OpenAI ships GPT-5.3-Codex under its first High cybersecurity classification

What the model actually merges

OpenAI describes GPT-5.3-Codex as combining two prior lineages: the frontier coding performance of GPT-5.2-Codex and the reasoning and professional knowledge capabilities of GPT-5.2. The stated result is a model built for long-running tasks that involve research, tool use, and complex execution rather than single-shot completions.

The interaction model is the other concrete claim. OpenAI says you can steer and interact with GPT-5.3-Codex while it is working without losing context, framing it as working alongside a colleague on a task in progress rather than dispatching a job and waiting for a return.

A first for the Cybersecurity domain

The most specific line in the card is procedural. This is the first launch OpenAI is treating as High capability in the Cybersecurity domain under its Preparedness Framework, which activates the associated safeguards.

What makes it unusual is the reasoning. OpenAI is explicit that it does not have proof the model reaches the High threshold — it is classifying up out of caution because it cannot rule the possibility out.

We do not have definitive evidence that this model reaches our High threshold, but are taking a precautionary approach because we cannot rule out the possibility that it may be capable enough to reach the threshold.Montana Labs

How the capability lines are drawn

The card sorts three domains differently. Biology is again treated as High capability, deployed with the same suite of safeguards used across the GPT-5 family. AI self-improvement does not reach High. Cybersecurity is the new addition, and the one triggered by precaution rather than measurement.

For cybersecurity, OpenAI describes a layered safety stack meant to impede and disrupt threat actors, paired with an intent to make the same capabilities as available as possible to cyber defenders. That dual framing acknowledges a coding-and-reasoning model cannot be gated for offense without also shaping what defenders can reach.

The implication: a threshold triggered before it is proven

The operative detail for teams building on Codex is that OpenAI moved the classification, and the safeguards, ahead of the evidence. A model can now ship under High cybersecurity restrictions without a demonstrated crossing of the line, which means the safeguards attached to GPT-5.3-Codex reflect what OpenAI could not rule out, not what it confirmed.

That changes how to read future Codex releases. The precedent set here is that an agentic coding model capable of long-running research and execution will be treated as a cybersecurity concern by default, and the burden shifts to showing a model stays below the threshold rather than proving it exceeds it.