gpt-5.4-cyber sunset: removed from the API on 2026-10-01
On 2026-09-11 OpenAI added a GPT-5.4-Cyber section to its API deprecations page: gpt-5.4-cyber is deprecated from the moment it was announced and is removed from the API on 2026-10-01, and the replacement it names is gpt-5.6-cyber. Announcement day and shutdown day are two different days - do not merge them into one. This page answers four things only: which id is going away, which id replaces it, which single field you edit, and how to verify after the edit.
Updated 2026-09-20
Four key points
shutdown date in the table
The entry is a single sentence: 'The gpt-5.4-cyber model is deprecated and will be removed from the API on October 1, 2026' - gone from the API on 2026-10-01, with the same entry naming gpt-5.6-cyber.
announcement day, not shutdown day
The section is headed '2026-09-11: GPT-5.4-Cyber'. By that page's own definition deprecation starts at announcement, but access actually stops on the shutdown date 2026-10-01. The two days are 20 apart (our subtraction; OpenAI states no notice window for this entry).
the replacement id OpenAI names
The second half reads 'Migrate to gpt-5.6-cyber before the shutdown date', and the table row pairs Oct 1, 2026 with those two ids. No alias, no grace period, no step-by-step migration guide is mentioned anywhere.
the one thing you edit
This page's wording, not an OpenAI procedure: set model from gpt-5.4-cyber to gpt-5.6-cyber, leave the other parameters alone, and prove it with one minimal request before you move real traffic.
What this is
The cyber line turns over fast. OpenAI's own news feed says GPT-5.4-Cyber was put in front of vetted defenders on 2026-04-14, and that GPT-5.6-Cyber arrived on 2026-08-10 as the model offered through Daybreak Red for authorized vulnerability research, exploit validation and security testing. When the newer entry lands, the older one goes onto the deprecations table. That table defines its own terms: announcing deprecation makes a model deprecated immediately, every deprecated model or endpoint gets a shut down date, and at that point it is no longer accessible - here that day is 2026-10-01. So the question is not which model is better; it is the day one value in your request starts erroring.
What happened
2026-09-11: the OpenAI API deprecations page gained a GPT-5.4-Cyber entry carrying three facts in one sentence - gpt-5.4-cyber is deprecated, it is removed from the API on 2026-10-01, migrate to gpt-5.6-cyber. There is no separate runbook, no alias and no extension notice. Our environment gets HTTP 403 from developers.openai.com, so this page transcribes a Wayback snapshot dated 2026-09-20; the snapshot link and timestamp are in the sources block.
Timeline
2026-04-14: OpenAI's news feed announces Trusted Access for Cyber with gpt-5.4-cyber placed in front of vetted defenders.
2026-09-11: the API deprecations page adds this entry, so gpt-5.4-cyber counts as deprecated from that day, removal 2026-10-01, replacement gpt-5.6-cyber.
2026-10-01: gpt-5.4-cyber leaves the API and all traffic should land on gpt-5.6-cyber; this page was last checked 2026-09-20.
Confirmed vs caution
Officially confirmed
The table entry states four things: section date 2026-09-11, subject gpt-5.4-cyber, shutdown 2026-10-01, replacement gpt-5.6-cyber. The same page defines the process - deprecation applies from announcement, everything deprecated gets a shut down date, access ends at that date. The scope is the OpenAI API, and this page works from the snapshot taken 2026-09-20.
⚠️ Caution
Do not treat three things as official. 1) The same page gives 'At least 3 months' for specialized variants of generally available models, but it never files gpt-5.4-cyber in a category, and this entry runs from the 2026-09-11 announcement to the 2026-10-01 removal - 20 days (our subtraction). Use the general policy neither to predict an extension nor to claim a breach. 2) Whether vetted access carries over to gpt-5.6-cyber, and what its limits are, is not in this entry; confirm through the OpenAI channel. 3) Talk of a delay or a second replacement candidate is rumour: until the table is edited, work to 2026-10-01.
Same vs differs
Same
In the official wording both are the same kind of thing: OpenAI cyber-specific entries, announced in the vetted-and-authorised context of Trusted Access for Cyber and Daybreak rather than as ordinary self-serve models, and moving between them changes neither your base URL nor your SDK. Whether they are equivalent in capability or parameters is not stated.
Differs
The difference is the whole reason this page exists: gpt-5.4-cyber carries a 2026-10-01 removal date and is no longer accessible after it, while gpt-5.6-cyber is the entry OpenAI points at. The direction is one-way - no read-only window for the old id and no automatic forwarding are documented.
What to do
Step 1, find the surface area: grep gpt-5.4-cyber across your repositories, CI smoke tests, gateway or proxy model-mapping tables and SDK defaults. The obvious call site is the one nobody forgets. Step 2, change model only: set it to gpt-5.6-cyber and keep everything else as it was. OpenAI does not claim the two are equal in capability, limits or filtering, so do not retune sampling and do not assume an identical response shape. Step 3, verify before 2026-10-01: send one minimal non-streaming request, expect HTTP 200 and a model field echoing the new id, then run a small share of live traffic for a day and watch error rate and latency before going all the way. Step 4, put 2026-10-01 in the on-call calendar and in an alert: the announcement day is not the shutdown day, and the old id will not stay behind as a fallback. Steps 2 to 4 are this page's ordering - OpenAI's text is the single 'Migrate to' sentence.
On QCode
Plainly: QCode's model list has no gpt-5.4-cyber. Checked 2026-09-20 - we do not sell that id, so there is nothing for us to migrate on your behalf. gpt-5.6-cyber is listed and priced in the catalog, but it took 0 priced requests over the last 30 days, so we have no usage evidence to quote either. Decide by running the four steps above yourself; its unit price and limits come from /pricing and the live catalog, not from this page.
FAQ
On what day does gpt-5.4-cyber stop working?
The deprecations page gives 2026-10-01 as the removal date and heads the entry 2026-09-11. By that page's definition the model is deprecated from the announcement, but requests actually stop on 2026-10-01.
Which replacement does OpenAI name?
One: gpt-5.6-cyber. The row reads 'Migrate to gpt-5.6-cyber before the shutdown date' and offers no second candidate.
Is changing model really enough?
OpenAI only says to migrate, with no runbook. The minimal change this page suggests is swapping gpt-5.4-cyber for gpt-5.6-cyber in the model field; limits, content filtering and tool behaviour may differ, so run your own task before routing real traffic.
Could the date slip?
The page says nothing about an extension and lists no grace window. Until the table is edited, treat 2026-10-01 as hard.
Where does QCode stand on these two ids?
QCode's list has no gpt-5.4-cyber. gpt-5.6-cyber is listed, but with 0 priced requests over the last 30 days (checked 2026-09-20) there is no usage record behind it here.
Is this the same event as the Copilot retirement?
No. This entry covers one id on the OpenAI API. Model names inside ChatGPT, Copilot or Azure have their own lifecycles and their own dates, which this page does not merge in, and that side is outside what this entry says.
Sources
OpenAI, 'Deprecations' (API docs), entry '2026-09-11: GPT-5.4-Cyber': 'The gpt-5.4-cyber model is deprecated and will be removed from the API on October 1, 2026. Migrate to gpt-5.6-cyber before the shutdown date.' - the table row pairs Oct 1, 2026 with gpt-5.4-cyber -> gpt-5.6-cyber. A direct request from our environment to https://developers.openai.com/api/docs/deprecations returns 403, so this page cites the Wayback snapshot https://web.archive.org/web/20260920011745/https://developers.openai.com/api/docs/deprecations (2026-09-20 01:17:45 UTC). The definitions used here - deprecation from announcement, a shut down date, no access afterwards, 'At least 3 months' for specialized variants - also come from the same snapshot cited above. The introductions of gpt-5.4-cyber (2026-04-14) and gpt-5.6-cyber (2026-08-10, Daybreak Red) come from the OpenAI News RSS at https://openai.com/news/rss.xml (fetched 2026-09-20). QCode catalog status and 30-day priced volume are our own check of 2026-09-20.
Edit that line before 2026-10-01
QCode does not offer gpt-5.4-cyber. gpt-5.6-cyber is listed on QCode (checked 2026-09-20, 0 priced requests in the last 30 days); price and limits come from /pricing.
Related
GPT-5.6-Cyber guide: what Daybreak Red is, who can apply
Where the successor's access rules and pricing angle are explained.
GPT-5.4 leaves Codex: deadline 2026-08-31
The same generation retiring on a different surface, a date already past.
gpt-3.5-turbo-instruct shuts 2026-09-28
Older Completions-era ids on the same deprecations table.
Not affiliated with OpenAI. The announcement date, removal date, replacement id and policy wording are transcribed from a public snapshot taken 2026-09-20; 'change the model field only' and 'start with a small share of live traffic' are this page's operational advice, not OpenAI procedures. QCode does not offer gpt-5.4-cyber.