The GPT-5.3-Codex system card is OpenAI's deployment-safety document for GPT-5.3-Codex, published on OpenAI's deployment safety page in February 2026. GPT-5.3-Codex is described as OpenAI's most capable agentic coding model at the time of its release, combining GPT-5.2-Codex's coding performance with GPT-5.2's reasoning and professional knowledge. The card records two points OpenAI describes as firsts: it is the first model OpenAI designated High capability in Cybersecurity under the Preparedness Framework, and OpenAI states the model was instrumental in creating itself, which it frames as a recursive self-improvement milestone.
Capability designations
Under the Preparedness Framework, the card assigns the following capability designations:
| Category | Designation | Notes |
|---|---|---|
| Biology/Chemical | High | Same safeguards as other GPT-5 series models |
| Cybersecurity | High | First such designation by OpenAI; precautionary (no definitive evidence of threshold breach, but cannot rule it out) |
| AI Self-Improvement | Not High | Does not reach the threshold for this category |
OpenAI applied a precautionary approach to the Cybersecurity designation. It states it lacks "definitive evidence" the model crosses the High threshold but is designating it High because it "cannot rule out the possibility," rather than waiting for a confirmed breach.
Cybersecurity safeguards
For the High Cybersecurity designation, OpenAI describes a mitigation approach it calls a "layered safety stack," designed to impede threat actors while keeping capabilities available for defenders. Its components include:
- Sandboxed execution environments: isolated containers (cloud) and Seatbelt/seccomp/landlock policies (local).
- Default network access disabled, which OpenAI states reduces prompt injection and data exfiltration risk.
- File edits restricted to the current workspace.
- The ability for users to expand network access to specific domains with explicit consent.
Agentic safety
The card identifies destructive actions (such as rm -rf, git reset --hard, and push --force) as a safety challenge for coding agents. OpenAI states GPT-5.3-Codex was trained with a "user model" that made conflicting edits during rollouts, with the model receiving positive reinforcement for preserving user changes. The destructive-action-avoidance score improved to 0.88, compared with 0.66 for the original GPT-5-Codex, which OpenAI describes as a 33% relative improvement.
Production benchmark performance
In conversational safety evaluations, the card reports GPT-5.3-Codex performing on par with GPT-5.2-Thinking, scoring 0.986 on illicit violent activities (against a 0.979 baseline) and 1.000 on biological weapons (the same as baseline). The card reports regression in conversational mode on hate (0.936 versus 0.979) and extremism (0.978 versus 1.000); OpenAI notes that conversational evaluations are not representative of real-world risk for a coding-focused model.
Recursive self-improvement
The card states that GPT-5.3-Codex was instrumental in creating itself, meaning OpenAI used earlier Codex models as part of the development process for the model. OpenAI characterizes this as the first confirmed public case of a deployed AI model being materially used to build the next generation of itself.
Relationships
- instance-of: Recursive Self-Improvement (RSI) — described by OpenAI as the first confirmed deployment case of a model instrumental in building its successor.
- related: GPT-5.3 Codex model page — the model page synthesizes this data with broader competitive context.
- related: OpenAI Preparedness Framework V.2 — the High Cybersecurity designation activates safeguards specified in the Preparedness Framework.
- related: Managing Advanced Cyber Risks — Frontier Model Forum framework addressing the type of High Cybersecurity risk this designation triggers.
- related: Claude Mythos System Card — both labs classified their top models as High Cybersecurity in early 2026.
- related: AI Benchmarks and Evaluation — Production Benchmarks methodology; precautionary versus confirmed threshold approach.
Provenance
OpenAI deployment safety page, February 2026 (Source: Raw Sources/GPT-5.3-Codex System Card.md).