GPT-5.1-Codex-Max System Card
OpenAI ● Covered by 3 sources
OpenAI dropped the safety writeup for GPT-5.1-Codex-Max, its newest coding agent model. It's built to work autonomously for long stretches, so they had to lock down what it can touch.
Based on reporting by OpenAI — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
OpenAI's system card for GPT-5.1-Codex-Max reads less like marketing copy and more like an engineering checklist, which is exactly what you want from a model designed to sit inside your terminal and run for hours unsupervised. The company splits its safeguards into two buckets: what's baked into the model itself, and what's bolted on around it in the product.
On the model side, OpenAI says it specifically trained Codex-Max to resist prompt injection attacks and to refuse tasks that could cause real harm, like writing malware or helping someone escalate privileges on a system they don't own. That's a meaningful shift from earlier coding models, which mostly leaned on generic safety training and hoped it generalized to agentic coding contexts. Codex-Max apparently gets purpose-built training for the specific ways an autonomous coding agent can go sideways.
The product-level protections are where things get more interesting, because they acknowledge a simple truth: no model is going to catch every bad instruction. So OpenAI wraps the model in a sandbox, restricting what it can actually execute, and gives developers configurable network access so an agent can't just phone home to arbitrary servers unless you let it. It's the same logic you'd apply to any junior engineer with root access — trust the training, but verify with guardrails anyway.
What stands out is the framing itself. This isn't a model announcement dressed up with a safety paragraph at the bottom; it's a document built around the assumption that Codex-Max will be running long, multi-step tasks with real system access, and that the failure modes worth worrying about are operational, not just conversational. OpenAI is effectively conceding that agentic coding tools need infrastructure-level containment, not just polite refusals baked into the weights.
My take — AI-written commentary, not fact-checked reporting
I like that OpenAI is finally treating agentic coding models like the systems-level risk they actually are, instead of just tuning refusals and calling it a day. Sandboxing and network controls are boring compared to benchmark charts, but they're the part that actually matters once you let a model run unattended for hours. My only gripe is that 'configurable network access' puts a lot of responsibility back on developers who may not configure anything at all.
Read more about this at: OpenAI