Codex Security Launches to Find, Validate, and Patch Code Vulnerabilities

OpenAI

Mar 6, 2026 · Updated Apr 25, 2026

OpenAI launched Codex Security, an AI agent that identifies complex code vulnerabilities, validates them automatically, and proposes targeted fixes. It cuts triage noise significantly, so security teams focus on real threats rather than false positives.

Codex Security, OpenAI's application security agent, builds a project-specific threat model for each codebase — capturing what the system does, what it trusts, and where it's most exposed. It searches for vulnerabilities, validates findings in sandboxed environments, and proposes fixes aligned with surrounding code behavior. In beta, it scanned 1.2 million commits, surfaced 792 critical findings, and cut false positive rates by more than 50%.

Most AI security tools flood teams with noisy, low-impact reports. Codex Security addresses this bottleneck by grounding analysis in system-specific context, aligning reported severity with real-world risk. As AI agents accelerate development, security review is becoming a critical bottleneck — one Codex Security is built to solve.

Codex Security is rolling out in research preview for ChatGPT Pro, Enterprise, Business, and Edu customers via Codex web, with free usage for the next month. Access it through your ChatGPT account to configure scans for your team.

View the full update on openai.com

OpenAI Developers

@OpenAIDevsMar 6

We're introducing Codex Security. An application security agent that helps you secure your codebase by finding vulnerabilities, validating them, and proposing fixes you can review and patch. Now, teams can focus on the vulnerabilities that matter and ship code faster. https://t.co/L9SkqrGro2

751

View on X

Every HeadsUpAI update is written based on its original source and reviewed before it's published. Read our editorial standards →

See all AI news & updates from OpenAI →

Keep reading

OpenAI Launches Daybreak to Automate Cyber Defense and Software Patching

OpenAI launched Daybreak, a cybersecurity platform that integrates GPT-5.5 models and Codex to identify, validate, and remediate software vulnerabilities. The system shifts security teams from manual triage to autonomous agentic workflows that can generate and test code patches directly in repositories.

ClaudeFeb 20

Claude Code Security Scans Codebases for Vulnerabilities and Suggests Patches

Claude Code Security launches as a new capability that scans codebases the way a human researcher would - reasoning about component interactions, not just matching known patterns. It finds vulnerabilities, suggests patches, and surfaces everything for human approval before applying.

OpenAI Open Sources Auto-review to Automate Safety Checks for Codex Agents

Maja TrebaczMay 4

OpenAI Open Sources Auto-review to Automate Safety Checks for Codex Agents

OpenAI released the research and code for Auto-review, a secondary agent that handles permission requests for Codex without requiring human intervention. This architecture allows autonomous coding agents to perform sensitive tasks like network calls while maintaining safety oversight through a separate reasoning model.

ReplitApr 21

Replit Launches Security Agent to Perform Deep Code Audits in Minutes

Replit launched the Security Agent, a specialized tool that performs full pre-launch audits by mapping application architecture and identifying exploitable vulnerabilities. It uses a hybrid approach to filter out 90% of false positives, securing AI-generated code without the weeks of manual review typically required by security engineers.