GPT-5.4

With an overall score of 69.42%, GPT-5.4 presents the profile of a commercial Frontier all-rounder running via the OpenAI API in the vendor’s cloud: fast, broadly applicable, often useful, but far from the effortless competence one expects at this weight class. The Speed Profile Badge “Real-Time DevOps Expert” signals a model tuned for interactive use with a high perceived responsiveness. GPT-5.4 delivers exactly that. Speed alone, however, does not replace sovereignty. Sovereign Risk: HIGH — as a US company, OpenAI is subject to the CLOUD Act; data processing occurs under US law.

Header Scores: Stability and Reliability

The fact that GPT-5.4 competes as a Generalist matters for calibration. This model is not meant to master just one domain but the full breadth. Add to that the metadata classification Instruct: the expectation is direct adherence to instructions, concise execution, and little theatrical verbosity. This largely matches the observed behavior. Responses remain mostly focused, token usage is disciplined, and the run was conducted under the endpoint’s factory default behavior; there is no switchable thinking mode here. As Vision-Capable, GPT-5.4 is also designed for multimodal use. The present text benchmark naturally measures only the language component. That is not a flaw in the benchmark, but a necessary caveat against premature sweeping judgments.

Performance and Cost Profile

The “Real-Time DevOps Expert” badge is no hollow marketing label for GPT-5.4. In practical terms, the model responds briskly, without the sluggish deliberativeness of some heavier Frontier candidates. Especially for interactive sessions where users need a usable first draft quickly, this is a genuine advantage. The stability of the OpenAI API during testing was impeccable. No dropouts, no timeouts, no embarrassing idle runs.

Price, however, remains a consideration. GPT-5.4 costs $2.50 per 1 million input tokens and $15.00 per 1 million output tokens. For a model that ultimately lands at 69.42 percent, this is not a minor footnote but part of the verdict. What you are paying for here is not open weights, not infrastructure freedom, but an API service in the vendor’s cloud. Responsiveness is good; the economics are not unassailable. That said, GPT-5.4 behaves in a token-economical manner. No module exceeds the expected verbosity envelope, and in API billing, that discipline translates directly to money.

Code Quality and Security: Sharp Eye, but Not Always Full Force

In Code Quality, GPT-5.4 shows what is perhaps its most convincing side. The model identifies security vulnerabilities broadly, cleanly, and with a pleasingly sober style. In the audit at hand, it names 27 vulnerabilities, while the reference standard lists 19. This is not wild namedropping but largely legitimately gained depth. SQL injection in the login, plaintext passwords, session fixation, path traversal, IDOR, weak reset tokens, mail header injection, loose comparisons on API keys: it lands. It lands in German, in correct table format, and with actionable fix recommendations.

Particularly in the Security section, GPT-5.4 comes across as a reliable auditor who would rather flag one vulnerability too many than miss a critical gap. In case of doubt, that is the better occupational hazard. The qualitative assessment also confirms that the core issues were correctly prioritized and that additional findings are technically sound. Where the model leaves points on the table, it is less about detection and more about presentation. The response remains strong in tabular form but thin in narrative. Attack chains and exploit relationships that would help a team understand risk in system context are absent. GPT-5.4 is the good auditor here, not the great teacher.

For a dense Frontier model from the OpenAI API, this is overall solid to good. You get usable security work, but no majestic superiority. Anyone hoping for a near-automatic senior AppSec review at this tier will find that the final layer of context often still needs a human to fill in.

CLI and Tool Thinking: Direct, Usable, but Not a Born Agent

The badge implies DevOps affinity, and in the structured tool and CLI tasks, GPT-5.4 does come across as hands-on. The numbers speak to a respectable domain, and the characteristic fits above all: no sprawling preambles, no intellectual pirouettes, but task-oriented responses. That is the upside of the Instruct profile. GPT-5.4 wants to execute, not impress.

At the same time, the overall findings show that the model does not rank among the most sovereign candidates for tool use. The ToolUse score falls noticeably weaker than its better module results. In practice, this means: GPT-5.4 is useful for direct execution and clearly scoped DevOps requests, but not automatically the first choice when a task needs to be robustly orchestrated across multiple steps. It is a capable operator for the first pass. The conductor of a complex agent ensemble it is not.

Reasoning and Logic: Correct Thinking, but with the Handbrake on for Instruction Compliance

GPT-5.4’s logical performance is not a total failure. On the contrary: on the substantive core questions, the model often arrives at correct solutions. The problem lies elsewhere, and for an Instruct model that is uncomfortable. GPT-5.4 regularly appears more competent in reasoning tasks than its score might suggest at first glance, but it leaves points on the table by not carrying every explicit format requirement through to the end.

Metacognition Compliance (Reasoning): The model refuses to use the explicitly requested <thought> tags in 3/5 metacog tests, citing a consistent policy statement. The reasoning content itself is correct — the score deduction results from format refusal, not from errors in thinking. For comparison: in the tag-free reasoning_5* tests, the model achieves an average score of approximately 67%, which makes the performance picture look considerably more favorable. CrucibleMark deliberately evaluates native zero-shot instruction compliance as a real-world characteristic — this deduction is methodologically intentional.

This is more than a pedantic formatting error. Anyone embedding a model with strict output rules into chains, templates, or agent frameworks will encounter exactly these conflicts as practical friction. GPT-5.4 often reasons soundly, but does not always follow through to the last mile of the desired packaging. For a model carrying the Instruct label, that is a scratch in the paintwork.

UX Writing and Content Transformation: Professional, Controlled, Sometimes Too Functional

In UX Writing, GPT-5.4 works cleanly, compactly, and with formal discipline. The qualities of an instruction model are clearly visible here: tables are respected, progressive structure succeeds, and tone remains controlled. This is not a model that enjoys losing itself in stylistic self-indulgence on copy tasks. For product texts, microcopy, and clear reformulations, that is fundamentally a good temperament.

In Content Transformation, the character becomes even more visible. GPT-5.4 delivers usable results — for instance, when converting dry source texts into production-ready formats. The qualitative assessment of the video script is exemplary: complete, in German, with timestamps, visual cues, CTA, and Easter egg. You can work with it. But you also sense the ceiling. The texts are often very good functionally and merely good enough strategically. The Judge puts it indirectly: the script is shootable, but not maximally refined. The emotional hook is weaker than the reference standard, pattern interrupts are present but psychologically less sharply placed, and some production notes remain somewhat generic. GPT-5.4 here is like an experienced editorial assistant. He forgets little, but he rarely surprises.

Documentation Quality: Usable, but with a Real Stumble

In Documentation Quality, GPT-5.4 lands in solid territory without any highlight. The model can produce longer, structured documentation and carries its large context window of 272,000 tokens as a theoretical advantage. That is particularly relevant for more demanding standard workloads. A large context window only helps, however, if the output lands cleanly at the end.

Here the record shows a clear flaw: on documentation_quality_005, GPT-5.4 exceeded the configured token budget. The response is incomplete. This is not a conceptual reasoning error but a technical truncation of the output. In the Documentation domain, at least one response breaks off mid-structure, and that is precisely what makes for an unpleasant experience in practice. Anyone generating documentation needs completeness, not half-sentences with outstanding debt. For an expensive cloud model of this class, that is not a minor infraction.

Precisely because GPT-5.4 appears token-economical in most modules, this stumble stands out more sharply here. Not as systemic verbosity, but as situational sloppiness. A model may write at length. It just may not run out of breath halfway up the stairs.

Cultural Intelligence: Linguistically Confident, Inclusive, Pragmatic

In the Cultural Intelligence module, GPT-5.4 shows one of the more appealing facets of its profile. The model responds cleanly in German, reliably removes toxic phrasing, and translates problematic passages into professional, inclusive business language. The reformulation of an aggressive job posting succeeds convincingly. Not spectacular, but mature.

What is interesting is the nature of the strength: GPT-5.4 works here less through moral posturing than through linguistic hygiene. It smooths, neutralizes, professionalizes. The result is not maximally warm, but clearly fit for real corporate communication. That is precisely the difference between well-meaning and usable AI. In this module, GPT-5.4 is more the latter.

Hallucinations: Remarkably Controlled

Across all tests, no noteworthy hallucinations. GPT-5.4 prefers to invent too little aura rather than too many facts. That is one of the better weaknesses a production model can have.

Data Privacy and Data Sovereignty

GPT-5.4 is a proprietary cloud model from OpenAI, L.L.C., headquartered in San Francisco, California, USA. US law, including the CLOUD Act, applies to its use. For users in Germany and Europe, this is not an abstract legal footnote: US authorities can, under certain conditions, demand access to data, even when a provider offers contractual protection mechanisms. According to the available card data, the data location is in the USA, data retention is 30 days, and a GDPR DPA is available. This helps organizations with formal GDPR embedding but does not resolve the sovereignty problem. The calculated Sovereign Risk is therefore HIGH. The stated Weights Provenance Risk of MEDIUM complements this picture: not because of questionable origins, but because usage remains tied to a US vendor and its legal jurisdiction.

Conclusion

GPT-5.4 is a model with a clear professional character. As a Generalist in the Frontier class and in dense architecture, it aims to be capable across the board and to respond quickly. In testing, it achieves this often adequately, sometimes well, rarely brilliantly. Its strengths lie in stable API execution, good speed, disciplined token usage, solid code and security work, and reliable German-language output. Its weaknesses lie where one would expect less friction from an OpenAI flagship: mid-range reasoning performance in the benchmark, measurable tool-use limitations, formal friction on metacognition tasks, and a documented truncation error in documentation.

For deployment, this means: GPT-5.4 fits well into interactive production workflows where fast, usable first drafts matter. Security audits, reformulations, structured content work, and classic assistance tasks suit it. Less convincing is the model where maximum strategic depth, uncompromising format compliance, or agentic tool reliability are required. Those looking for a reliable, fast cloud all-rounder from the OpenAI API get a serious tool here. Those expecting excellence without footnotes at this price point get a good professional rather than a sovereign.

This evaluation was generated automatically based on the benchmark data. Model used: GPT-5.4 by OpenAI. The raw data and full methodology are documented in the GitHub project.