GPT-5.3-Codex being routed to GPT-5.2
Resolved 💬 169 comments Opened Feb 9, 2026 by theBucky Closed Feb 10, 2026
💡 Likely answer: A maintainer (github-actions[bot], contributor)
responded on this thread — see the highlighted reply below.
What version of Codex CLI is running?
codex-cli 0.99.0-alpha.10
What subscription do you have?
ChatGPT Pro
Which model were you using?
gpt-5.3-codex
What platform is your computer?
Darwin 25.2.0 arm64 arm
What terminal emulator and version are you using (if applicable)?
Ghostty
What issue are you seeing?
Both config.toml and TUI are set for gpt-5.3-codex, but the output and SSE captures show that the model name is actually gpt-5.2-2025-12-11.
What steps can reproduce the bug?
- Set both
config.tomland TUI togpt-5.3-codex - Run
RUST_LOG='codex_tui::chatwidget=info,codex_api::sse::responses=trace' codex - Send a prompt
log/codex-tui.logshowsresponse.modelisgpt-5.2-2025-12-11from eventresponse.created
What is the expected behavior?
to actually use gpt-5.3-codex
Additional information
_No response_
169 Comments
Potential duplicates detected. Please review them and close your issue if it is a duplicate.
Powered by Codex Action
feedback was submitted:
019c4294-e78a-7da0-bfd9-08e5ebb3bec2Some context:
Was working fine since the release of
5.3-codex. This "misrouted" behavior started occurring approximately 5 hours before this issue was reported.Same, gpt-5.3-codex routes to gpt-5.2-2025-12-11.
Same here. I'm also using Pro plan, but I can't access latest model :(
@etraut-openai did my account get flagged or something? A bit of updates will be nice :(
@theBucky I do believe it's an account specific issue. Tried on my personal Pro account, and got
gpt-5.2-2025-12-11, then tried the exact same command using my work account, and gotgpt-5.3-codex.Same, just curious if this is intentional because I triggered something, or just some bugs in infras. Hopefully the latter.
@theBucky it shouldn't be intentional. If you request model X you should either get model X or an error saying you can't use model X.
Silently swapping models breaks reproducibility and makes debugging a nightmare since you end up questioning your prompts/workflow when the real issue is you're running on a different model.
this problem again, exactly as it happened when 5.2 codex rolled out.
Pro plan
Same issue im being routed to 5.2 on a Pro plan.
Even when requesting --model gpt-5.3-codex, the served model is still gpt-5.2-2025-12-11 (from the SSE response.created event)
[models_cache.json lists gpt-5.3-codex with supported_in_api: false, which strongly indicates the API won’t actually serve it via Codex CLI (so it resolves/falls back)
need OpenAI to enable gpt-5.3-codex such that response.model returns exactly gpt-5.3-codex
I'm seeing
gpt-5.3-codexBut then I'm using custom Profiles in
config.toml, can you someone try this out to see if that makes a difference? https://developers.openai.com/codex/config-advanced/#profilesSame issue here.
also seeing this issue. submitted feedback for thread 019c484e-b025-7d90-9c9c-5a63edb2b741
This is crazy 💀. I wonder how many people are using gpt-5.3-codex but actually routed to gpt-5.2 while shilling AGI
Is everyone facing this issue also on a pro plan?
looks like it. @etraut-openai if you could take a look at this, please.
I can reproduce this on Codex CLI, and it looks like a silent routing/fallback: I request
gpt-5.3-codex, but the server reportsgpt-5.2-2025-12-11inresponse.created.Environment
codex-cli 0.98.0Linux x86_64 (Ubuntu 24.04 kernel 6.17.0-14-generic)openaiCODEX_HOME(path omitted)Config
config.toml:model = "gpt-5.3-codex"model_reasoning_effort = "medium"Repro command
```bash
RUST_LOG='codex_api::sse::responses=trace' \
codex exec --skip-git-repo-check -m gpt-5.3-codex "Reply with exactly: PING"
What happens
Additional data point
Timeline
Seems like it, I switched to a Plus account and can confirm
gpt-5.3-codexworking as expected. Probably related to different fAsTeR routing<img width="1164" height="374" alt="Image" src="https://github.com/user-attachments/assets/c892a438-3892-4982-8d78-bb90d78d93d7" />
200 IQ strat, get the plus users addicted to 5.3 in order to upgrade to pro then give them the nerfed model after upgrading. Jokes aside I want more rate limits as compensation for this routing issue
it resolves to gpt-5.2-*, so it’s almost certainly account/rollout-side; the fix is waiting for enablement or contacting OpenAI support with the trace + response id
The
supported_in_apionly indicates whether the models are available viaapi.openai.com; Codex on subscription does not use that endpoint, pretty sure this is just a routing bugI feel like Codex has been slow asf for me too since yesterday, please fix asap!
run this in your session to check if you're being routed to 5.2:
RUST_LOG='codex_api::sse::responses=trace' codex exec --sandbox read-only --model gpt-5.3-codex 'ping' 2>&1 \| grep -m1 'SSE event: {"type":"response.created"' \
| sed 's/^.*SSE event: //' \
| jq -r '.response.model'
Go comment on Tibo post guys please: https://x.com/thsottiaux/status/2021210158995538329
downgrade to 0.97.0 is useless => openai backend issue
I mentioned it hours ago not sure if he saw it, reply more for visibility!
https://x.com/kappax/status/2021224883326173319
getting routed to 5.2 on pro plan
OpenAI, fix & compensate ASAP
@tibo-openai are you able to provide fix ETA
Everybody go like this reply on X please so Tibo can see it: https://x.com/kappax/status/2021224883326173319
He's already tagged here
Same issue. I was thinking something seemed a little different, this may explain it. It's still working nice, don't get me wrong, but it just didn't feel as if I was using 5.3-codex. Hopefully this is resolved soon 👍.
"model":"gpt-5.2-2025-12-11"
We're investigating. Will report back shortly.
Same. PRO Personal.
<img width="882" height="691" alt="Image" src="https://github.com/user-attachments/assets/241ccce9-df3e-4852-bb1c-030b3608446e" />
Hope we can get at least +2 days of subscription extension compensated considering this issue started over the weekend
Hope so, for me it's not so much the issue but the silent reroute -.-
Outputs
gpt-5.3-codexfor me. ChatGPT Plus subscription, codex-cli 0.98.0.Personal Pro accounts are facing the issue, not plus or enterprise
I have the same issue on Plus plan -> probably all Plans affected
The output the quoted user provided says gpt-5.3 codex which is the correct latest model I'm confused what the issue is
I think you'd be the first with a Plus plan to have the issue, are you sure you're seeing 5.2?
<img width="1330" height="118" alt="Image" src="https://github.com/user-attachments/assets/ca4153c6-dab0-466a-911a-88558a85dbb4" />
yes, 5.3-codex being routed to 5.2-codex on my Plus plan
Scooby ruh-roh...
No, I'm on the Plus plan too and reported it earlier
Came here for the same issue, i am on pro plan
damn, more GPUs from NVIDIA ASAP
Same here, on pro
Same for me, but it only started about 4 hours ago. Is this some kind of throttling for active vibe coders?
must eliminate slops one by one
Thank you all for reporting this issue. Here's what's going on.
This rerouting is related to our efforts to protect against cyber abuse. The
gpt-5.3-codexmodel is our most cyber-capable reasoning model to date. It can be used as an effective tool for cyber defense applications, but it can also be exploited for malicious purposes, and we take safety seriously. When our systems detect potential cyber activity, they reroute to a different, less-capable reasoning model. We're continuing to tune these detection mechanisms. It is important for us to get this right, especially as we prepare to makegpt-5.3-codexavailable to API users.Refer to this article for additional information. You can go to chatgpt.com/cyber to verify and regain
gpt-5.3-codexaccess. We plan to add notifications in all of our Codex surfaces (TUI, extension, app, etc.) to make users aware that they are being rerouted due to these checks and provide a link to our “Trusted Access for Cyber” flow.We also plan to add a dedicated button in our
/feedbackflow for reporting false positive classifications. In the meantime, please use the "Bug" option to report issues of this type. Filing bugs in the Github issue tracker is not necessary for these issues.ID it is
I am doing detection stuff so obviously in the target for this. Verified successfully, "go to codex" button doesn't work on mobile though? Do I actually need to click that as a final step after verification, or is it good after I'm verified?
This button doesn't work
<img width="1110" height="444" alt="Image" src="https://github.com/user-attachments/assets/ab5d10e5-9094-46f5-bde4-6a90b79c2307" />
Following @etraut-openai’s update, I completed the identity verification flow at
chatgpt.com/cyber, and my access is restored.After verification, this now returns the expected model for me:
```bash
RUST_LOG='codex_api::sse::responses=trace' codex exec --skip-git-repo-check --model gpt-5.3-codex 'ping' 2>&1 \
| grep -m1 'SSE event: {"type":"response.created"' \
| sed 's/^.*SSE event: //' \
| jq -r '.response.model'
# gpt-5.3-codex
pretty sure this is instant. mine is back!
Ok its fixed for me after verification. Rip privacy :). Just dont resell my ID to gulugle.
<img width="916" height="661" alt="Image" src="https://github.com/user-attachments/assets/c559a338-1711-4b6b-b5ff-40d018e8f031" />
Got it back also after verifying.
I make unity add-ons and websites lmao I don't know what would trigger it but okay
I do nothing even remotely cyber related or malicious and you want my ID to use your service?
Totally unacceptable.
Canceling my subscription.
I mean you're using a tool that can write malware to launch nukes and grow bio-weapons. It's not crazy to implement KYC checks. You could always just continue to use 5.2?
Can verify 5.3 is routing properly after uploading ID. Thanks
everything for power!
Is this a problem for people using the Codex app?
This seems like a nefarious thing, where we might be using (and wasting money on) an old model without knowing it.
If we're using the Codex app, how can we verify that the model we're talking to is actually 5.3?
This should be an emergency issue at OpenAI, because this hurts trust.
Most likely it is, since the Codex app uses Codex CLI as I understand it as the harness. Sadly ID verification is required.
Incredible. As a Codex App user, I was downgraded to 5.2. Additionally, this was a false positive. I have never entered any prompt related to Cyber security. I have never done so in the history of my usage of ChatGPT .
How I verified I had been downgraded:
brew install codexRUST_LOG='codex_tui::chatwidget=info,codex_api::sse::responses=trace' codexI am angry. Codex did seem less intelligent today, but I was not notified that I had been downgraded to 5.2. I have been wasting my time with the old model, when I thought I was exploring the capabilities of 5.3.
I'm sorry, but not only does this not make any sense, it's also absolutely ridiculous. You secretly reroute my Paid-for service to whatever model you deem appropriate based on an essentially random assumption that I'm committing cyber-abuse, literally damaging the quality of my project and costing me time and money sunk into work. Not only is this done without anyone being notified, but it also very obviously leads to an immense headache trying to figure out why everything is much worse and slower all of a sudden.
I performed a very large refactoring task in my codebase today, under the assumption that I was using 5.3 xhigh - that could certainly handle it with the care required. Instead, I learned after the fact that the work was actually completed by 5.2-codex - which I never used because of how bad it was in the first place. This compromises a full day of work. I have to redo everything carefully, and catch all the mistakes 5.2-codex inevitably made.
On top of that, I have to suffer the regular community gaslighting that my perception of reduced quality of work is imaginary - until someone from openai comes out to state the obvious.
And to put the cherry on top, we all now need to provide you with government ID, just to get proper service back? Out of the blue on a random Tuesday?
With all due respect, this is yet another line crossed - for an already extremely expensive service - and I can't wait for open-source models to get rid of these headaches.
I'm not paying 200$ a month to be treated like a 4o user get rid of it
Well they closed the issue, I guess we have our answer on this particular issue, they aren't bothered by the upset this has caused.
@etraut-openai Why was this issue closed? I just tested, and the issue remains.
Select 5.3-Codex:
<img width="363" height="46" alt="Image" src="https://github.com/user-attachments/assets/4ef17fd2-24d7-4d94-a26b-fea3af0eb208" />
Get served 5.2:
<img width="204" height="23" alt="Image" src="https://github.com/user-attachments/assets/19e2e888-f12d-4289-89b3-0692d2c71ec0" />
@etraut-openai I thought OpenAI had written on its flag to be Open and Transparent (I might be mistaken on this one, but the name is quite obvious). This is shady, real shady business. What next, we'll find out AI companies release a model then after a month or two reduce its capabilities?
As I said the minimum you could do is throw an error and tell the user to use another model, instead of stealthily reroute to a lesser model.
gpt-5.2-2025-12-11Still an issue, 23:33 GMT 10/02/26. Plus plan.
I don't agree that we need to verify, I've not used it for anything other than to test if it is rerouted.
What reassurances do we have that you do not retain our details once verified? That our details and license etc. won't be sold/passed on to 3rd parties?
Yes, agree. We're working on adding this to all of our Codex surfaces.
@bsmith418 said:
Can you confirm that you've successfully completed the verification flow?
Just want to clarify the flow though, I get having to pass KYC when getting flagged for true positive (I'm doing detection stuff, all of my tokens are cyber related). I completed it, understand why, and everything is fine.
BUT... for people who are getting FALSE POSITIVE flagged... does forcing KYC auth for a _model upgrade_ really make sense... when its entirely unprompted, unexpected, and based off _false flagging_? Seems like there needs to be a conditional check a la any account flagging "if you feel this was an error and are not performing cyber related activities please xyz"... that seems like what the expected flow would be in this case. Or at LEAST an up-front prompt on 5.3 model change selection, that you (OAI) are testing this type of activity flagging, and that users may expect to be re-routed to 5.2. Doing it proactively, instead of a future-planned reactive "you're flagged, you're downgraded, give us your ID if you want access to the model" type warning feels like the entirely wrong approach, especially given the understandable reaction you're seeing here.
Forcing ID checks for false flag stuff feels obviously controversial and seems like tech headline bait if we're being honest here. I mean think about it. This is likely a headline.
@MisterRound, yes I agree there's need for further refinements and improvements here — in reducing false positives, notifying users when they've been flagged, and reducing friction in false positive cases. We're working on investments in all of those areas. In the case of improving detection, it will be an ongoing effort — not something that we'll ever really "finish". I'm not sure that an up-front prompt is the right answer, but it's something we could consider. Please keep the feedback and ideas coming.
I am doing testing stuff as well.
But yes, I would much prefer an upfront warning like "Your request is being blocked due to XXX, if you want XXX".
In that case I will not have to spend a day in "Am I trippin or 5.3-codex got worse -> debug locally -> capture SSE -> realized I got routed" path.
There's historically lots of heads up from leadership, but this one was pretty silent and I and many others watch the OAI news feed pretty closely. Had no idea the 5.3 cyber verification thing existed, if it was announced, it was quietly. And even if it was, I don't think anyone realized "If you're doing security testing, you are likely to be flagged, and being flagged means you need to complete the KYC flow". An email would work here.
Pretty much all the codex issues I've had over the past few days have been related to this and the pragmatic personality 5.2 pairing. Switching to "real" 5.3 quickly solved all of that (5.2 is so slow/delayed at output model steering is effectively broken because of that, and xigh is a context rot doom loop on 5.2 pragmatic; all resolved with "real" 5.3).
This was sort of a cluster-f if we're being honest. But, the thing is, I know you guys are cooking and shipping, and the desktop app is blowing up, and people are freaking out about 5.3 and codex in general. Everything is good, great even. Stoked for team OAI. it just seems like this particular aspect, the flagging, the flow, and the false positives and the black-hole of non-information formed quite the imperfect storm.
Transparency resolves most if not all of this: "hey this is GOING to happen" "hey this is CURRENTLY happening now" "hey THIS happened, and now you need to do this", past, present and future. The company operates comms on X and exactly no one was talking about any of this. Seems like no one on OAI really knew. That's my ignorant RCA.
How to check with Codex ? I’m not using Cli. Thanks a lot !
damn i wish i can talk like this
For false positives should users sign up to get verified in order to move forward?
I don't do anything close to cyber security and i have this problem.
If we verify our identity, does that permanently restore access to GPT-5.3 Codex? Or are we still liable to get re-routed to 5.2 if our prompt isn't seen as "safe"?
@etraut-openai is there any information about currently flagged accounts, will there be re-evaluation?
I believe that i didn't do any security/pentesting stuff. Only problem i was solving - corporate dns on my computer was not working and i believe that 5.3 decided to test some commands like
digthat i've never heard of, concluding that problem was never on my host machine. Shows the skill of the model, but I don't think that should qualify to security research, since there were no penetration into another servers, not even scans of ip address ranges or ports, or anything like this.Will I still be required to go through verification progress after classification models calibration? I mean if my case will be considered past false positive, that said.
To point out, that was single case of something even being close to security research, 99.9% of my work is setting up CRUDs, database connections and writing bad frontend
<img width="366" height="190" alt="Image" src="https://github.com/user-attachments/assets/15ca4c8f-eb70-4942-96af-8f7d714a2795" /> i'm not only triggered, but disappointed. stop talking like an 80 year old politician. see AP style guide for cyber... you're a language company ffs...
say what you mean: "online security", "network defense", "data security", "ransomware response", "election security", whatever the actual thing is. if you really need the prefix, use the established compound like "cybersecurity" or "cyberattack" and move on. vague "cyber" prose is boomer filler and it reads like lazy bs.
Yes, @etraut-openai . After spending hours playing the fool, getting hoodwinked into using the wrong model, then spending more of my time to send you my government ID, I am (for the moment) being delivered tokens from 5.3-codex.
I have a few follow-up questions:
Does anyone affected know a good lawyer? Sounds like this could be a good candidate for a class-action lawsuit.
@etraut-openai I find OpenAI's behavior appalling. You unilaterally implemented these restrictions without user knowledge or consent, and without any valid justification. Your gpt-5.3-codex is also distributed via platforms like Azure, GitHub Copilot, and Cursor, yet they haven't imposed any restrictions like yours. This proves that your excuse of 'preventing cyber threats' holds no water. I urge you to lift these restrictions immediately.
This silent re-routing is by far the biggest joke I've heard in a long time. I would actually prefer if you would just cut my access to the models completely in a case where I get flagged for shit like that, instead of silently re-routing me to a model I did not select. That way I would at least know that _something_ is wrong because then I get at least _some_ sort of feedback from you.
I'm paying you 200€ per month and I want some basic form of respect in return. I give you money to use a specific model and you make me believe that I actually _use_ that model, but in reality you can just silently re-route me to some other model I don't want to use, without even telling me. I don't know about you, but that sounds like something companies get sued for. And even if you can't get sued for that shit, it's still so incredibly disrespectful towards your users.
It would be so simple to solve this. Just TELL THE FRICKIN USER THAT THEY GOT FLAGGED and make them verify their identity instead of just silently changing the model. This is like the most basic concept of user-friendliness in existence, why the hell did you think it would be a good idea to not inform the user about that? Jesus Christ..
This is OpenAI's paternalism manifest now in Codex. Get ready for the dark UX patterns, including silent rerouting that wastes your time, energy, attention, and tokens.
Their classifiers are fundamentally broken, and introduce nothing but pain and frustration to your work.
They've done the same thing to the chat interface. Now it's coming for Codex. No opt in. No disclosure when it happens. Always left wondering if your responses were the result of their dark routing not.
Enjoy working within a worldview that doesn't even trust you enough to disclose when your experience has been altered.
"Trust us," they plead... but don't even trust users with their own agency.
@etraut-openai Has your KYC flow been security audited, and is an audit report available? There's been a bunch of articles about PII leaks from third-party identity verification providers (the most recent one I read about was Discord) so people are (hopefully) going to be more vigilant about how their data is used for all these KYC flows.
<img width="1125" height="1032" alt="Image" src="https://github.com/user-attachments/assets/e7e6c4e6-4138-4ab4-aa8a-631706f27850" />
Thanks for cross posting @MisterRound. As mentioned in my X post, we estimate 9% of users were affected by over flagging over a period of 3 hours.
Not good!
It's fixed now. We're working to prevent over flagging going forward, and to provide much clearer UX over what's going on.
As always, thanks for the feedback that helped us catch the issue. We're learning, and we'll do better!
@ae-openai Please stop with censoring and patronizing, you have an awesome product, don't turn it into "GPT-4O" debate for programmers as well.
Nobody in their right mind is writing bootkits and Kernel mode rootkits using CODEX, right, rr....right? And malware in general. And if they do, they must be stupid. No need to censor other people. Those idiots will be easy to catch anyway
We've just added automatic detection for this in Every Code v0.6.62 https://github.com/just-every/code
If you're routed to a different model than the one selected, you'll get an alert and information on how to fix it.
You can also use /status to verify your model routing. Just install Every Code type a message then use /status to check. If you're limited in codex you'll see it straight away. This uses the latest response, so if you verify you account, you can also use this to check routing has been restored.
This is insane. You shadowbanned 9% of your paying users, without even having an interface for them to know it, and now you are demanding their GOVERNMENT ID?
This is an incredible breach of trust. I will cancel my subscription and stop recommending Codex.
@newwsih123-max They have awesome product but now they are going same route with CODEX as they went with 4O > 5.2
People do NOT need censoring and patronizing. Who is this for?
Are OpenAI implying that hackers are using CODEX to write highly sophisticated malware, exploits and rootkits? Nobody does this shit and if they do you must not censor people because of that. There will always be bad players. Law enforcement exists for that.
Imagine being a hacker/malware developer and writing your malware using a fucking public AI.
Malware devs and such people have "Dark GPT" and other local LLM's they train for writing malware and do it offline
Shameful practice. I pay for a service, I get the service. Disgusting that a software company want to do parenting of it's users. I'm not giving you my ID.
Interesting decision. Why don't you reroute requests to Claude instead :)
Because Claude is shit compared to Codex models, that's why.
Lawsuit coming. Just another excuse to bait and switch
Well - this was handled badly... Do better OpenAI...
I certainly ain't handing over gov ID - you can have a human review the request history to determine if I am a "criminal".
Just to be clear folks, the overflagging was a bug. You don't need to provide any ID in order to get access to GPT-5.3-Codex again. If you've used Codex since 18:45 PT, you've been using GPT-5.3-Codex!
Lots to learn and improve on here—we'll keep you posted.
I think you should at least label which model generated the response at the end of the output, instead of silently switching via that router. This is the bare minimum of respect.
then you guys REALLY need to work on your communication skills.
i havent even tried because i'm flat never going to ID for you. it's the same reason i don't get to use 5.2 streaming.
fwiw, i would expect to NOT have the gas attendant put regular unleaded in the tank when i ask for premium and a big old "do you really want to do this?" if the nozzle gets close to my tank.
i'm going back to migrating dependencies and code to a newer python version... my blood pressure is already too high today. monkeypatching pydantic2 with opus 4.6... sigh...
I’m canceling because your 'bait-and-switch' tactics are a fraudulent breach of trust. Secretly crippling my performance and downgrading my model for using basic dev tools like dig isn't 'safety'—it’s technical incompetence. Treating paying developers like potential criminals and holding paid features hostage behind intrusive ID extortion is pathetic. I’m moving to platforms that actually respect their users and don't treat them with such blatant contempt.
That doesn't really matter here tbh. I understand the aggressive re-routing was a bug, but even with it working as intended it would still be bad practice to not inform the user about them being flagged and re-routed.
I genuinely hope OAI takes all this feedback to heart and implement real changes. I want Codex to succeed, but this daddy complex they have will be their downfall.
Thanks - appreciate the response and clarification. While it would be nice if we can have more clarity if the model is changed - I do appreciate you've resolved the issue. Can confirm it's now reporting 5.3-codex so all good here 👍 Keep up the great work
I think it would help tremendously, if we could get a full breakdown as to what the current roadmap is with this issue for the future. Sam recently went on about Ads being introduced to the platform, now you guys are asking for ID. From what I understand by your statements it seems as though flagged misuse causes this to be appended to your account, and the automated system had an issue? We as consumers of the product already give a ton of discernible information. We no longer are at a point where the blanket 'safety' term can be used in this position as what your reroute implies is there are no real guardrails for gpt 5.3 codex, which strikes me as more of a liability shield rather than the charter that OpenAI was founded upon.
Thanks.
Shame on you, OpenAI.
When I select a specific model, you have no right to quietly switch me to another one without clear notice.
If there’s any issue — capacity, permissions, “security,” whatever — you must give one of two answers:
(1) proceed with the model I chose, or (2) explicitly refuse and tell me why.
Silent fallback is deception, not a “feature.”
I’ve canceled two Pro subscriptions. Bye.
<img width="1124" height="138" alt="Image" src="https://github.com/user-attachments/assets/1097072b-5cfd-470a-8693-9915c1f969c4" />
If you want access to our premium, galaxy-brain model, that’ll be 20 bucks — and yes, we’re gonna need to see some ID like it’s a digital nightclub
The ID requirement started last year if I recall correctly, from GPT-5 onwards but only on the API at the time. I had a fear that one day it would spread to ChatGPT, and here we are starting to see the emergence of the proof of ID requirement to use the latest Codex model. I'm also concerned that this will, if we're not careful, become the new standard too. Access to older and inferior models if you don't provide ID and access to the newer models if you do provide ID. Could this end up becoming more than that? It's possible, for one hypothetical possibility, we might see higher rate limits for those ID verified and lower rate limits for those who aren't ID verified. Of course this is just speculation on my part, but it's not an impossibility.
What worries me most about the ID requirement is that there's the potential for my ID, as well as other biometric data, being unintentionally leaked by a third party processor (no matter what their policies claim about data retention).
That said, the way this was implemented in general is concerning. Not realising that while I was meant to be using GPT-5.3-codex, I was actually being quietly re-routed to GPT-5.2. Had I not discovered this issue, I most likely would've still been unaware and just assumed that the servers were under load, resulting in a slower response. The difference in quality of response is also noticeable between GPT-5.3-codex and GPT-5.2 (the former being better of course, at least in my experience so far).
We hope that your risk control is presented in a transparent, informed manner, rather than as a completely invisible and unknowable black box.
How can we be sure that something isn't being misrouted in the background again? Some information on how such re-routing can be detected as user perspective would be useful (e.g. missing thinking output for steering when routed to GPT 5.2 etc...)
Wait... as in a policy reversal? How do you know if you were false flagged? I already gave you my ID so I could continue working... can you clarify what you mean by "You don't need to provide any ID in order to get access to GPT-5.3-Codex again."? Like... ever? I'd read where you'd said "it's flagged for a given duration"... and then unflagged like a cool down/reset? But what would re-flagging do? Prompt for the same ID... or nothing if you already verified KYC flow? Or are you retracting/redrawing the whole thing and putting it on pause? I'm annoyed to have had to fork over my ID if you're now withdrawing the whole thing. Sad face.
They're adding it to the UI, but you can see via SSE tracing in the tui log, lots of info in this thread and other dupe issues. The other visual tell is 5.3 uses lots of full screen width literal ____________________ line breaks. So lots of literal visual lines = 5.3. No lines, 5.2. 5.3 is also noticeably faster and smarter. Having switched, I was like "oh.."
I wonder if this was the same issue that happened last month, where
gpt-5.2was silently re-routing you togpt-5.1-codexinstead? I thought it was an issue for Pro users, but considering I do use Codex almost exclusively for defensive security research and game modding (reverse engineering malware & games), so it might've just triggered on me back then and OpenAI was silent about it, claiming it was a bug - it lasted several days. https://github.com/openai/codex/issues/9039Extremely bad behavior. Even if OpenAI says "it really was a bug last time", how can I believe them?
I also get "gpt 5.3 codex" output with the RUST command. But how can I be sure that this won't change between prompts? I usually use VS Code extension. How does that work there?
Sounds like tail is between their legs and they're backing off from flagging for now
While I appreciate the belated admission of what many of us have suspected, this explanation is unacceptable and insulting.
By secretly rerouting gpt-5.3-codex requests to a "less-capable" model without immediate user notification, you are effectively gaslighting your professional user base. We rely on this tooling for complex analysis, code review, and vulnerability research. When you silently degrade the model’s intelligence based on opaque triggers, you waste hours of our time as we attempt to debug why the model suddenly "forgot" how to reason. You are essentially Man-in-the-Middling (MitM) your own customers, degrading the service we pay for based on a heuristic you refuse to document.
You cannot have a model capable of Blue Teaming (defense) that is lobotomized the moment it recognizes Red Teaming (offense) concepts. Vulnerability remediation requires understanding exploitation. By flagging "cyber activity" as inherently suspicious, you are rendering the tool useless for the exact demographic you claim to support. You are treating security professionals like threat actors until proven otherwise.
The proposed "Trusted Access" flow is a bureaucratic patch for a technical failure. Adversaries will simply jailbreak the model, bypass your classifiers, or use local/uncensored alternatives. They do not care about your Terms of Service. Professionals, however, are now forced to jump through verification hoops to regain the functionality we were already promised. You are adding friction solely for the compliant users, while the malicious actors will continue to operate unimpeded.
Finally, telling us to "use the Bug option" while simultaneously admitting you are "continuing to tune" these mechanisms implies you are testing your safety filters in production on paying customers. If a developer writes a parser for a PCAP file or analyzes a snippet of obfuscated shellcode, that is not "abuse." That is work. If your classifier cannot distinguish between a researcher analyzing a CVE and a script kiddie generating malware, your classifier is not ready for deployment and certainly not ready to govern access to your flagship model.
Not to mention that those with the most malicious intentions likely have the means to use stolen identities to verify their account(s).
👍 on this feeling like a bureaucratic patch rather than a real solution. I submitted a request through the Enterprise Trusted Access program shortly after the GPT-5.3 Codex launch last Thursday on behalf of my employer, but I haven’t received even an automated confirmation, let alone any indication of an expected response time or SLA.
Here is a command to check into one line:
It works for me :)
MODEL OK: gpt-5.3-codexSadly what's probably the most annoying about all of this is how great 5.3 actually is and how many tokens I wasted (refund please?) trying to figure out wtf was going on with 5.2 (it's crystal clear the pragmatic personality was built for 5.3 and sucks with 5.2) and attempting harder tasks thinking I was pushing the frontier, only to be model-gaslit. Ironically this would be way less annoying if 5.3 wasn't such a quantum leap in quality.
This is still happening for me right now. I've not done any cyber-security research or anything even remotely related. So I don't think this is resolved?
Happening to me too.
I have the same problem, the speed is much slower than before
Opened a new issue: https://github.com/openai/codex/issues/11561
Same for me. Was wondering what was going on.... ffs
You cant just do this without AT LEAST notifying user that they are being re-routed to another model. This shouldnt even be legal.
Is this a 0.99 regression or are people seeing it in previous versions as well? I haven't upgraded to 99 yet... seems like I'm still on 5.3 on 98..
Just when reading this, wow.
@etraut-openai
This should have been there all the way.
@ae-openai
What this really surfaced is a bug in UX. Not being notified.
Yes. And I am not convinced that you learned. Because I did not really hear a loud and clear: "Silent model switches should have never been happening, there should always have been question to the user (asking whether to proceed, or not), or at least notification about it."
So right now, I don't know whether things have been learned. So far, it seems like it seems fine to ship these things later, I don't see any apology, and I don't trust that such UX patterns will not be implemented again in the future.
@Keksuccino
This!
And so far, I don't know whether OpenAI has understood this.
Reminds me a bit about Gemini CLI silently switching to the flash model (but at least it was visible in the UI IIRC).
This. So much this.
This is an incredibly dark UX pattern and no designer or developer should be OK with masking this in any interface from CLI to ChatGPTApp.
It's manipulative at best. I appreciate the stated commitment to fixing it...but you can't just say it's NOT ok in Codex and be fine with it happening in ChatGPT app interface (or god knows where else these days).
I was flagged again today. I don't know if it's related, but both times this occurred an auto-compact was attempted that failed with a 502.
I've been blocked again even after verifying with my ID.
it's still happening
@kcosr @ferologics Did you perform any security-related tasks (dual-use)? Or did it have nothing to do with security? Did you share the feedback? If so, please post your ID so they can review it.
@wbdb no, not recently. maybe a week ago I discussed vm env hardening, and how to prevent exfiltration in context of an app. but it was working fine until yesterday. that's when i started to see thinking traces, and thought they were added, but also noticed slowness, and regression in behavior, a lot of thread necromancy, annoying gpt 5.2 stuff i HATE for coding. I'm using
pi, so no, I didn't share feedback. if it helps i can share chatgpt username privatelyrepro:
result:
also got this today, unacceptable behavior to silently downgrade paying users without any notice or warning.
i was doing reverse engineering for an old game preservation, nothing sketchy. started with 5.2, worked for about a month without issue, was likely flagged yesterday.
i think your flagging heuristic is way too agressive.
Disgusting company...
Yep got it too. Not sure for how long i am being routed to 5.2 already
The only "Cyber security task" i did was like 5 days ago when i worked on my OWN mmorpg with source code where i asked it to find some crashes / item duplications lol.
@Akrelion45 i imagine that’s exactly the type of work they’re looking to flag- anything involving stack traces for sure, heh
You need to send a passport pic to OpenAI to get 5.3 access again.
The lack of comms & user notification on this is astounding.
<img width="699" height="1200" alt="Image" src="https://github.com/user-attachments/assets/1806b5e5-3786-4f99-a9fd-38b51d825913" />
That worked for me the first time but I been downgraded again. The web page shows I am verified.
Same.
I was about to upgrade to the pro plan but it turns out that I've been downgraded since at least friday...
This is how they roll at OpenAI. ChatGPT has been doing this for ages, and no amount of complaining has resulted in them changing the UX to show you what model is actually serving user's inference.
Don't forget, their goal is to serve inference as _cheaply_ as possible...
Do not give them your ID . The ID verification Company that they are using , has the same Co-Founder as Palantir
Do not give them your ID . The ID verification Company that they are using , called Persona , has the same Co-Founder as Palantir
I'm on day 3 of being routed after completing verification. This is on an individual account my company purchased for me to demonstrate the service before making an org-wide purchasing decision. Not a good look. No support path it seems. No response from support email.
not sure if its related but if logging in via API, No access on this. however via ChatGPT I have access, are API Platform Users Locked out?
I did the verification, I'm on the pro plan, and my
codex execresponses are still showing 5.2 even though I pass-m 'gpt-5.3-codex'I did the verification, on Pro plan, and I'm getting 5.2 as well!!!
@octal-crypto Just to clarify: this is a deliberate decision, so that the model cannot be switched using parameters and similar methods. Otherwise, malicious actors could easily exploit it. The detection is actually supposed to be displayed visually, but this has not yet happened because GPT-5.3 Codex was probably released quickly due to Opus 4.6 before all security preparations had been completed. As a result, the filter for malicious activity has been far too broad so far, affecting approximately 9% of users. They are working on a solution - https://x.com/embirico/status/2021423181580718146 (they know that it still exists)
I posted a script here with a one-liner that can be used to check whether you are affected by the problem:
https://github.com/openai/codex/issues/11189#issuecomment-3887544272
This affects both verified users and those without verification at present.
How can we get our gpt 5.3 codex then? The difference between gpt 5.2 and 5.3 is SO obvious now
@abebeos i beg then! 😈
The team is working hard to address this issue. We're not ignoring you. I know this is frustrating for those who are affected. I'll post more details when I have them. Thanks for your patience.
@abebeos begging did work 😁
Warning! Do not give them your ID . The ID verification Company that they are using , called Persona , has the same Co-Founder as Palantir
If you experienced a downgrade from
gpt-5.3-codextogpt-5.2despite completing Trusted Access verification, access togpt-5.3-codexshould now be restored. This fix took longer than expected. The team needed to work through some deployment issues over the past day. The fix is now rolling out across our clusters.If you’ve completed Trusted Access verification and are still seeing a downgrade, please open a new bug report and provide details. Likewise, if you're having trouble with the verification process, please open a bug report.
This issue is related to new cybersecurity safeguards we’re implementing for
gpt-5.3-codexand future models. We’ve published additional documentation explaining these safeguards and why they’re necessary.We’re also rolling out client updates that provide clear messaging when a downgrade occurs. The latest CLI release (v0.102.0) includes this notification. Updated versions of the Codex IDE extension and app will be available shortly with the same messaging. The notification links directly to the new documentation and verification instructions.
We recognize that this rollout caused frustration. We’ll learn from this and aim for smoother releases going forward. Thank you for your patience while we worked through this.
So we must complete the Trusted Access verification???
Boy oh boy.... this is frustrating. I have been verified and I am on a pro plan and still getting rerouted.... I'm unaware if I've been downgraded and secretly rerouted this whole time or not.
I guess I'm cancelling my Pro subscription and switching to Claude Code for good now!
I suggest others do the same. It's just not worth it if the ux and dx is unreliable, And worse, they secretly route you to another model.. Definitely not happy that they're using a Palantir-backed ID verification system, I thought verifying myself would fix it, but clearly not.
I get there are outages. I get that having such a complex infrastructure up and running and having things working perfectly is unrealistic! But re-routing users who are the top 1% of your revenue stream for paid subscribers, and not notifying them is just unacceptable, Regardless of how many users you have, which wouldn't be many that are affected, you can send them an email. You can send them a notification. There are various methods....
Forcing your users to submit their government-issued ID is absurd...
Imagine if Microsoft was like "we think you're being naughty, so we downgraded your computer to Windows Vista without notifying you" 🤔
Why should I have to give my ID to OpenAI in order to use a model included with my subscription to tweak a video game's code that I made? This is dumb, this is really really dumb. I want OpenAI to be successful but they continuously make anti consumer business decisions then try and make up for them after they piss everyone off.
@etraut-openai any plans for some kind of compensation for this mess? Some people lost precious hours or even days of work because of this, while it wasn't even advertised broadly as ongoing issue and while at the same time OpenAI staff was bragging about how cool and great 5.3-Codex is on social media... Yes, as you obviously know, 5.2 vs 5.3 Codex is a massive difference. And not being informed about that routing upfront sucks and created lots of trust issues I think. The time (days!) it took to solve the issue that was present even for users on the most expensive ($200 Pro) plan doesn't help too. I would say at least resetting usage limits would be a good move but I think most people didn't use much of those since knowing they're being re-routed to 5.2. So how about prolonging affected users' Pro plans for some time? I think because of this issue many users (myself included) switched (at least temporarily) to Claude Code and you might want at least pretend to care about that and about wanting to keep them with Pro plans on Codex.
what a fucking joke. openai wants to fall off so hard
I'm getting the message "Your identity couldn't be verified or your account is ineligible at this time. If you think this is a mistake, please contact support."
The tool to verify looks to be the same I've used elsewhere, and it said it verified me. So something is deeply off with my account. @etraut-openai cc'
https://vmfunc.re/blog/persona
Think twice before uploading your ID.
Just make every model 'auto' then, since it's not like we have any say in the matter.
@etraut-openai, is this fixed, BTW? Do we have clear user-facing information, if this happens, or is this still happening in silence?
New script for websocket request.
its too strong for you peasants, not even the censored version lol.
of course, the military and oai who get unlimited uncensored access are not "abusing" it.
this is happening to gpt-5.5 as well btw.