OpenAI launches Codex Security to find, validate, and patch software vulnerabilities

OpenAI has launched Codex Security, a new application security agent that analyzes codebases, validates likely vulnerabilities, and suggests patches. The company says the product is now in research preview and is rolling out through Codex web to ChatGPT Pro, Enterprise, Business, and Edu customers, with free usage for the next month.

OpenAI positions Codex Security as a higher-signal alternative to traditional security tools that often bury teams in low-value alerts. According to the company, the agent builds a project-specific threat model, uses that context to prioritize findings based on real-world impact, and pressure-tests issues in sandboxed environments where possible before surfacing them for review.

That matters because modern security teams now face two problems at once. AI-assisted coding speeds up software development, but it also increases the amount of code that needs review. OpenAI says Codex Security aims to reduce that bottleneck by combining frontier-model reasoning with automated validation and patch suggestions that align with the surrounding system.

What Codex Security does

OpenAI says Codex Security starts by building system context and generating an editable threat model for each repository. That model is meant to capture what the system does, what it trusts, and where it is most exposed. Teams can edit the threat model so the agent stays aligned with their architecture and risk priorities.

From there, the agent searches for vulnerabilities, ranks them by expected impact, and validates high-signal issues in isolated environments. OpenAI says that process helps reduce false positives and can provide stronger evidence for security teams. When a likely vulnerability is confirmed, Codex Security proposes fixes designed to improve security while limiting regressions.

The company also says the product can improve over time using reviewer feedback. If a team changes the criticality of a finding, Codex Security can use that feedback to refine later scans and better match the organization’s own threat model and architecture.

OpenAI’s early results

OpenAI says early beta scans on the same repositories showed a strong drop in alert noise over time. In one case, noise fell by 84% since the initial rollout. The company also says over-reported severity dropped by more than 90%, while false positive rates fell by more than 50% across repositories.

OpenAI also shared broader beta-scale numbers. Over the last 30 days of the beta, Codex Security scanned more than 1.2 million commits across external repositories and identified 792 critical findings plus 10,561 high-severity findings. OpenAI says critical issues appeared in under 0.1% of scanned commits.

Open-source projects already affected

OpenAI says it has used Codex Security to scan open-source projects it depends on and has reported high-impact issues to maintainers. The company named projects including OpenSSH, GnuTLS, GOGS, libssh, PHP, and Chromium, and said 14 CVEs have already been assigned, with dual reporting on two of them.

In the appendix to its announcement, OpenAI listed examples that include multiple GnuTLS flaws, two GOGS issues, and several other vulnerabilities involving path traversal, LDAP injection, denial of service, and mail abuse.

Codex for OSS

OpenAI also announced Codex for Open Source, a program aimed at maintainers of critical open-source software. According to the application page, selected maintainers receive six months of ChatGPT Pro, conditional access to Codex Security, and API credits for project and maintenance work. OpenAI says it has already started onboarding an initial cohort and plans to expand the program in the coming weeks.

Codex Security at a glance

Why this launch matters

The announcement shows where OpenAI wants agentic coding tools to go next. Codex Security is not just a code assistant that flags suspicious patterns. OpenAI says it tries to understand a repository in context, test whether a finding is real, and then move directly toward a fix. That makes it closer to a security workflow tool than a conventional static scanner.

It also signals a bigger push into secure software development. OpenAI has already tied the launch to connected GitHub repositories, reviewable fixes, and open-source maintainer support. For engineering teams, the real test will be whether the early beta improvements in noise reduction and validation quality hold up as access expands beyond the initial cohort. That expectation is an inference from OpenAI’s rollout and beta claims, not a separate company statement.

FAQ