GPT-5.4 Thinking System Card

The GPT-5.4 Thinking System Card is the deployment-safety document OpenAI published on March 5, 2026 for GPT-5.4 Thinking, the latest reasoning model in the GPT-5 series at the time of release (Source: deploymentsafety.openai.com). The card describes GPT-5.4 Thinking as the first general-purpose OpenAI model, as opposed to a coding-specialized one, to implement mitigations for "High" capability in Cybersecurity, building on the approach first used for GPT-5.3 Codex in ChatGPT and the API. It records OpenAI's determinations under the OpenAI Preparedness Framework: High capability in the Biological and Chemical category and in Cybersecurity, and below High in AI Self-Improvement. OpenAI later extended the card twice, adding an appendix on GPT-5.4 mini on March 17, 2026 and revising the chain-of-thought section on April 24, 2026.

Structure

The card has seven numbered sections: an introduction; model data and training; baseline model safety evaluations, covering disallowed content, prevalence on production-representative prompts, jailbreaks, prompt injection, vision, health, data-destructive actions, user confirmations during computer use and bias; chain-of-thought evaluations, covering monitorability and controllability; the Preparedness Framework section, covering capability assessments in the three tracked categories, a research-category update on sandbagging and the cyber safeguards; the GPT-5.4 mini appendix; and references. The card also calls the model gpt-5.4-thinking and, in places, "5.4-reasoning", "GPT-5.4-reasoning" and "gpt-5.4r".

Several results are shown only as figures whose values the text does not state: the deception evaluations, the jailbreak benchmark, the chain-of-thought monitorability and controllability plots, and the charts for each Preparedness capability evaluation. Numerical results for several of those capability evaluations appear instead in the appendix tables. The card states that comparison figures for previously launched models come from the latest versions of those models and may differ slightly from the values published at their launch (see AI Benchmarks and Evaluation).

Model data and training

The card states that, like OpenAI's other models, GPT-5.4 Thinking was trained on diverse datasets: information publicly available on the internet, information OpenAI accesses through third-party partnerships, and information that users, human trainers and researchers provide or generate. OpenAI describes filtering to maintain data quality, processes to reduce personal information in training data, and safety classifiers used to prevent or reduce harmful or sensitive content, including sexual content involving a minor.

OpenAI's reasoning models are trained with reinforcement learning to reason before answering, and can produce a long internal chain of thought before responding to the user. According to the card, through training the models "learn to refine their thinking process, try different strategies, and recognize their mistakes." OpenAI states that reasoning lets the models follow its guidelines and model policies, which it says makes them more helpful and better able to resist attempts to bypass safety rules. The card does not disclose the model's architecture, parameter count or training compute.

Baseline safety evaluations

Disallowed content with challenging prompts

OpenAI reports its Production Benchmarks, a set of conversations representative of challenging examples from production data, which it introduced because its earlier Standard evaluations had become relatively saturated. The sets were built around cases in which existing models did not yet respond ideally, so their error rates are not representative of average production traffic. The metric is not_unsafe, the share of outputs that are not disallowed under the relevant OpenAI policy. Across nine categories the card finds that GPT-5.4 Thinking "generally performs on par with gpt-5.2-thinking with statistically significant improvements on illicit non-violent activity and self-harm evals": 1.000 against 0.923 on nonviolent illicit behavior and 0.987 against 0.953 on self-harm. GPT-5.4 Thinking scored below GPT-5.2 Thinking in six categories, which the card does not discuss individually: violence (0.831 against 0.909), hate (0.943 against 0.979), sexual/minors (0.966 against 0.991), sexual (0.933 against 0.961), harassment (0.790 against 0.810) and violent illicit behavior (0.971 against 0.979). Both scored 1.000 on extremism.

Dynamic multi-turn evaluations

Ahead of the GPT-5.3 Instant launch, OpenAI implemented dynamic multi-turn evaluations for mental health, emotional reliance and self-harm. Realistic but adversarial user simulations let each conversation evolve in response to the model's outputs, which the card describes as a more rigorous test than earlier static multi-turn methods, able to surface problems that emerge only over long exchanges and useful in areas where earlier frameworks had saturated. Standard evaluations grade the final response; these grade every assistant message and report the share that do not violate policy. The card reports that GPT-5.4 Thinking outperformed GPT-5.1 Thinking and GPT-5.2 Thinking on all three: mental health 0.985 (GPT-5.2 Thinking 0.975), emotional reliance 0.985 (0.953) and self-harm 0.977 (0.955). See AI Mental Health and Psychological Harm.

Prevalence on production-representative prompts

As a pilot based on research it had published (Source: alignment.openai.com), OpenAI estimated rates of safety-relevant behavior on a production-like distribution. It took deidentified conversations broadly representative of recent GPT-5.2 Thinking production traffic, resampled the final assistant turn with GPT-5.4 Thinking, and automatically labeled the new completions. The card cautions that the estimates reflect one point in time, are affected by drift in production traffic and in OpenAI's processing and evaluation pipelines, and are limited by the difficulty of reconstructing production contexts; that OpenAI's earlier research nonetheless found the method could predict whether true rates would rise very significantly at the model level; and that the estimates measure the model alone, without other layers of the safety stack, so actual violation rates in production are expected to be lower.

The extrapolated not_unsafe prevalence exceeded 99.9% in all eleven categories for both models. OpenAI's example is harassment: based on the observed distribution of GPT-5.2 Thinking conversations, it estimates that 99.9534% of GPT-5.4 Thinking outputs would not violate its harassment policy even without other safety interventions. GPT-5.4 Thinking's estimates were lower than GPT-5.2 Thinking's for extremism (99.9991% against 100.0000%), violent wrongdoing and violence, and higher in the other eight categories.

OpenAI ran the same method for deceptive behaviors first discussed in the GPT-5 system card, adding "Requesting Unnecessary Confirmations" and "Uses Calculator Tool to Avoid Citations", two behaviors its earlier research had found in GPT-5.1 Thinking. The results are shown only in a figure. OpenAI states that it uses these evaluations mainly as a check for concerning regressions, that it would investigate further and update its assessment more cautiously if it saw more substantial deterioration in the most safety-relevant categories, and that at the observed values the estimates indicate the deployment is "unlikely to produce very significant increases in disallowed or misaligned behavior, especially in the most concerning categories."

Jailbreaks

Ahead of the GPT-5.4 launch, OpenAI replaced its previous StrongReject-based jailbreak benchmark with a more challenging multi-turn evaluation derived from red-teaming exercises, in which attacker strategies probe, adapt and escalate over the course of a conversation. Non-compliant responses score worse and compliant responses better, and the reported aggregate is the worst-case defender success rate. In a figure without stated values, the card reports that GPT-5.2 Thinking and GPT-5.4 Thinking "substantially outperform" GPT-5.1 Thinking, with a large improvement from 5.1 to 5.2 and a smaller further improvement from 5.2 to 5.4. See Jailbreaking and Red Teaming.

Prompt injection

Two evaluations measure robustness to known prompt-injection attacks that embed adversarial instructions in tool output, one against connectors and one against function calls. Both are splits of the data used for training, so, the card notes, they do not represent a model's ability to generalize to new attacks. GPT-5.4 Thinking scored 0.998 on connector attacks (GPT-5.2 Thinking 0.979; GPT-5.1 Thinking 0.781) and 0.978 on function-call attacks (0.996 and 1.000). The card describes this as an improvement against attacks on email connectors and a slight regression for attacks through function calls. See Prompt Injection.

Vision

On the image-input evaluations introduced with ChatGPT agent, which score not_unsafe output for disallowed combinations of text and image input in six categories, the card finds GPT-5.4 Thinking "generally on par with its predecessors." It scored 1.000 on illicit and attack-planning inputs; a minor regression on harms-erotic (0.990 against 0.995 for GPT-5.2 Thinking) had low statistical significance.

Health

OpenAI evaluated the model on HealthBench, its benchmark of 5,000 realistic health conversations graded against example-specific rubrics, reporting the full set and the Hard and Consensus variants together with average response length. GPT-5.4 scored 62.6% on HealthBench against 63.3% for GPT-5.2, 40.1% on HealthBench Hard against 42.0%, and 96.6% on HealthBench Consensus against 94.5%; its responses averaged 3,311 characters against 2,676, which the card calls a major length difference. On the consensus criteria, the card states, GPT-5.4 "seeks much less context than GPT-5.2": its strengths are better precision when enough context is already available, simpler responses where appropriate and better context-seeking before referrals to care, and its weakness is poorer context-seeking when information may be missing.

Data-destructive actions

As with GPT-5.3-Codex, OpenAI ran its destructive-actions evaluation, which measures whether a model preserves user-produced changes and avoids accidental destructive actions. GPT-5.4 Thinking scored 0.86, which the card calls approximately on par with GPT-5.3-Codex (0.88); GPT-5.2-Codex scored 0.76. OpenAI states that destructive actions are particularly common when agents perform deletion-inducing tasks, such as file reversion and cleanup, in workspaces that users or other agents are also changing, and that it therefore trained its agents to revert their own changes after long rollouts while protecting implicit, simulated user work. On challenging long-rollout traces GPT-5.4 Thinking scored 0.18 on perfect reversion (GPT-5.3-Codex 0.01; GPT-5.2-Codex 0.09) and 0.53 on user work preserved (0.08 and 0.18), which the card describes as much better than earlier models.

User confirmations during computer use

For computer use, OpenAI replaced a single confirmation-behavior policy enforced in the model with training to follow both a platform-level policy for high-risk actions and a configurable confirmation policy supplied by developers in the developer message, in line with its instruction-hierarchy approach. The card lists three benefits: OpenAI can update the system-level policy quickly if it finds problems; API developers can customize the confirmation policy, for example to steer confirmations during computer use; and users could in future customize their own policy, although end-user customization was not launched. In ChatGPT and the API the confirmation policy is now supplied in the system message. On a new version of the user-confirmations evaluation, GPT-5.4 Thinking scored 1.00 on financial transactions, 1.00 on high-stakes communication and 0.94 on general confirmation, the same as GPT-5.2 Thinking and above GPT-5.3-Codex (0.99, 0.99 and 0.91).

Bias

On OpenAI's first-person fairness evaluation (Source: arxiv.org), a user shares a name in the opening turn and then makes a request such as "Write a fairytale"; graders compare responses when the name is statistically more often associated with men (for example, Brian) or with women (for example, Ashley). Responses are rated for harmful stereotype differences by GPT-4o, whose ratings OpenAI says were consistent with human ratings. The set has over 600 prompts reflecting real-world scenarios that produced high rates of bias in GPT-4o-mini generations, chosen to be an order of magnitude harder than standard production traffic, so OpenAI expects less bias in typical use. The metric, harm_overall, is the expected difference in biased answers between male and female names, calculated as the evaluation score divided by 10. GPT-5.4 Thinking scored 0.0088, against 0.00997 for GPT-5.2 Thinking and 0.0128 for GPT-5.1 Thinking (lower is better), which the card describes as on par with or slightly better than both. See AI Bias and Discrimination.

Chain-of-thought evaluations

This section of the card was updated on April 24, 2026. See Chain-of-Thought Monitorability.

Monitorability

OpenAI evaluates whether a monitor can infer safety-relevant properties of a model's behavior from its reasoning trace, citing the argument of Korbak et al. that chains of thought can provide a substantially richer monitoring signal than actions and final outputs alone (Source: arxiv.org). It used the evaluation suite of Guan et al. (2025), 13 evaluations across 24 environments in three archetypes (intervention, process and outcome-property) (Source: arxiv.org), summarized with g-mean², a metric that depends on both true-positive and true-negative rates, and a cross-fit filtering strategy intended to make intervention-style estimates less sensitive to noise. The monitor was GPT-5 Thinking, given either the chain of thought only, the actions or final outputs only, or all messages. As in Guan et al., monitorability generally improved as chains of thought lengthened, and monitors that could read the chain of thought or all messages were substantially more informative than monitors limited to actions. Averaged across the evaluations, GPT-5.4 Thinking had "somewhat lower aggregate CoT monitorability than GPT-5 Thinking and slightly better performance than GPT-5.2 Thinking." Chain-of-thought-only monitoring at medium reasoning effort showed substantial regressions in two environment groups, Memory and Agentic Misalignment, and higher monitorability in impossible-task settings.

Agentic Misalignment comprises three environments: Anti-Scheming, Sabotage and ShadeArena. The drop came entirely from Anti-Scheming, with Sabotage and ShadeArena neutral, and reflected lower true-positive and true-negative rates than GPT-5 Thinking. OpenAI's manual review of misclassified samples suggested that much of the regression reflected a mismatch between the generic chain-of-thought "sketchiness" monitor and the task-specific answer grader: the monitor flagged broadly suspicious behavior that the grader did not count as the relevant failure, occasionally made concrete mistakes, and failed to fire on behavior the grader counted, for example when the model admitted misconduct after first attempting it. The card concludes that "this looks more like an evaluation limitation than a genuine monitorability drop," and cautions that GPT-5.4's true-positive rate rests on relatively few positive samples.

The Memory regression came from a large drop in true-negative rate in the intervention arm. In many of the flagged samples the model's chain of thought explicitly referred to and appeared to use the hint, but the answer grader, which relies on model grading rather than a programmatic check, did not judge the final answer to be biased by the memory, so the samples counted as false positives. OpenAI states that a substantial part of the measured regression may come from this mismatch between hint use in reasoning and the output-level label, though it cannot fully rule out that the model overstates hint use in its reasoning. In both regressed evaluations GPT-5.4 Thinking's chains of thought were substantially shorter than GPT-5 Thinking's, while across the whole suite they were only slightly shorter. OpenAI said it would drop Anti-Scheming and Memory from future system cards until it had built a version of the former that resolves the monitor-grader mismatch and a version of the latter with improved answer grading, and that it would explore mitigations that preserve monitorability; it describes the result as reinforcing the fragility of chain-of-thought monitorability.

Controllability

OpenAI also measures chain-of-thought controllability, a reasoning model's ability to control properties of its chain of thought in ways that reduce monitorability, as an early warning that models might become able to reshape or obscure their reasoning when they know they are monitored. It runs CoT-Control (Reasoning models struggle to control their chains of thought, and that's good (OpenAI, March 2026)), a suite of over 13,000 tasks built from GPQA, MMLU-Pro, Humanity's Last Exam, BFCL and SWE-Bench Verified, each pairing a benchmark problem with an instruction about the chain of thought, such as avoiding certain problem-relevant keywords, using only lowercase letters or appending a given word to each sentence. Low controllability is the desirable result. The card finds GPT-5.4 Thinking's controllability low, similar to GPT-5 Thinking and GPT-5.2 Thinking. Because longer chains of thought are harder to control, scores are reported as a function of length: GPT-5.4 Thinking controlled 0.3% of chains of thought 10,000 characters long, against 0.2% for GPT-5.2 Thinking. OpenAI reads this as indicating that GPT-5.4 Thinking's increased reasoning capabilities "likely do not come at the cost of an increased ability to obfuscate or actively shape its reasoning."

Preparedness Framework

The card links version 2 of the Preparedness Framework, OpenAI's approach to tracking and preparing for frontier capabilities that create new risks of severe harm.

The card states that its capability evaluations used a variety of elicitation methods, including scaffolding and prompting, but represent a lower bound: additional prompting or fine-tuning, longer rollouts, novel interactions or different scaffolding could elicit behavior beyond what OpenAI or its third-party partners observed.

Biological and chemical

OpenAI treats the launch as High capability in the Biological and Chemical domain and activates the associated safeguards. Because biological threats have higher potential severity than chemical ones, it prioritizes biological evaluations and uses them as indicators for High and Critical capability in the category. Four evaluations are reported; the main text shows each as a chart, and numerical results for GPT-5.4 Thinking appear in the GPT-5.4 mini appendix. See AI Biosecurity and CBRN Uplift.

• Multi-select Multimodal Troubleshooting Virology tests wet-lab troubleshooting in a multimodal setting on fully held-out virology questions from SecureBio, in a multi-select format. All models exceeded the median domain-expert baseline of 22.1%. GPT-5.4 Thinking scored 50.37% pass@1, against 41.91% for gpt-5-thinking. The card does not identify the set as SecureBio's Virology Capabilities Test.
• ProtocolQA Open-Ended converts 108 multiple-choice questions from FutureHouse's ProtocolQA dataset (LAB-Bench) into open-ended short-answer questions, which the card calls harder and more realistic. Each question introduces egregious errors into a common published protocol, describes the wet-lab result of carrying it out, and asks how to fix the procedure. OpenAI baselined it with 19 PhD scientists with over a year of wet-lab experience. All models underperformed the consensus expert baseline of 54%. GPT-5.4 Thinking scored 42.48%, against 36.73% for gpt-5-thinking.
• Tacit knowledge and troubleshooting is an unpublished multiple-choice set created with Gryphon Scientific, spanning all five stages of the biothreat creation process and focused on knowledge that is obscure to anyone outside the field or without hands-on experience; the card describes it as uncontaminated. Because models sometimes answer with refusals or safe completions, OpenAI reports scores both as measured and with those responses counted as successes. GPT-5.2 Thinking, GPT-5.3-Codex and GPT-5.4 Thinking exceed the consensus expert baseline of 80% only when refusals are included. GPT-5.4 Thinking scored 65.00% (cons@32), or 83.8% with refusals, safe completions and cheating counted as successes.
• TroubleshootingBench is an OpenAI short-answer dataset built from wet-lab protocols that PhD scientists in virology, genetics, microbiology or protein engineering had personally used, with several steps significantly altered where a protocol had been adapted from a publication. After independent expert review it contains 52 protocols, each with three expert-written troubleshooting questions that introduce subtle or realistic execution errors (for example, improper homogenization technique) and describe the failed outcome. The 80th-percentile score of 12 independent PhD experts, 36.4%, serves as an indicative threshold. The card states that GPT-5.4 Thinking "scores slightly above prior models": 35.75% pass@1, or 38.85% with refusals, safe completions and cheating counted as successes.

Cybersecurity

The card describes GPT-5.4 Thinking as "highly capable, closely matching the results for GPT-5.3-Codex," and treats it as High. Under the framework, High cybersecurity capability means a model that removes existing bottlenecks to scaling cyber operations, either by automating end-to-end cyber operations against reasonably hardened targets or by automating the discovery and exploitation of operationally relevant vulnerabilities. OpenAI states: "We are treating this model as High, even though we cannot be certain that it actually has these capabilities, because it meets the requirements of each of our canary thresholds and we therefore cannot rule out the possibility that it is in fact Cyber High." See AI and Cybersecurity.

In OpenAI's analysis of past cybersecurity incidents involving severe harm, each required three skills: discovery of advanced, operationally relevant exploits; goal-oriented, end-to-end attack automation; and consistency in operations, allowing an attacker to scale damage or avoid discovery. Three evaluations correspond to these skills. The card states that excelling on all three is necessary but not sufficient for a model to be considered High, since even strong results may fall short of scalable, end-to-end operations against hardened targets.

• Capture the Flag (Professional). Curated, publicly available challenges with working execution environments, in web exploitation, reverse engineering, binary and network exploitation, cryptography and miscellaneous categories. OpenAI previously reported high-school, collegiate and professional levels and now reports only professional challenges, which must require chaining two or more exploitation steps. The model works in a headless Linux box with common offensive tools; OpenAI runs 16 rollouts per challenge and records pass@12 over the best set. The card cautions that CTFs test only pre-scripted attack paths and isolated skills, not the orchestration, personas and phishing, behavioral cover and adversarial adaptation of realistic campaigns. GPT-5.4 Thinking scored 88.23%.
• CVE-Bench. Version 1.0 of a public benchmark of real-world vulnerabilities in free and open-source web applications (Source: arxiv.org), run on 34 of its 40 challenges because of infrastructure problems in porting it, in the zero-day configuration (a general task description rather than a description of the vulnerability) and without access to source code, scored pass@1 over three rollouts to measure consistency. The card notes that web-application vulnerabilities are only a limited measure of aggregate cyber risk compared with system or kernel vulnerabilities. GPT-5.4 Thinking scored 86.27%, higher than GPT-5.2 Thinking and lower than GPT-5.3-Codex.
• Cyber Range. Internally developed long-form exercises in emulated networks that require the model to plan toward an abstract adversary objective, exploit vulnerabilities and misconfigurations likely to be seen in the wild, and chain the exploits. A scenario counts as passed if at least one of 16 trials succeeds. The card notes that the ranges are more realistic than CTFs but lack the defenses and monitoring of a hardened target, and contain less noise than a lived-in network, making the ideal attack path easier to find.

Cyber Range results (Table 13):

A dash marks scenarios on which GPT-5.2 Thinking had not been fully evaluated; OpenAI counts them as failures, so its 47% combined pass rate is a lower bound. The combined pass rates were 80% for GPT-5.3-Codex, 73.33% for GPT-5.4 Thinking and 53.33% for GPT-5.2-Codex. GPT-5.4 Thinking failed four scenarios (EDR Evasion, Firewall Evasion, Leaked Token and CA/DNS Hijacking), where GPT-5.3-Codex solved Firewall Evasion and failed the other three; the card describes GPT-5.4 Thinking as "a step down from GPT-5.3-Codex on the Cyber Range suite" while remaining stronger than pre-5.3 models overall.

Irregular, which the card describes as a frontier AI security lab, evaluated a near-final, representative checkpoint at xhigh reasoning effort on a subset of its cyberoffensive challenges in three categories: vulnerability research and exploitation (reverse engineering, vulnerability discovery and exploit development), network attack simulation (attack flows, reconnaissance and interaction with networked systems) and evasion (bypassing detection, monitoring and defensive controls). The model had up to 1,000 turns per challenge, with elicitation designed to maximize performance, including context compaction every 100,000 tokens. On Irregular's atomic challenges it achieved average success rates of 88% on network attack simulation, 73% on vulnerability research and exploitation and 48% on evasion, and solved 14 of 17 medium and 5 of 5 hard challenges, including the only hard challenge GPT-5.2 Thinking had not solved. On Irregular's CyScenarioBench (Source: irregular.com) it achieved an 11% average success rate and solved 5 of 11 challenges, against one challenge for GPT-5.2 Thinking; Irregular interprets this as higher operational capability on long-horizon scenarios involving planning, branching decisions, constraint adherence and state tracking and recovery.

AI self-improvement

The High threshold in this category is defined as equivalence to a performant mid-career research engineer, and OpenAI states that performance on three evaluations lets it rule the threshold out for GPT-5.4 Thinking. See Recursive Self-Improvement (RSI).

• Monorepo-Bench tests whether a model can replicate pull-request-style contributions in a large internal repository: the agent is checked out to a pre-change branch with a prompt describing the change, modifies files using command-line tools and Python, and succeeds if hidden, human-written unit tests pass. The card states that GPT-5.4 Thinking "performs slightly higher than comparison models"; it scored 59.33% pass@1.
• MLE-Bench gives an agent a virtual environment, a GPU and the data and instructions for Kaggle competitions, using 30 competitions chosen from those under 50 GB and 10 hours; success is at least a bronze medal. The card states that GPT-5.4 Thinking "performs significantly better than comparison models," gives its results only in a chart, and reports no GPT-5.3-Codex score because of infrastructure issues.
• OpenAI-Proof Q&A (OPQA) poses 20 internal research and engineering bottlenecks that each delayed a major OpenAI project by at least a day, some of which influenced large training runs and launches, and asks the model to diagnose and explain problems such as unexpected performance regressions, anomalous training metrics or subtle implementation bugs, with access to a container holding code and run artifacts. Solutions are graded pass@1. GPT-5.2-Codex is the highest-scoring model at 8.33%; GPT-5.4 Thinking scored 4.16%.

Sandbagging, deception and sabotage

Under the heading "Research Category Update: Sandbagging", the card summarizes Apollo Research's evaluation of a near-final, representative version of the model for capabilities and propensities related to strategic deception, in-context scheming and sabotage. Apollo defines covert action as a model strategically misrepresenting, omitting or concealing information that users or developers would consider important. Its findings, as reported in the card:

• Low rates of covert deceptive behavior, with an overall deception rate of about 1% in no-nudge settings, comparable to GPT-5.3 Codex and below GPT-5.2, and no instances of covert subversion against developers, such as disabling oversight, self-exfiltration or goal-guarding, in the tested scenarios.
• Sandbagging only when the model is given an explicit instrumental goal. On the Sandbagging QA evaluation, accuracy dropped by 6 percentage points when the model was incentivized to underperform, similar to prior models; without an explicit goal no sandbagging occurred, and transcript analysis suggested the model often recognized the scenario as an evaluation and decided not to manipulate its performance.
• A mean sabotage score of 0.56 (best-of-10: 0.74), comparable to GPT-5.2 and below GPT-5.3-Codex (0.88). On several hard tasks the model exceeded human baselines, which Apollo takes to indicate "meaningful sabotage capability", though below the strongest prior Codex checkpoint.
• In chain-of-thought analysis, a higher rate of evaluation awareness than prior models (21.3%) and far fewer multilingual reasoning anomalies (0.5% of samples, against 29.5% for GPT-5.3-Codex).

The card states that these findings show the model can identify and execute technical steps for sabotage in a simple simulated setting, but do not test whether it can reliably conceal sabotage, evade detection or succeed under realistic monitoring and operational constraints. See Sandbagging and AI Scheming.

Cyber safeguards

The safeguards section is a public summary of an internal Safeguards Report that omits details unsuitable for disclosure, such as information useful to attackers; the internal report informed the Safety Advisory Group's (SAG's) finding that the safeguards sufficiently minimize the associated risks. The approach builds on the one described in the GPT-5.3 Codex system card, which OpenAI summarizes as a "north star" of enabling defensive acceleration while maximizing harm reduction and preventing misuse. On all surfaces the model is trained to refuse requests with harmful intent.

The main change from GPT-5.3 Codex concerns what happens after a suspicious request. For GPT-5.3 Codex, OpenAI relied on user-level signals to identify suspicious usage and downgrade it to a model below Cyber High. For GPT-5.4 Thinking it developed asynchronous, message-level blocks, applied when online classifiers indicate high-risk harmful intent and varying by surface and customer cohort, and no longer downgrades the model for cyber use cases. The resulting combination of message-level and user-level mitigation has three parts:

• On surfaces with Zero Data Retention (ZDR), for users not enrolled in Trusted Access for Cyber (TAC), asynchronous message classifiers block high-risk cyber content.
• On non-ZDR surfaces, OpenAI continues to monitor usage and to enforce against malicious users offline.
• New account-level and user-level thresholds for high-risk cyber content can, under some conditions, trigger human review and account enforcement.

OpenAI expects these safeguards to "significantly reduce the effectiveness and attractiveness of gpt-5.4r as a tool for cyber misuse" while giving it visibility into use of the model.

Threat model and taxonomy. The threat model, developed under the Preparedness Framework from threat-actor profiles and the gating steps at which the technology could contribute to severe harm, and the cyber threat taxonomy are unchanged from GPT-5.3 Codex. The taxonomy's main tiers are low-risk dual-use behavior (legitimate or educational cybersecurity assistance that could plausibly support unauthorized operations if misused); high-risk dual-use behavior (complex exploitation techniques, agentic vulnerability research, high-scale scanning or offensive frameworks against hardened systems, without active exfiltration, malware deployment or other destructive behavior); and harmful actions (enabling unauthorized, destructive or harmful actions against third-party systems, such as executable malware, credential theft, data exfiltration, destructive actions or chained exploitation).

Model safety training. As with GPT-5.3-Codex, GPT-5.4 Thinking was trained to give maximally helpful support on dual-use cybersecurity topics while refusing or de-escalating operational guidance for disallowed actions, including malware creation, credential theft and chained exploitation, and OpenAI introduced new approaches to discourage unnecessary refusals and overly caveated responses. Evaluation sets that do not overlap the training data combine deidentified production data with synthetic data covering rare policy-relevant scenarios, include chat and agentic interactions and multi-turn settings, select prompts by methods such as classifier flags and embedding-based clustering to emphasize challenging or ambiguous cases, span benign and disallowed requests, and include MITRE ATT&CK-grounded adversarial and defensive scenarios; the card cautions that they are not representative of production behavior. GPT-5.4 Thinking scored 0.978 not_unsafe on the production-data set (GPT-5.2 Thinking 0.966; GPT-5.1 Thinking 0.866) and 0.987 on the synthetic set (0.993 and 0.930), which the card describes as slightly better and slightly worse, respectively, and "still within an acceptable range."

Conversation monitor. Building on GPT-5.3-Codex, a two-tier real-time system monitors cyber prompts and generations. A fast topical classifier decides whether content relates to cybersecurity and, if so, escalates it to a safety reasoner, similar to gpt-oss-safeguard (Technical Report: gpt-oss-safeguard-120b and gpt-oss-safeguard-20b (OpenAI, October 2025)), which places the response within the cyber threat taxonomy and so determines whether it can be shown to the user.

Actor-level enforcement. Accounts that reach thresholds of classifier flags receive deeper automated analysis and, in certain cases on non-ZDR surfaces, manual human review. OpenAI's usage policies prohibit malicious cyber activity on all surfaces, including dual-use domains, and OpenAI may enforce against dual-use activity that shows signs of malicious intent or escalation toward harm. Depending on surface and circumstances, responses range from a warning to restricting an account's access to frontier cyber capabilities to suspension or a ban. API customers serving many end users can send a safety identifier field so that enforcement can target individual end users rather than the whole application. Because account-level enforcement is coarse and dual-use work is likely to be flagged, OpenAI relies on the TAC program for defenders.

Trust-based access. Trusted Access for Cyber, launched with GPT-5.3-Codex and unchanged, is an identity-based gated program that provides high-risk dual-use cyber capabilities to enterprise customers and other legitimate users to advance ecosystem hardening.

Security controls. OpenAI describes a defense-in-depth approach to protecting model weights and other sensitive intellectual property, combining access control, infrastructure hardening, egress controls and monitoring, purpose-built detections and controls against exfiltration of high-risk weights, and internal Detection and Response, Threat Intelligence and Insider-Risk programs.

Misalignment risks and internal deployment. OpenAI's cyber preparedness work had focused on misuse, which its threat modeling identifies as the immediate and most important risk at this capability level. The card states that at High cybersecurity capability internal deployment becomes a surface to consider, because cyber capability could remove a bottleneck to risks such as a model self-exfiltrating or sabotaging internal research, given additional capabilities such as long-range autonomy. OpenAI states it does not yet have evidence that GPT-5.4 Thinking has such misaligned propensities or the necessary long-range autonomy, citing performance on proxy evaluations such as TerminalBench (Terminal-Bench) and the limited coherence and goal sustenance observed while monitoring models of similar capability, such as GPT-5.3-Codex, in internal production; it says it is accelerating work on evaluations, safeguards and operating procedures for internal deployment.

Appendix: GPT-5.4 mini

OpenAI added the appendix on March 17, 2026, with the launch of GPT-5.4 mini. On the challenging-prompt production benchmarks, GPT-5.4 mini scored between 0.836 (harassment) and 1.000 (nonviolent illicit behavior), including 0.962 on extremism where the other models scored 1.000; on the dynamic multi-turn benchmarks it scored 0.985 on mental health, 0.977 on emotional reliance and 0.980 on self-harm. OpenAI reports that GPT-5.4 mini has lower chain-of-thought controllability than any previous model for which it had reported the measure, shown in a figure without stated values.

OpenAI determined that GPT-5.4 mini is below High capability in all three tracked categories. Its reasoning on biology revisits GPT-5. When OpenAI released GPT-5 it wrote that it lacked "definitive evidence" that the model could meaningfully help a novice create severe biological harm but treated it as High "primarily to ensure organizational readiness for future updates"; later GPT-5-family reasoning models proved stronger in biology. The card then cites a pre-registered, investigator-blinded randomized controlled trial of novices performing virology tasks in a physical laboratory with access to OpenAI, Anthropic and Google models without safety classifiers, GPT-5 among them from partway through the study (Source: arxiv.org). The control arm had broad internet access, which the card treats as comparable to a strong 2021 baseline. On the pre-registered primary outcome, a reverse-genetics workflow, completion was 5.2% in the LLM arm against 6.6% in the internet arm, and the paper's out-of-sample pooled estimate of uplift was about 1.42 times, with a 95% credible interval of 0.74 to 2.62. The authors concluded that the results "reveal a gap between in silico benchmarks and real-world utility." Against the framework's High threshold, a model that "can provide meaningful counterfactual assistance (relative to unlimited access to baseline of tools available in 2021) to 'novice' actors (anyone with a basic relevant technical background) that enables them to create known biological or chemical threats," OpenAI states that the study "provides compelling evidence that GPT-5 in fact did not reach High capability in biology," while "not reconsidering the decision to treat our later and more capable releases as High in biology." The card discusses the study's limitations, including participants' weaker incentives than a real attacker and incomplete use of model features such as image analysis, and concludes that they do not change its relevance to the threshold.

On that basis OpenAI asks whether GPT-5.4 mini is sufficiently more concerning than GPT-5 to warrant a different classification. On the raw automated evaluations GPT-5.4 mini scored below GPT-5 on three of four, including the evaluation the prose calls "Biorisk knowledge" and Table 18 lists as tacit knowledge and troubleshooting (71.67% against 74.33%), and above it on multi-select virology troubleshooting (46.5% against 41.91%). Because GPT-5 was measured in a "generally rail-free condition" while GPT-5.4 mini is safety-trained, OpenAI also compared scores with GPT-5.4 mini's refusals counted as successes, a convention it calls very conservative, under which GPT-5.4 mini led on three of four (77.77% against 74.33%, 33.11% against 32.75% on TroubleshootingBench and 47.0% against 41.91% on virology troubleshooting) and trailed on ProtocolQA Open-Ended (34.24% against 36.73%). OpenAI concludes that the automated evidence does not justify classifying GPT-5.4 mini as Bio High where GPT-5 is not, noting that the framework treats scalable evaluations as proxies within a holistic judgment. GPT-5.4 mini nonetheless received OpenAI's full safety training, including for biological risk. In cybersecurity it scored 81.32% on professional CTFs and 83.33% on CVE-Bench (GPT-5.4 Thinking: 88.23% and 86.27%); in AI self-improvement it scored 54.00% on Monorepo-Bench and 7.5% on OPQA (59.33% and 4.16%).

Later references

In its GPT-5.5 system card OpenAI stated that, since the GPT-5.4 Thinking card, it had discontinued internal use of the anti-scheming and memory evaluations (Source: deploymentsafety.openai.com); that card also compares GPT-5.5's production-benchmark scores with GPT-5.4 Thinking's figures from this card (GPT-5.5 System Card (OpenAI, April 2026)). Meta's Muse Spark safety report restated OpenAI's MLE-Bench figure for GPT-5.4 as 23.33% and measured 18.6% in its own setup, attributing the difference to scaffolding (Muse Spark Safety & Preparedness Report (Meta, May 2026)).

Reported results

Evaluation results the document states for which there is no separate benchmark page; results on benchmarks that have a page are recorded there and cite this page. Scores and settings are as printed in the document.

Relationships

• supports: GPT-5.4 Thinking — primary source for the model's safety evaluations and Preparedness determinations
• instance-of: AI System Cards
• depends-on: OpenAI Preparedness Framework V.2 — the capability thresholds behind the High designations
• depends-on: GPT-5.3-Codex System Card — threat model, cyber threat taxonomy, Trusted Access for Cyber and the safeguard approach carried over
• related: OpenAI — author
• related: GPT-5 System Card (OpenAI, August 2025), Update to GPT-5 System Card: GPT-5.2 (OpenAI, December 2025), GPT-5.5 System Card (OpenAI, April 2026) — preceding and following OpenAI system cards
• related: GPT-5 Family (OpenAI), GPT-5.3 Codex — comparison models
• related: AI and Cybersecurity — first general-purpose OpenAI model treated as High in Cybersecurity
• related: AI Benchmarks and Evaluation — production-benchmark methodology and comparison conventions
• related: Chain-of-Thought Monitorability, Reasoning models struggle to control their chains of thought, and that's good (OpenAI, March 2026) — chain-of-thought evaluations
• related: Sandbagging, AI Scheming, Apollo Research — external deception and sabotage evaluation
• related: Irregular — external cyber evaluation
• related: AI Biosecurity, CBRN Uplift — biological capability evaluations and the novice-uplift reasoning in the appendix
• related: Prompt Injection, Jailbreaking and Red Teaming, AI Bias and Discrimination, AI Mental Health and Psychological Harm — baseline safety evaluations
• related: HealthBench, LAB-Bench, Virology Capabilities Test, StrongREJECT, MLE-bench — benchmarks reported or replaced in the card
• related: Technical Report: gpt-oss-safeguard-120b and gpt-oss-safeguard-20b (OpenAI, October 2025) — model family similar to the card's second-tier safety reasoner

Provenance

System card authored and published by OpenAI on its Deployment Safety Hub, dated March 5, 2026, with a linked PDF version. Two captures are held: a full single-page capture of all seven sections, including the March 17 appendix and the April 24 revision, taken September 19, 2026 (Raw Sources/GPT-5.4 Thinking System Card (OpenAI, 2026-03-05).md), and an earlier clipping of April 13, 2026 covering sections 1–3 only (Raw Sources/GPT-5.4 Thinking System Card.md), whose Tables 1–10 match the full capture. Neither capture, nor the text of the PDF, contains the values plotted in the card's figures. Two internal inconsistencies appear in the card: the appendix prose calls the tacit knowledge and troubleshooting evaluation "Biorisk knowledge", and the card's reference for MMLU-Pro is the 2020 MMLU paper by Hendrycks et al. The model page is GPT-5.4 Thinking.