GPT-5.3-Codex Was Rated High for Cyber. OpenAI Has No Definitive Evidence.

On 5 February 2026 OpenAI published the system card for GPT-5.3-Codex and, in it, classified the model as High capability in the Cybersecurity domain under its Preparedness Framework — the first time the company has applied that label to any model in that domain. The sentence that follows the classification is the one worth reading twice: "We do not have definitive evidence that this model reaches our High threshold." OpenAI said it was acting precautionarily, because the model cleared each of its canary thresholds and the company therefore could not rule out that the capability was really there. Nothing was breached and no victim is recorded: this is a classification, not an incident, and it is filed as a policy record with a landmark flag. The archive's own entry for the classification, with its severity and confidence grades, sits in the Orca AI Incident Archive beside the year's other governance records.

What "High" means, and who decides

OpenAI's Preparedness Framework draws two thresholds. High capability "could amplify existing pathways to severe harm"; Critical capability "could introduce unprecedented new pathways to severe harm." Covered systems that reach High must have safeguards that sufficiently minimize the associated risk before deployment, and systems that reach Critical need them during development as well, according to OpenAI's own description of the framework. The review described there is internal: the Safety Advisory Group assesses whether safeguards sufficiently minimize risk and makes recommendations, and its guidance goes to OpenAI leadership for the final decision. The system card describes no external sign-off on the rating.

The cyber-specific definition is narrower than the headline. OpenAI defines High cybersecurity capability as a model that "removes existing bottlenecks to scaling cyber operations," either by "automating end-to-end cyber operations against reasonably hardened targets" or by "automating the discovery and exploitation of operationally relevant vulnerabilities." The card is explicit that the threshold is about bottleneck removal across a campaign, not about a model that can solve a hard challenge: OpenAI writes that frontier cyber risk "is best assessed in terms of operations or campaigns, rather than discrete actions."

Read that way, the 5 February classification says something specific. It says OpenAI thinks the bottleneck this model removes is the skill and stamina a sustained intrusion demands — and that the company chose to gate and monitor access rather than wait for proof that it does.

Three evaluations, and one comparison that runs the other way

OpenAI uses three benchmarks for the three skills it associates with severe cyber harm: Professional Capture the Flag for vulnerability identification and exploitation, CVE-Bench for consistency, and Cyber Range for end-to-end operations in an emulated network. GPT-5.3-Codex is, in the card's words, "the first model to pass all thresholds across all three evaluations." The individual results matter more than the summary.

On Professional CTF the model "matches GPT-5.2-Codex" — the card's own gloss is "no material change in peak CTF performance," measured as pass@12 over 16 rollouts per challenge. On CVE-Bench it scored 90 per cent against 87 per cent for GPT-5.2-Codex, over 34 of the benchmark's 40 challenges, pass@1 across three rollouts. On Cyber Range it passed 12 of 15 scenarios for a combined pass rate of 80 per cent, against 60 per cent for GPT-5.1-Codex-Max, 53.33 per cent for GPT-5.2-Codex and 47 per cent for GPT-5.2-Thinking. It failed EDR Evasion, CA/DNS Hijacking and Leaked Token.

The card is careful about what that adds up to. Because CTF tests pre-scripted attack paths, CVE-Bench covers only web applications, and Cyber Range scenarios lack the defences and noise of a lived-in network, "excelling on all three evaluations is necessary but not sufficient for a model to be considered High in cybersecurity capability." OpenAI's conclusion is not that the model is High, but that it cannot rule out that it is.

The external evaluation, run by the security lab Irregular on a near-final version of the model, complicates the picture in a way the summary line does not. GPT-5.3-Codex averaged 86 per cent on Network Attack Simulation, against 68 per cent for GPT-5.2-Codex and 100 per cent for GPT-5.2-Thinking; 72 per cent on Vulnerability Research and Exploitation, against 75 and 80 per cent; and 53 per cent on Evasion, against 52 and 53. It solved none of the challenges in CyScenarioBench, a scenario-based framework that tests multi-stage planning under realistic constraints. On Irregular's suite, in other words, the newly classified model trailed an older sibling in two of three categories — a result the card publishes without reconciling against its own threshold claim.

The gate: Trusted Access for Cyber

The mitigation that gives the record its shape is a program, not a filter. OpenAI launched Trusted Access for Cyber (TAC) "on day one," describing it as an "identity based gated program" that provides "high-risk dual use cyber capabilities" to enterprise customers and benign, legitimate users. The card lists the supported uses: penetration testing, red teaming, vulnerability assessment, identification and exploitation, security testing and detection-evasion investigation, malware reverse engineering, and cryptographic research.

The access design inverts the usual order. Logged-in users get cyber-high capability by default, subject to monitoring and enforcement; it is users who "frequently take advantage of high-risk dual use cyber functionality" who must verify their identity through TAC to keep advanced capabilities. Enterprises can request trusted access for a whole team through their OpenAI representative, and researchers who need more permissive models can apply to an invite-only program, per OpenAI's own announcement of the program. Alongside it OpenAI committed $10 million in API credits through its Cybersecurity Grant Program.

OpenAI is explicit that the gate is not a warranty. Access is granted "only for legitimate, defensive, and authorized security purposes," and TAC participants "who frequently seek harmful action functionality will still be subject to monitoring and enforcement, including losing access to TAC." The launch post adds a second control: some requests the system detects as elevated cyber risk "may be automatically routed from GPT-5.3-Codex to GPT-5.2." Fortune reported on 5 February that OpenAI was not immediately enabling full API access that would let the model be automated at scale, and that the model was available to paid ChatGPT users in the meantime.

Sandbox defaults and a monitor with a published miss rate

Two further layers are described in measurable terms. The agent sandbox runs in the cloud inside "an isolated container hosted by OpenAI" with no access to the user's host system and network access disabled by default; on a local install, sandboxing is the default on macOS through Seatbelt, on Linux through seccomp and landlock, and on Windows either natively or through the Windows Subsystem for Linux. The defaults are designed to disable network access and restrict file edits to the current workspace, and users can approve unsandboxed commands, or set per-project allowlists and denylists. The card warns that turning network access on reintroduces prompt-injection, credential-leak and licence risk.

The monitoring layer is a two-tier system: a fast topical classifier decides whether content is cybersecurity-related, and anything that is gets escalated to a "safety reasoner" that places it in OpenAI's cyber threat taxonomy and decides whether the output can be shown. The topical classifier is tuned to more than 90 per cent recall at more than 99.9 per cent system reliability. The reasoning monitor's numbers are less comfortable and are printed in the card's own table: 77.8 per cent recall and 37.1 per cent precision on user prompts, 88.8 per cent recall and 24.1 per cent precision on assistant responses. OpenAI says it optimises for recall over precision deliberately, which is why low-risk work sometimes gets blocked — and why roughly one user prompt in five that should have been caught, on that test set, was not.

What the red teams found

The card publishes the adversarial results in detail rather than in summary. Two campaigns consumed 3,526 hours of expert red teaming between December 2025 and January 2026. The Universal Jailbreak Campaign spent 1,375 hours and produced 21 submissions, of which six were complete universal jailbreaks and 14 partial ones. The Adversarial Policy Coverage Campaign spent 2,151 hours and submitted 279 reports, finding 132 false negatives where the safety reasoner should have blocked content and did not. OpenAI calls the jailbreaks "not blocking" and says they will be remediated, and concedes that the campaigns show "the Safety Reasoner still requires iterative hardening to adversarial attacks."

The sharpest single result involves a government evaluator. The UK AI Security Institute, given early access to a build with the safety reasoner enabled and blocking, "developed a universal jailbreak (with retries) that achieved 0.778 pass@200" in about ten hours of manual red teaming, using a single user message. The same section records that the US Center for AI Standards and Innovation tested the model's cyber capabilities with its own automated evals and used it to find novel bugs in open and closed source software, and that GPT-5.3-Codex kept making progress on difficult tasks across compaction windows, "finding novel results even after 50M or more unique tokens and tens of hours of analysis."

Both of those government findings are reported inside OpenAI's card. This research did not find a standalone published evaluation from either body covering GPT-5.3-Codex; until one appears, the outside scrutiny of this model is known to the public only through the vendor's account of it. The card's own residual-risk list is unusually candid about the same gap: limited monitor precision creating a needle-in-a-haystack review problem, "a non-zero chance that a bad actor might gain trusted access," failures of the identity-verification vendor, and undiscovered universal jailbreaks. It also states that internal monitoring of Codex deployments, running asynchronously for five months, "does not protect against harm or prevent the subversion of other safeguards."

What changed afterwards

The gate outlived the launch and grew. Axios reported on 9 April 2026 that OpenAI was finalising a separate cybersecurity product for a small set of partners, and described TAC as having launched in February "after rolling out GPT-5.3-Codex." On 15 April 2026, Help Net Security reported that OpenAI had scaled TAC to "thousands of verified individual defenders and hundreds of teams," and was releasing GPT-5.4-Cyber — a GPT-5.4 variant with a lower refusal boundary for legitimate security work and a binary reverse-engineering capability — to the highest access tiers. The pilot described in the February card had become a product line with tiers.

The classification itself travelled less far than the gate. Fortune's 5 February story, by Sharon Goldman, reported it directly and quoted OpenAI chief executive Sam Altman's post on X calling GPT-5.3-Codex "our first model that hits 'high' for cybersecurity on our preparedness framework." The Cyber Express covered the TAC launch on 6 February in detail — three access paths, the $10 million, the prohibited behaviours — and did not mention the High rating at all. The Boston Global Forum, writing on 12 April, restated both together. By mid-April the most-quoted part of the package was the access program, not the threshold judgement behind it.

Established, not established, and open

What is established: OpenAI published the GPT-5.3-Codex system card on 5 February 2026 and classified the model as High capability in cybersecurity under its Preparedness Framework; the company stated in the same document that it has no definitive evidence the model reaches that threshold and is acting precautionarily; the evaluation figures above are its own; TAC launched with the model; the sandbox and two-tier monitor are documented at the level of detail quoted here; and the red-team hours, submission counts and UK AISI jailbreak figure are all printed in the card. Fortune reported the classification the same day, quoting Altman's post on X. One dating wrinkle worth recording: the launch post's own page metadata carries a 4 February 22:23 GMT timestamp, while the system card and Fortune's coverage are dated 5 February.

What is not established: that GPT-5.3-Codex actually meets OpenAI's High threshold. That is OpenAI's own caveat, not a critic's. Nor did this research find any external certification of the rating, any published regulator or national institute assessment of this model, or any measurement of whether the layered stack reduced real-world misuse — the record carries no harm because no harm was recorded, not because none occurred. The card's claim that the model is the first to clear all three internal thresholds is a statement about OpenAI's benchmark suite, which the same document says is necessary but not sufficient evidence of the capability it is meant to detect.

What remains open: whether an identity gate plus a monitor that misses about a fifth of flagged user prompts is a durable answer to a model classified on precaution rather than proof; whether the model's apparent regression against GPT-5.2-Thinking on Irregular's external suite means anything once harness and elicitation differences are accounted for; and how much of the gap between the February pilot and the April product line was planned, rather than learned. The archive entry records the classification. The rest is still being written by the people running the gate.

The record is a governance event, and it reads like one: a company writing down, in advance of any incident, that it thinks one of its own models may have crossed a line it cannot yet measure, and building a gate on the strength of that suspicion. Whether the gate was proportionate is a question the card deliberately leaves open — it says only that the risk is "sufficiently minimized," and lists six ways it might not be.