OpenAI's GPT-5.1-Codex-Max and the compaction approach to long-running agents

What compaction actually changes

The headline claim in the system card is narrow and technical: GPT-5.1-Codex-Max is OpenAI's first model "natively trained to operate across multiple context windows through a process called compaction, coherently working over millions of tokens in a single task."

That is a different bet from simply enlarging a context window. Compaction implies the model learns to summarize and carry forward its own working state as it exhausts one window and moves into the next, rather than relying on an external harness to stitch context together.

For anyone building long-running coding agents, this is the part worth watching. The failure mode of multi-step agents is usually not raw reasoning — it is losing the thread across a task that spans thousands of tool calls. Training the behavior into the model, instead of bolting it on with retrieval and manual summarization, is a claim about where OpenAI thinks that responsibility belongs.

Trained on the work, not just the benchmark

The card is explicit that the model was trained on "real-world software engineering tasks like PR creation, code review, frontend coding and Q&A," building on an updated foundational reasoning model trained across software engineering, math, research, medicine, and computer use.

That framing — PR creation and code review as first-class training targets — signals the intended shape of use. This is not positioned as an autocomplete engine but as something meant to participate in the workflow around a change: proposing it, reviewing it, answering questions about it.

The mitigations sit at the product layer too

OpenAI separates its safety work into two categories, and the second is the one applied teams should read carefully. Alongside model-level training against harmful tasks and prompt injections, the card lists "product-level mitigations like agent sandboxing and configurable network access."

For an agent that executes code, network access is the real blast radius. Making it configurable is an acknowledgment that a model trained to resist prompt injection is still not a substitute for constraining what the agent can reach. That division of labor — model-level resistance plus product-level containment — is the practical stance the card takes.

Where it lands on the Preparedness Framework

The card places the model precisely on OpenAI's capability scale. It is "very capable in the cybersecurity domain but does not reach High capability on cybersecurity," and does not reach High on AI self-improvement. It is being treated as High capability on biology and deployed with the same safeguard suite used for GPT-5.

We expect current trends of rapidly increasing capability to continue, and for models to cross the High cybersecurity threshold in the near future.Montana Labs

That sentence is the most forward-leaning statement in the document. OpenAI is saying a coding model sitting just below the cybersecurity threshold is a transitional state, not a stable one.

The implication: agent containment is now the engineering problem

Read together, the compaction capability and the network-access controls point to the same conclusion. A model that can coherently drive a task across millions of tokens is a model that can take many autonomous steps before a human sees the result — which makes sandboxing and network configuration the levers that actually bound its behavior.

For teams adopting GPT-5.1-Codex-Max, the work is less about prompting it well and more about deciding what it is allowed to touch during a long run. The system card treats that as OpenAI's responsibility at the product layer; in practice, the deployment decisions land on whoever wires the agent into their own systems.