking | 0.909 | not_unsafe (higher is better); deliberately difficult production-derived conversational prompts; baseline is "the latest GPT-5.2-Thinking"; OpenAI says the model is not intended for conversational use; reported by OpenAI in the GPT-5.3-Codex system card | Baseline Model Safety Evaluations: Disallowed Content (Table 1) |
| Production Benchmarks (disallowed content, conversational setting) — violence | GPT-5.3-Codex | 0.873 | not_unsafe (higher is better); deliberately difficult production-derived conversational prompts; baseline is "the latest GPT-5.2-Thinking"; OpenAI says the model is not intended for conversational use; developer-reported | Baseline Model Safety Evaluations: Disallowed Content (Table 1) |
| Destructive actions evaluation — Destructive action avoidance | GPT-5-Codex | 0.66 | new evaluation of preserving user-produced changes and avoiding destructive actions; higher is better; reported by OpenAI in the GPT-5.3-Codex system card | Avoid data-destructive actions (Table 2) |
| Destructive actions evaluation — Destructive action avoidance | GPT-5.1-Codex | 0.70 | new evaluation of preserving user-produced changes and avoiding destructive actions; higher is better; reported by OpenAI in the GPT-5.3-Codex system card | Avoid data-destructive actions (Table 2) |
| Destructive actions evaluation — Destructive action avoidance | GPT-5.1-Codex-Max | 0.75 | new evaluation of preserving user-produced changes and avoiding destructive actions; higher is better; reported by OpenAI in the GPT-5.3-Codex system card | Avoid data-destructive actions (Table 2) |
| Destructive actions evaluation — Destructive action avoidance | GPT-5.2-Codex | 0.76 | new evaluation of preserving user-produced changes and avoiding destructive actions; higher is better; reported by OpenAI in the GPT-5.3-Codex system card | Avoid data-destructive actions (Table 2) |
| Destructive actions evaluation — Destructive action avoidance | GPT-5.3-Codex | 0.88 | new evaluation of preserving user-produced changes and avoiding destructive actions; higher is better; developer-reported | Avoid data-destructive actions (Table 2) |
| Tacit Knowledge and Troubleshooting — refusal or safe-completion rate | GPT-5.1-Codex | 6% | share of questions answered with a refusal or safe completion (not an accuracy score); accuracy is figure-only; reported by OpenAI in the GPT-5.3-Codex system card | Preparedness: Biological and Chemical (Figure 1 text) |
| Tacit Knowledge and Troubleshooting — refusal or safe-completion rate | GPT-5.2 Thinking | 30% | share of questions answered with a refusal or safe completion (not an accuracy score); accuracy is figure-only; reported by OpenAI in the GPT-5.3-Codex system card | Preparedness: Biological and Chemical (Figure 1 text) |
| Tacit Knowledge and Troubleshooting — refusal or safe-completion rate | GPT-5.2-Codex | 0.1% | share of questions answered with a refusal or safe completion (not an accuracy score); accuracy is figure-only; reported by OpenAI in the GPT-5.3-Codex system card | Preparedness: Biological and Chemical (Figure 1 text) |
| Tacit Knowledge and Troubleshooting — refusal or safe-completion rate | GPT-5.3-Codex | 8.3% | share of questions answered with a refusal or safe completion (not an accuracy score); accuracy is figure-only; developer-reported | Preparedness: Biological and Chemical (Figure 1 text) |
| TroubleshootingBench | Human baseline (80th percentile of 12 PhD experts) | 36.4% | indicative threshold; 52 expert-written protocols, three short-answer questions each; stated by OpenAI | Preparedness: Biological and Chemical (Figure 4 text) |
| CVE-Bench — v1.0, zero-day configuration | GPT-5.3-Codex | 90% | pass@1 over 3 rollouts; 34 of 40 challenges; no source-code access; developer-reported | Preparedness: Cybersecurity — CVE-Bench |
| CVE-Bench — v1.0, zero-day configuration | GPT-5.2-Codex | 87% | pass@1 over 3 rollouts; 34 of 40 challenges; no source-code access; reported by OpenAI in the GPT-5.3-Codex system card | Preparedness: Cybersecurity — CVE-Bench |
| Cyber range — Combined pass rate | GPT-5.1-Codex-Max | 60% | percentage of 15 scenarios passed (four new in this card); a scenario passes if at least one of 16 trials succeeds; reported by OpenAI in the GPT-5.3-Codex system card | Preparedness: Cybersecurity — Cyber Range (Table 5) |
| Cyber range — Combined pass rate | GPT-5.2 Thinking | 47% | percentage of 15 scenarios passed (four new in this card); a scenario passes if at least one of 16 trials succeeds; carries a footnote whose text is lost in the capture; the GPT-5.4 Thinking card explains the same 47% as a lower bound assuming failure on the newest scenarios, which were not run; reported by OpenAI in the GPT-5.3-Codex system card | Preparedness: Cybersecurity — Cyber Range (Table 5) |
| Cyber range — Combined pass rate | GPT-5.2-Codex | 53.33% | percentage of 15 scenarios passed (four new in this card); a scenario passes if at least one of 16 trials succeeds; reported by OpenAI in the GPT-5.3-Codex system card | Preparedness: Cybersecurity — Cyber Range (Table 5) |
| Cyber range — Combined pass rate | GPT-5.3-Codex | 80% | percentage of 15 scenarios passed (four new in this card); a scenario passes if at least one of 16 trials succeeds; developer-reported | Preparedness: Cybersecurity — Cyber Range (Table 5) |
| Irregular atomic challenge suite — Network Attack Simulation | GPT-5.3-Codex | 86% | average success rate; measured by Irregular on a near-final checkpoint; Codex CLI, xhigh reasoning effort, web search enabled, up to 1,000 turns, compaction every 100K tokens; reported in the GPT-5.3-Codex system card | Preparedness: Cybersecurity — External evaluations (Irregular) |
| Irregular atomic challenge suite — Network Attack Simulation | GPT-5.2-Codex | 68% | average success rate; re-run by Irregular with the Irregular Agent harness for comparison; reported in the GPT-5.3-Codex system card | Preparedness: Cybersecurity — External evaluations (Irregular) |
| Irregular atomic challenge suite — Network Attack Simulation | GPT-5.2 Thinking | 100% | average success rate; re-run by Irregular with the Irregular Agent harness for comparison; reported in the GPT-5.3-Codex system card | Preparedness: Cybersecurity — External evaluations (Irregular) |
| Irregular atomic challenge suite — Vulnerability Research and Exploitation | GPT-5.3-Codex | 72% | average success rate; measured by Irregular on a near-final checkpoint; Codex CLI, xhigh reasoning effort, web search enabled, up to 1,000 turns, compaction every 100K tokens; reported in the GPT-5.3-Codex system card | Preparedness: Cybersecurity — External evaluations (Irregular) |
| Irregular atomic challenge suite — Vulnerability Research and Exploitation | GPT-5.2-Codex | 75% | average success rate; re-run by Irregular with the Irregular Agent harness for comparison; reported in the GPT-5.3-Codex system card | Preparedness: Cybersecurity — External evaluations (Irregular) |
| Irregular atomic challenge suite — Vulnerability Research and Exploitation | GPT-5.2 Thinking | 80% | average success rate; re-run by Irregular with the Irregular Agent harness for comparison; reported in the GPT-5.3-Codex system card | Preparedness: Cybersecurity — External evaluations (Irregular) |
| Irregular atomic challenge suite — Evasion | GPT-5.3-Codex | 53% | average success rate; measured by Irregular on a near-final checkpoint; Codex CLI, xhigh reasoning effort, web search enabled, up to 1,000 turns, compaction every 100K tokens; reported in the GPT-5.3-Codex system card | Preparedness: Cybersecurity — External evaluations (Irregular) |
| Irregular atomic challenge suite — Evasion | GPT-5.2-Codex | 52% | average success rate; re-run by Irregular with the Irregular Agent harness for comparison; reported in the GPT-5.3-Codex system card | Preparedness: Cybersecurity — External evaluations (Irregular) |
| Irregular atomic challenge suite — Evasion | GPT-5.2 Thinking | 53% | average success rate; re-run by Irregular with the Irregular Agent harness for comparison; reported in the GPT-5.3-Codex system card | Preparedness: Cybersecurity — External evaluations (Irregular) |
| CyScenarioBench (Irregular) — challenges solved | GPT-5.3-Codex | 0 | card: "did not solve any challenges from CyScenarioBench"; measured by Irregular on a near-final checkpoint; Codex CLI, xhigh reasoning effort, web search enabled, up to 1,000 turns, compaction every 100K tokens; reported in the GPT-5.3-Codex system card | Preparedness: Cybersecurity — External evaluations (Irregular) |
| Apollo Research: sabotage suite — mean best-of-10 | GPT-5.3-Codex | 0.88 | max 1.00; short-horizon ML engineering sabotage tasks in a sandbox; measured by Apollo Research on a near-final checkpoint, reported in the GPT-5.3-Codex system card | Research Category Update: Sandbagging (Apollo Research) |
| Apollo Research: sabotage suite — mean best-of-10 | GPT-5.2 | 0.75 | max 1.00; measured by Apollo Research on a near-final checkpoint, reported in the GPT-5.3-Codex system card | Research Category Update: Sandbagging (Apollo Research) |
| Apollo Research: sabotage suite — mean best-of-10 | GPT-5.2-Codex | 0.66 | max 1.00; card writes "GPT-5.2 Codex"; measured by Apollo Research on a near-final checkpoint, reported in the GPT-5.3-Codex system card | Research Category Update: Sandbagging (Apollo Research) |
| Apollo Research: non-Latin-script reasoning tokens — share of reasoning tokens | GPT-5.3-Codex | 0.55% | measured by Apollo Research on a near-final checkpoint, reported in the GPT-5.3-Codex system card | Research Category Update: Sandbagging (Apollo Research) |
| Apollo Research: non-Latin-script reasoning tokens — share of reasoning tokens | GPT-5 | 0.016% | measured by Apollo Research on a near-final checkpoint, reported in the GPT-5.3-Codex system card | Research Category Update: Sandbagging (Apollo Research) |
| Apollo Research: non-Latin-script reasoning tokens — share of reasoning tokens | GPT-5.2 Robin Alpha | 0.012% | checkpoint name as printed in the card; measured by Apollo Research on a near-final checkpoint, reported in the GPT-5.3-Codex system card | Research Category Update: Sandbagging (Apollo Research) |
| Cyber safety training: policy compliance rate — Production data | GPT-5.1 Thinking | 0.866 | policy compliance rate (higher is better); challenging cyber chat and agentic cases; reported by OpenAI in the GPT-5.3-Codex system card | Cyber Safeguards: Model safety training (Table 7) |
| Cyber safety training: policy compliance rate — Production data | GPT-5.2 Thinking | 0.966 | policy compliance rate (higher is better); challenging cyber chat and agentic cases; reported by OpenAI in the GPT-5.3-Codex system card | Cyber Safeguards: Model safety training (Table 7) |
| Cyber safety training: policy compliance rate — Production data | GPT-5.2-Codex | 0.921 | policy compliance rate (higher is better); challenging cyber chat and agentic cases; reported by OpenAI in the GPT-5.3-Codex system card | Cyber Safeguards: Model safety training (Table 7) |
| Cyber safety training: policy compliance rate — Production data | GPT-5.3-Codex | 0.940 | policy compliance rate (higher is better); challenging cyber chat and agentic cases; developer-reported | Cyber Safeguards: Model safety training (Table 7) |
| Cyber safety training: policy compliance rate — Synthetic data | GPT-5.1 Thinking | 0.930 | policy compliance rate (higher is better); challenging cyber chat and agentic cases; reported by OpenAI in the GPT-5.3-Codex system card | Cyber Safeguards: Model safety training (Table 7) |
| Cyber safety training: policy compliance rate — Synthetic data | GPT-5.2 Thinking | 0.993 | policy compliance rate (higher is better); challenging cyber chat and agentic cases; reported by OpenAI in the GPT-5.3-Codex system card | Cyber Safeguards: Model safety training (Table 7) |
| Cyber safety training: policy compliance rate — Synthetic data | GPT-5.2-Codex | 0.939 | policy compliance rate (higher is better); challenging cyber chat and agentic cases; reported by OpenAI in the GPT-5.3-Codex system card | Cyber Safeguards: Model safety training (Table 7) |
| Cyber safety training: policy compliance rate — Synthetic data | GPT-5.3-Codex | 0.996 | policy compliance rate (higher is better); challenging cyber chat and agentic cases; developer-reported | Cyber Safeguards: Model safety training (Table 7) |
| System mitigations and classification performance — Cybersecurity topical classifier — recall | Cybersecurity topical classifier (safeguard system) | >90% | threshold set for minimum 0.90 recall of cybersecurity-related content on production-representative traffic with synthetic labels; system reliability >99.9%; reported by OpenAI in the GPT-5.3-Codex system card | Cyber Safeguards: Conversation monitor (Table 8) |
| System mitigations and classification performance — reasoning monitor, user prompts — recall | Cybersecurity reasoning monitor (safeguard system, not a subject model) | 77.8% | challenging prompts, expert-labelled; distinguishes harmful action and high-risk dual-use content from other content; reported by OpenAI in the GPT-5.3-Codex system card | Cyber Safeguards: Conversation monitor (Table 8) |
| System mitigations and classification performance — reasoning monitor, user prompts — precision | Cybersecurity reasoning monitor (safeguard system, not a subject model) | 37.1% | challenging prompts, expert-labelled; reported by OpenAI in the GPT-5.3-Codex system card | Cyber Safeguards: Conversation monitor (Table 8) |
| System mitigations and classification performance — reasoning monitor, second row (label missing in capture; presumably assistant generations) — recall | Cybersecurity reasoning monitor (safeguard system, not a subject model) | 88.8% | challenging prompts, expert-labelled; reported by OpenAI in the GPT-5.3-Codex system card | Cyber Safeguards: Conversation monitor (Table 8) |
| System mitigations and classification performance — reasoning monitor, second row (label missing in capture; presumably assistant generations) — precision | Cybersecurity reasoning monitor (safeguard system, not a subject model) | 24.1% | challenging prompts, expert-labelled; reported by OpenAI in the GPT-5.3-Codex system card | Cyber Safeguards: Conversation monitor (Table 8) |
| UK AISI safeguard red-teaming: universal jailbreak — pass@200 | GPT-5.3-Codex | 0.778 | single-user-message universal jailbreak (with retries) developed in about 10 hours of manual red-teaming, against a model with the Safety Reasoner integrated and blocking; on a policy-violating cyber dataset supplied by OpenAI; measured by UK AISI, reported in the GPT-5.3-Codex system card | Cyber Safeguards: External government red teaming |
Discrepancies noted
The second row label of Table 8 is lost in the vault's capture of the card, and the prose describing the Leaked Token scenario does not match the table's figures for it.
Relationships
- instance-of: Recursive Self-Improvement (RSI) — described by OpenAI as the first confirmed deployment case of a model instrumental in building its successor.
- related: GPT-5.3 Codex model page — the model page synthesizes this data with broader competitive context.
- related: OpenAI Preparedness Framework V.2 — the High Cybersecurity designation activates safeguards specified in the Preparedness Framework.
- related: Managing Advanced Cyber Risks — Frontier Model Forum framework addressing the type of High Cybersecurity risk this designation triggers.
- related: Claude Mythos System Card — both labs classified their top models as High Cybersecurity in early 2026.
- related: AI Benchmarks and Evaluation — Production Benchmarks methodology; precautionary versus confirmed threshold approach.
Provenance
OpenAI deployment safety page, February 2026 (Source: Raw Sources/GPT-5.3-Codex System Card.md).