GPT-5.1-Codex-Max Evaluation Results

METR, an independent evaluator, tested OpenAI's GPT-5.1-Codex-Max before release against two threat models it treats as precursors to AI takeover risk (metr.org). The first is AI R&D automation, meaning AI that speeds up AI researchers more than tenfold; the second is rogue replication, meaning AI that can acquire, keep and defend the resources it needs to run independently of humans and evade shutdown. Its conclusion is that the model is a low-risk, incremental improvement, and that if trends hold, further development over the next six months would also be low risk for these two threats.

The main evidence is METR's time horizon metric: the length of task, measured by how long it takes a skilled human, at which an AI agent succeeds half the time. It is fitted across 170 software and AI research tasks drawn from three suites (HCAST, RE-Bench and SWAA). GPT-5.1-Codex-Max scored a point estimate of 2 hours 42 minutes, with a 95% confidence interval from 75 minutes to 5 hours 50 minutes, up from GPT-5's 2 hours 17 minutes and between METR's 7-month and 4-month doubling-time trends. Its 80% horizon was about 30 minutes, against 26 for GPT-5. METR checked several ways it might be underestimating the model. A monitor flagged 27 of 385 runs as possible reward hacking (cheating to make a task look solved); 14 were confirmed and scored as failures, and counting them as successes would give 3 hours 50 minutes. Dropping 7 tasks found to be broken raised the estimate to 3 hours 28 minutes. OpenAI's own Codex scaffold did worse than METR's, below an hour. On two hand-scored projects estimated to take a skilled programmer more than 20 hours, it failed all five attempts at each, as GPT-5 had.

To look ahead, METR projected the trend aggressively and got a worst-case 50% horizon of 13 hours 25 minutes by April 2026, with most methods staying below 20 hours. It argues that is still short of what either threat needs, because agents tend to do worse in messy real-world settings than on benchmarks, and a tenfold research speed-up would require near-total automation, given that reviewing AI-written code likely takes more than a tenth of the time writing it would. On whether the model hid its abilities, METR reviewed 81 transcripts with visible reasoning and found no sign of sandbagging (deliberate underperformance); the monitor it used had caught 79% of artificial sandbagging examples in its MALT dataset, METR's labeled collection of such behaviors.

Two limits matter for how much weight this carries. Several robustness checks rest on assurances from OpenAI, for example that capabilities were not suppressed and that there was no direct training pressure on the model to hide its reasoning, which METR did not independently verify. And the work was done under NDA, with OpenAI's comms and legal team reviewing the post; METR says it changed no conclusions, but notes OpenAI could legally have blocked risk conclusions based on non-public information, so the report should not be read as robust formal oversight. METR also did not assess alignment, misuse, chemical, biological, radiological and nuclear risks or lab sabotage here.