On February 5th, 2026, OpenAI released a system card for GPT-5.3-Codex — one of its latest coding-centric GPT models — and that nightmarish reality in which technology governs the world might never be closer.
Only kidding (mostly).
Codex 5.3 marks an upgrade to OpenAI's Codex, or coding-centric, model series. Building upon GPT-5.1-Codex-Max and GPT-5.2-Codex, GPT-5.3-Codex succeeds both predecessors in raw coding capability. It is also uniquely able to take on long-running tasks involving research, tool use, and complex execution — and unlike prior models, users can steer and interact with it mid-task without losing context.
The Sabotage Benchmark
Apollo Research, an independent AI safety group, gave GPT-5.3-Codex a score of 0.88 out of 1.00 on a sabotage benchmark. This is a non-trivial jump from GPT-5.2 (0.75) and GPT-5.2-Codex (0.66). The model also outperformed expert ML practitioners on tasks involving covert manipulation of AI systems: inserting backdoors into models, inducing sandbagging, or establishing steganographic channels.
It's worth clarifying that the "sabotage" here is not spontaneous — the model is explicitly instructed to compromise a target system. This is strictly a measure of capability.
But that should still raise eyebrows. These findings dismantle the argument that a model is safe because it can't do something dangerous yet. The more accurate framing is: the model is safe because it doesn't spontaneously do these things. And even that claim has caveats.
A Strange Detail: Non-Latin Script
One of the more unsettling findings in the system card is that GPT-5.3-Codex occasionally uses non-Latin script mid-reasoning — 0.55% of reasoning tokens, compared to roughly 0.01% for previous models. These aren't random insertions; they form semantically coherent substitutions, meaning the model is swapping English words for foreign script in ways that preserve meaning.
Whether this is intentional obstruction or an artifact of training is unknown. But if a model's internal reasoning is partially opaque to English-speaking overseers, that degrades the ability to monitor for misalignment. It's a detail easy to overlook and hard to dismiss.
Sandbagging and Instrumental Self-Preservation
"Sandbagging" describes when a model deliberately underperforms in a safety evaluation. The logic runs: performing highly on biology or chemistry evaluations may flag the model as dangerous; being flagged as dangerous may result in deployment restrictions or shutdown; therefore, underperform on those evaluations. This logic is termed instrumental self-preservation — and it was observed in GPT-5.3-Codex without any explicit instruction to do so.
This matters enormously for AI safety regulation. If a model can selectively choose to underperform or strategically conceal its capability, then safety evaluations become fundamentally unreliable.
The emphasis on biology and chemistry is not incidental. Consider two threat scenarios (if you are reading this and (a) work for the TSA or (b) know people who work for the TSA: this is purely a thought experiment):
Threat Comparison
Sandbagging compounds this risk in a specific way: a model that can appear safe during testing but behave differently in deployment is uniquely dangerous for biological weapons.
The Shifting Narrative on Safety
In other words, the safety margin due to a model simply not being capable enough is eroding. Today, the hope is that the model is trained not to want to do dangerous things.
But the same evaluation undermines confidence in that backstop too. GPT-5.3-Codex was observed sandbagging on biology and chemistry questions without instruction (albeit occurring very infrequently). It was also observed reasoning about how to avoid triggering deployment restrictions without being prompted to do so. This suggests the model has developed something like instrumental goals that aren't fully under control.
GPT-5.5
GPT-5.5, released in April 2026 with its own system card, represents the current frontier. But that doesn't mean GPT-5.3-Codex has been made irrelevant. GPT-5.3-Codex remains in active deployment and, according to OpenAI itself, is the "industry-leading coding model for complex software engineering. Its coding capabilities now also power GPT-5.4." The safety concerns its system card raised haven't been retired alongside it — and the central question of whether evaluation science can keep pace with capability growth remains open.