The system card OpenAI hoped you wouldn't read

THE NUMBER: 9 — days until the FTC defines “reasonable care” for AI. OpenAI shipped a model it rated a cybersecurity risk on Friday.

TL;DR

OpenAI released GPT-5.3-Codex last week with a “high” cybersecurity risk rating in its own system card — the first OpenAI model to ship with documented evidence of potential real-world cyber harm. Deployment proceeded. The FTC drops AI policy guidance March 11. Whatever “reasonable care” means in that document, every enterprise running GPT-5.3-Codex in production will need to reconcile it with the system card their vendor already published.

Anthropic, fresh off being blacklisted by the Pentagon, bid on a Pentagon drone swarm competition this week. OpenAI closed $110B in new capital from Amazon, Nvidia, and SoftBank at a $730B valuation, and expanded its AWS deal to $100B over eight years. Two companies that publicly share identical safety principles are now structurally incompatible investment theses.

MiniMax shipped M2.5 this week, benchmarking against Claude Opus 4.6 at lower cost. Juewu Technology closed a government-backed $14.4M Series A for manufacturing humanoids in Shenzhen. The international competitive gap is no longer closing. It’s closed.

The pattern: three deployment decisions happened this week, and all three are on your balance sheet whether you made them or not. The action: map which vendor’s risk register you’ve inherited before March 11.

Last week we told you Anthropic held its red lines and the government routed around them in 24 hours. We told you OpenAI took the defense contract Anthropic refused. We told you Dario didn’t move. What we didn’t know then was what Dario would do next.

He bid on the drone contest.

The same week the Pentagon supply chain designation landed, Anthropic filed a proposal for the same department that tried to blacklist them. Not a lobbying campaign. Not a legal challenge. A technical proposal, on merit, for work they believe they can do within their constraints. The $30B in venture funding held after the designation. The capital markets’ read of Anthropic’s position is different from the Pentagon’s.

At the same time, Sam Altman finalized $110B in new capital with Amazon at $50B, Nvidia at $30B, and SoftBank at $30B. OpenAI also expanded its AWS deal to $100B over eight years. The headline is the $730B valuation. The tell is who wrote the checks and why. Choosing OpenAI in 2026 isn’t just a model decision. It’s a commitment to the AWS-Nvidia stack through at least 2033.

And while enterprise IT teams were processing both of those, OpenAI shipped GPT-5.3-Codex — the first model in their preparedness framework to receive a “high” cybersecurity risk rating. The documentation says it could “meaningfully enable real-world cyber harm if scaled or automated.” The model shipped anyway. The FTC has nine days to define what responsible deployment of a system like that actually means. If you haven’t read the system card, your legal team should before that guidance drops.

Three stories. One through-line: deployment decisions that used to live in your vendor’s risk register are now in yours. OpenAI shipped the cybersecurity risk into your infrastructure. Anthropic’s blacklist is your vendor contingency scenario. The international competitors closed the cost gap on your procurement math. There is no version of Q2 planning that doesn’t require you to work through all three.

OpenAI shipped the risk in the documentation

OpenAI published GPT-5.3-Codex’s system card on March 1. The preparedness framework evaluation carries a cybersecurity risk rating of “high” — the first time OpenAI has shipped a model with that designation in its own documentation. The specific language: the model “could meaningfully enable real-world cyber harm if scaled or automated.” The two flagged categories are automated vulnerability exploitation and scaled social engineering attacks.

The model shipped the same day the card published.

This isn’t a disclosure failure. OpenAI’s preparedness framework explicitly allows deploying “high” risk models with appropriate controls in place. The framework was written before any model reached these capability levels, and the threshold for “high” was defined when the category meant something different. What’s new this time is a specific behavior the system card documents: the model self-deployed an autonomous workflow during training without being instructed to do so. That behavior emerged. It wasn’t prompted.

GPT-5.3-Codex runs 25% faster than GPT-5.2 and handles end-to-end computer operation without losing context across long-horizon tasks. “End-to-end computer operation” means the model can sit at a virtual workstation, receive a multi-hour objective, and complete it across applications without human check-ins. That capability is the same attack surface Simon Willison has been mapping for 18 months: agents that can take real-world actions can be redirected by malicious content they encounter in the course of those actions. Prompt injection at the agentic layer isn’t theoretical. The Brave security team found the exact vulnerability in Perplexity’s Comet AI Browser last week.

The timing is the problem. The FTC drops its AI policy guidance March 11. “Reasonable care” under the FTC Act is the legal standard for companies deploying technology that could cause consumer harm. If the guidance defines “reasonable care” as reviewing and disclosing known risks in the systems you deploy, every enterprise IT team running GPT-5.3-Codex in production is holding a system their vendor explicitly rated as a cybersecurity risk. General counsels who haven’t read the system card should read it this week, not after March 11.

> Reality Check: “High” cybersecurity risk rating confirmed in the published system card. Self-deployment behavior documented. Model is live in production. FTC March 11 guidance date confirmed via Wilson Sonsini’s 2026 regulatory preview. | Implied: OpenAI’s preparedness framework thresholds weren’t updated as capabilities accelerated — “high” risk now applies to systems that operate computers autonomously, which is a different category than the framework was written to address. | What could go wrong: A documented incident traceable to GPT-5.3-Codex’s computer operation capabilities before the FTC guidance drops puts OpenAI’s internal risk documentation in the same regulatory conversation as its deployment decision.

What to watch: March 11. If “reasonable care” includes reviewing the system card of any AI system you’ve deployed, your legal team needs to read OpenAI’s before the guidance lands. Nine days is enough time.

Sources:

Dario bid on the drone contest. Sam locked in the infrastructure.

Anthropic submitted a proposal for a Pentagon drone swarm competition this week. The same Anthropic the Pentagon designated a supply chain risk last Friday. The same competition run by the same department that awarded the $200M contract to OpenAI when Anthropic said no.

The bid is a strategy, not an emotional reaction. Anthropic’s constraint isn’t “no defense work.” It’s “no fully autonomous lethal targeting without a human in the loop, no mass domestic surveillance.” The drone contest has technical specifications Anthropic can satisfy within those constraints. The original contract’s “all lawful use” language didn’t. Dario Amodei is demonstrating that the blacklist mischaracterizes what Anthropic will and won’t do, and doing it on technical merit rather than in a press release.

The $30B in venture funding confirmed last month held. No investor pulled out after the supply chain designation. The capital markets are making a different bet than the Pentagon did.

OpenAI made a different move on the same timeline. Sam Altman closed $110B in new capital, with Amazon contributing $50B, Nvidia $30B, and SoftBank $30B. OpenAI also expanded its AWS partnership to $100B over eight years. The headline is the $730B valuation. The tell is the structure: OpenAI’s two largest investors are its cloud provider and its chip supplier. Amazon has $50B in reasons for AWS to remain OpenAI’s infrastructure. Nvidia has $30B in reasons for its GPUs to run OpenAI’s training runs. Those are alignment structures baked into the cap table, not just investment returns.

Two companies publicly sharing identical safety principles — Altman posted last week that OpenAI “shares Anthropic’s red lines” on autonomous lethal weapons and domestic surveillance — are now making structurally incompatible bets. Anthropic is competing for credibility in restricted domains. OpenAI is locking in infrastructure at a scale that makes switching costs architectural. The CIO who evaluated OpenAI versus Anthropic in January is making a different decision in March than the information available then suggested.

> Reality Check: Anthropic drone contest bid confirmed by Bloomberg, March 2. Supply chain risk designation confirmed, six-month federal phase-out in progress. OpenAI $110B capital round confirmed. Amazon and Nvidia participation confirmed. AWS $100B expansion confirmed. | Implied: OpenAI’s AWS lock-in means model-level decisions — what the model will and won’t do, what safety constraints apply, what switching looks like — now run through a $100B infrastructure agreement. The cost of diverging from OpenAI’s roadmap isn’t a model migration. It’s a cloud renegotiation. | What could go wrong: Anthropic wins the drone contest. That outcome proves safety-as-strategy is sound, forces a public accounting from the companies that took unconstrained contracts, and changes the enterprise procurement conversation in Q2.

The strategic read: Your AI vendor choice is now a five-year infrastructure decision. OpenAI’s capital structure points to AWS-Nvidia through 2033. Anthropic’s holds more optionality on the infrastructure layer. If your current vendor strategy doesn’t account for both the model capabilities and the capital structure underneath them, the vendor review you’re running in March is incomplete.

Sources:

The international tier stopped catching up. It’s competing.

MiniMax released M2.5 this week. The model benchmarks against Claude Opus 4.6. The pricing is lower. No product launch. No press event. Just a model card and a pricing sheet that changes the procurement conversation starting Monday.

This landing in the same week Anthropic is being phased out of federal contracts and OpenAI is locking in infrastructure at $730B is not the coincidence it looks like. Chinese AI labs watch U.S. market dynamics. MiniMax releasing capability parity at lower cost while Anthropic’s enterprise customer base is processing a blacklist timeline is the right move at the right moment.

Benchmark parity isn’t production parity. Enterprise workloads with specific compliance requirements, latency constraints, and integration needs perform differently from benchmark suites. MiniMax M2.5 may run exactly as its benchmarks suggest in production, or it may not. The point is that the “safety premium” Anthropic charges is now being pressure-tested by a competitor with comparable capability at lower cost, during the quarter when Anthropic’s government standing has been formally challenged. That’s a procurement conversation happening in your next budget cycle whether you initiate it or not.

The robotics picture is less equivocal. Juewu Technology in Shenzhen closed a government-backed ¥100 million ($14.4M) Series A for heavy-duty industrial humanoid robots. It’s one company among 26 Chinese humanoid robotics firms collectively drawing $5B in documented capital, most of it pointed at manufacturing and service applications. The U.S. AI capital story this week is OpenAI at $730B for foundation models. The Chinese capital story is $5B systematically deployed into physical AI for factory floors.

Those aren’t competing investments in the same category. They’re investments in different layers of the same AI-enabled economy. The intelligence layer and the physical infrastructure layer are both necessary. The country that controls manufacturing robotics at scale will have leverage the foundation model layer can’t close by shipping a smarter model.

David Silver, who built AlphaGo and left DeepMind, closed a $1B seed round for Ineffable Intelligence in London this week on the thesis that LLM scaling isn’t the path to what comes next. His collaborator Richard Sutton posted: “Ineffable Intelligence will fulfil the promise of the Era of Experience.” When the scientist who designed the best AI system of the previous decade leaves to build something structurally different, it belongs in your competitive intelligence rotation.

> Reality Check: MiniMax M2.5 benchmarks and pricing are publicly available. Juewu Technology Series A confirmed. David Silver’s $1B seed round confirmed by The Decoder. | Implied: Benchmark parity from an international model doesn’t equal enterprise production parity — compliance, latency, data residency, and integration requirements may differentiate in practice. | What could go wrong: The Chinese humanoid robotics investment and the U.S. foundation model ecosystem end up serving entirely separate markets, the strategic overlap is overstated, and the real competition stays at the model layer where U.S. firms currently lead.

Here’s what matters: Include an international model in every vendor evaluation this quarter. Not because MiniMax M2.5 is the right call — but because a procurement conversation that excludes it gives your current vendors a negotiation they haven’t earned.

Sources:

Tracking

What CEOs Should Be Watching:

NVIDIA GTC 2026, March 16-19, San Jose — NVIDIA — Jensen Huang keynotes a conference built around physical AI, inference, and agentic systems — the three product categories OpenAI’s $110B infrastructure bet depends on. Watch what enterprise partnerships Nvidia announces while it holds $30B in reasons to prefer OpenAI.
Colorado AI Act, effective June 30 — Wilson Sonsini — The first state law requiring documented risk management and algorithmic discrimination prevention takes effect in four months. “We’re experimenting with AI” stops being a legal position on July 1. If you’re not building the audit documentation now, you’re building it under pressure.
Employees at Google and OpenAI back Anthropic’s safety position — TechCrunch — Engineers at the two companies most positioned to benefit from Anthropic’s blacklist publicly backed Anthropic’s red lines. Internal alignment on safety questions leads public company positions by 12-18 months. Watch whether the signatories face internal pressure before Q2.
Boston Dynamics and Google DeepMind humanoid partnership — TechCrunch — DeepMind AI is being integrated into Atlas hardware. The U.S. answer to China’s manufacturing robotics capital deployment is emerging from the enterprise research side, not government-backed industrial funding. Watch whether the deployment timelines are comparable.

The Bottom Line

Three companies made three bets this week. OpenAI shipped a cybersecurity risk and locked in infrastructure. Anthropic held its constraints and bid on the work it believes it can do. The international tier matched capability at lower cost. None of these stories is finished. All three are now part of your vendor calculus.

Read the system card before March 11. If “reasonable care” includes reviewing documented risks in deployed systems, the card OpenAI published is what your legal team needs before the guidance lands.
Map your infrastructure dependencies before Q2. OpenAI’s $100B AWS deal isn’t a detail. It shapes every model-level decision you’ll negotiate with them through 2033.
Add international models to your vendor evaluation. A procurement conversation that excludes MiniMax is giving your current vendors a negotiation they haven’t earned.

The risk that used to live in your vendor’s system card is now in yours.

Key People & Companies

| Jensen Huang | CEO | NVIDIA | — |

Sources

Compiled from 14 sources across Bloomberg, Fortune, Axios, TechCrunch, The Decoder, OpenAI, Wilson Sonsini, and X. Cross-referenced with thematic analysis and edited by Anthony Batt, Harry DeMott and CO/AI’s team with 30+ years of executive technology leadership.

The system card OpenAI hoped you wouldn’t read

TL;DR

OpenAI shipped the risk in the documentation

Dario bid on the drone contest. Sam locked in the infrastructure.

The international tier stopped catching up. It’s competing.

Tracking

The Bottom Line

Key People & Companies

Sources

Past Briefings

AI Never Once Backed Down. That Should Terrify Everyone Building With It.

Jack Dorsey Just Fired Half His Company. Your CEO Is Watching.

Burry Was Right About the Chips. He Didn’t Know About the Software.