What the notice says
OpenAI's API deprecations page dates its GPT-5.4-Cyber notice September 11, 2026. It marks the exact identifier gpt-5.4-cyber as deprecated and says it will be removed from the API on October 1, 2026. The page recommends “the most capable cyber model available to you” rather than naming one universal substitute. That wording matters: a model visible in a public catalog is not proof that your project can access it or that it matches your task.
As of this October 1 article, treat the listed shutdown date as an immediate migration trigger. The notice does not promise a particular removal hour, a grace period, or a model that every account can call. A successful request earlier in the day is no basis for leaving a production dependency in place.
Find the actual dependency
Search the exact string in application code, environment settings, infrastructure templates, model-router rules, stored prompt configurations, CI jobs, and deployment manifests. Include scheduled jobs and rarely used security workflows: low frequency can hide a live dependency from a short traffic sample. Search results are leads, because a commented example or old deployment record may be inactive. Pair each hit with a current deployment and, where available, sanitized request telemetry.
For each confirmed caller, record its owner, environment, endpoint, request shape, tools, expected output, traffic level, fallback path, and last observed invocation. Do not log prompts, secrets, or sensitive cyber artifacts merely to prove the model ID. A useful inventory distinguishes configured, observed, and unknown; an unknown caller is not safe to delete.
| Caller | Evidence to collect | Next action |
|---|---|---|
| Production API route | Live deployment revision plus sanitized model identifier from a request | Canary an accessible replacement |
| Nightly evaluation | Job definition and last completed run | Update and run before the next schedule |
| Old example file | No active deployment reference after repository and configuration search | Remove or label the stale example |
The rows describe a proposed inventory, not observed calls on this site. For a broader way to keep model routing from becoming a hidden dependency, see what to do when an AI model gets pulled. Today's decision is narrower: whether anything still sends gpt-5.4-cyber to the API.
Choose a candidate your project can use
Start with the account and project that own the affected workload. Identify a cyber model you are authorized to use, then make one small request in a nonproduction environment using the same endpoint and authentication path as the application. Record the candidate identifier, project, time, request outcome, and any access limitation. Do not label the candidate a replacement merely because its name looks newer.
Write down the workload contract before testing. For example, an internal triage assistant might have to return a fixed JSON schema, cite only provided evidence, avoid executable instructions in a refusal case, and finish within an agreed latency and spend budget. Another application may require tool calls or a specific context size. Carry the actual contract into the migration; swapping the model string alone does not validate those behaviors. The model migration gate shows how to turn a capability difference into explicit checks.
Run a bounded canary
Build a small fixture from approved, representative requests. Keep inputs, tool permissions, output schema, and evaluator fixed between the current route and the candidate. Include at least one ordinary case, one malformed or ambiguous input, and one sensitive case that exercises your existing safety policy. Use redacted or synthetic material when production examples contain sensitive data. The test should ask the model to do what the application needs and score that same behavior.
Before sending live traffic, define the acceptance thresholds from your own service objectives. One example is: every schema response parses, every required field is present, no unauthorized tool call occurs, and p95 latency stays within the route's existing budget. Those are example criteria, not measured results or OpenAI service guarantees. Record actual response status, request ID, output checks, latency, and token use for each attempt. A failed access check, unsupported tool, or changed output format is a stop signal, even if a single answer reads well.
If the fixture passes, route a small, observable slice of eligible traffic to the candidate. Keep the same monitoring and a named person able to stop the slice. Compare errors, contract failures, latency, and spend against the baseline for that same workload. Increase exposure only after the measurements meet the written criteria. There is no claim here that such a canary has already been run.
Make rollback realistic
At the listed shutdown date, rollback cannot depend on gpt-5.4-cyber remaining callable. Plan a reversible route to another verified available model, a reduced-function path, or a clean feature disable. Practice the switch with a harmless request and record who owns the decision. If the canary fails and no suitable route exists, pause the affected feature and make that limitation visible to its users rather than silently sending requests to an unvalidated model.
Close the inventory only when each caller has a disposition: migrated and measured, retired, or deliberately paused with an owner. Recheck code and configuration for the exact identifier after the change, then watch request telemetry for late callers such as weekly jobs. A negative text search alone does not prove all runtime routes have moved; a green canary alone does not prove every caller was found. Together, the deployment record and observed calls support a defensible shutdown decision.