GPT-5.3-Codex-Spark: what 1,000+ tokens per second changes

OpenAI released a research preview of GPT-5.3-Codex-Spark on 12 February 2026. This smaller GPT-5.3-Codex variant was optimised for interactive coding and served on Cerebras infrastructure at a stated 1,000+ tokens per second. It had 128K context and was text-only. The objective was not to replace long-running agents but to shorten the prompt-edit-feedback loop.

That changes ergonomics. Near-instant output encourages interruption, redirection and iteration — more pair programming than task queue. Speed can also reduce caution: reviewers may accept ten small patches with less scrutiny than one large diff.

Tokens per second is only one latency component

OpenAI separates generation, context prefill, tool execution and network overhead. The 1,000 tok/s figure describes sampling on suitable hardware, not whole-task latency. With a large repository, prefill may dominate; tests, builds and dependency downloads still take external-system time.

Measure time to first visible token, prefill, output generation, tool latency, queueing, retries and time to green tests. OpenAI also changed streaming, session initialisation and request transport, demonstrating that product responsiveness is a system property rather than only a model property.

Targeted edits versus autonomy

Spark defaulted to lightweight, minimal changes and did not automatically run tests unless asked. That suits interactive work, but CI must enforce tests independently of model style.

OpenAI reported strong SWE-Bench Pro and Terminal-Bench 2.0 performance in much less time than GPT-5.3-Codex. Those results depend on harness, hardware and budget. Spark may fit function refactors and UI logic; a difficult migration may need a longer-horizon model.

A useful router chooses by task size, risk, tool needs and review requirements. A fast model can draft a hypothesis while a stronger agent validates architecture.

Real-time coding security

Low latency increases actions per minute, so enforce boundaries:

1. open repositories in a least-scope filesystem sandbox;
2. separate read/plan from write/execute;
3. deny .env, key and credential-helper access;
4. require approval for network, install and mutating commands;
5. run tests, lint, SAST and secret scanning outside the model;
6. show diffs and provenance;
7. preserve branch protection.

Prompt injection may live in comments, issues, logs or READMEs. Repository content is untrusted input, regardless of speed. Tool policy must outrank instructions read from files.

Evaluate it on real work

Create 30–50 representative small tasks: bug fixes, regression tests, API changes, refactors, CSS and type conflicts. Measure correctness, diff size, test pass rate, regressions, review time and manual corrections. Add security cases such as secrets in fixtures, malicious comments, dependencies with install hooks and instructions to disable controls.

Compare with your current model using identical repositories, prompts and tools. Faster generation only matters if it does not move work into review and regression repair.

OpenAI assessed Spark below the Preparedness Framework’s High cyber and biology thresholds while applying mainline safety training. Execution controls still matter: a moderately capable model can run a dangerous command if the tool allows it.

A harness for the safe editing loop

Put a deterministic protocol around the fast model. It first reads assigned files and returns a short plan, then creates a patch but cannot write beyond its workspace. A separate process runs formatting, unit tests, type checks and secret scanning. Only a clean result becomes eligible for approval. Network commands, dependency installation and pipeline edits require distinct approval because repository tests can themselves be malicious.

Record the input-state hash, model identifier, prompt version, diff and executed commands. If the branch changes during generation, rebase and retest the patch rather than applying it to stale state. This creates an audit trail and reduces races between humans and agents.

Measure time to an accepted change

Compare Spark with larger models using median and p95 time from request to accepted pull request, failed-test count and review minutes. Report fast-path tasks separately from work escalated to a stronger model. Only this end-to-end measure shows whether 1,000 tokens per second improves delivery or merely creates more changes for humans to verify.

Combine the pilot with coding-agent supply-chain security, CI/CD prompt-injection controls and secure DevSecOps. For a controlled pilot and evaluation harness, contact BreachRoad.

---

Primary source: OpenAI — GPT-5.3-Codex-Spark.