GPT-5.3-Codex Guide: The Terminal Specialist, Read Closely

The interesting thing about GPT-5.3-Codex is not its headline score. It is the shape of its improvement. On the benchmark most people quote for coding models it barely moved; on the benchmarks that measure driving a terminal and a desktop it moved a long way. If you understand why, you know which jobs it is for.

OpenAI released it on 5 February 2026, describing it as its most capable agentic coding model, built by combining the software engineering strength of GPT-5.2-Codex with the broader reasoning and professional knowledge of GPT-5.2. At launch it was available only inside Codex on paid ChatGPT plans, with API access promised later. It now has its own API model page.

What changed from GPT-5.2-Codex

OpenAI's launch appendix, run at xhigh reasoning effort, compares the two directly:

• SWE-Bench Pro (public): 56.8%, against 56.4% for GPT-5.2-Codex
• Terminal-Bench 2.0: 77.3%, against 64.0%
• OSWorld-Verified: 64.7%, against 38.2%
• Cybersecurity capture-the-flag: 77.6%, against 67.4%
• GDPval (wins or ties): 70.9%, level with GPT-5.2

OpenAI also says it runs about 25% faster than GPT-5.2-Codex inside Codex, and that early versions of the model were used to help debug its own training run, diagnose evaluation results and manage deployment tasks.

Read the gaps, not the headline

A 0.4-point move on SWE-Bench Pro is noise. A 13-point move on Terminal-Bench 2.0 and a 26-point move on OSWorld-Verified are not. Put together, they say the model did not get much better at writing the patch for a well-specified issue, but got much better at the work around it: running commands, reading their output, recovering from a failed step, and operating software through a screen.

That distinction matters in practice. If your agent is mostly asked to produce a diff from a clear ticket, GPT-5.3-Codex is roughly where GPT-5.2-Codex was. If your agent spends most of its turns in a shell, installing dependencies, chasing a failing build or poking at a running service, the upgrade is where the value is. Terminal-Bench explained covers what that benchmark rewards, and why it predicts agent behaviour better than a patch-only score.

As always, these are vendor numbers on vendor scaffolds at the highest effort setting. Expect your own harness, at the effort level you can afford, to land lower.

Built for a harness, not a chat window

The API profile tells you how OpenAI expects it to be used. The model is served on the Responses API only; Chat Completions and Batch are both listed as unsupported. The built-in tools listed are function calling, web search, hosted shell and skills. Reasoning effort runs from low to xhigh.

The context window is 400,000 tokens, but OpenAI caps input at 272,000 tokens, with up to 128,000 reserved for output. Plan repository context around the 272K figure, not the 400K one. Knowledge cutoff is 31 August 2025, so anything about libraries released after that has to come from the repository or a search tool.

Pricing is $1.75 per million input tokens, $0.175 for cached input and $14 per million output, and OpenRouter lists the same rates at the time of writing. The cached-input rate is the one to design for: an agent loop resends most of its context every turn, and a stable prefix turns that into a tenth of the cost.

The first High cybersecurity rating

GPT-5.3-Codex was the first model OpenAI classified as High capability for cybersecurity under its Preparedness Framework. It shipped with extra mitigations and access controls, and alongside a Trusted Access for Cyber pilot for defensive security work.

Two practical consequences follow. Expect some security-adjacent requests to be refused or routed more conservatively than with older models, even when your intent is defensive. And treat a model that is good at capture-the-flag tasks as something that needs a real sandbox: no ambient credentials, restricted egress, and a disposable environment. Agent sandboxing covers the options.

GPT-5.3-Codex or GPT-5.4?

A month later, GPT-5.4 arrived and folded the Codex line into the general flagship. Reported figures put GPT-5.4 slightly ahead on SWE-Bench Pro, at 57.7%, and well ahead on OSWorld-Verified, at 75.0%. Coverage of that launch puts it a little behind GPT-5.3-Codex on Terminal-Bench 2.0. It costs more per token, at $2.50 input and $15 output, and offers a much larger context window.

A reasonable rule:

• Stay on GPT-5.3-Codex for terminal-heavy agent loops that fit within 272K of input, where its slightly lower price and strong shell behaviour line up with the work.
• Move to GPT-5.4 when you need a longer context, desktop computer use, a general assistant that also codes, or Chat Completions compatibility. The GPT-5.4 guide covers its long-context pricing, which has a catch.
• Look back at GPT-5.2-Codex only if an existing pipeline is validated against it. The GPT-5.2-Codex guide covers that model.

How to test it on your own repository

Because the gains are concentrated in shell work, test shell work. Pick ten tasks from your history where most of the effort was outside the editor: a broken build after a dependency bump, a flaky integration test, a migration that needed a running database.

Run each through the same harness with GPT-5.3-Codex and with whatever you use today, at the same effort level. Record turns to completion, total output tokens, and how often the agent recovered from a failed command without being told. That last number is what Terminal-Bench is trying to capture, and it is the one most likely to differ.