OpenAI previews Codex Security
In a month-long beta, the tool scanned 1.2 million commits across open-source repositories and flagged 792 critical and over 10,000 high-severity issues, including 14 logged CVEs.
- Security & misuse
- Minor
OpenAI opened Codex Security, an agentic tool for finding and proposing fixes for software vulnerabilities, to a research preview in March 2026, offering free access for the first month to ChatGPT Pro, Enterprise, Business and Edu customers through Codex’s web interface. The tool followed OpenAI’s earlier vulnerability-discovery agent, Aardvark, unveiled in October 2025.
Rather than scanning for known patterns, Codex Security is built to work through three stages: analysing a connected GitHub repository to build a codebase-specific threat model, using an OpenAI model to reason about plausible attack paths and validate candidate vulnerabilities in an isolated sandbox to rule out false positives, and proposing patches for human review, ranked by estimated severity and real-world impact. OpenAI said the approach reduced false positives by more than half compared with earlier scanning methods.
During the tool’s beta period, The Hacker News reported, OpenAI said Codex Security had scanned roughly 1.2 million commits across external open-source repositories, surfacing 792 critical and 10,561 high-severity findings, and had contributed to 14 vulnerabilities serious enough to be assigned CVE identifiers in projects including GnuPG, GnuTLS, OpenSSH and Chromium. The research preview arrived within days of OpenAI’s separate announcement that it would acquire the AI red-teaming firm Promptfoo, part of a wider push by the company into automated security tooling for both its own agents and the wider software industry.