OpenAI Launches Codex Security to Automate Vulnerability Detection and Code Fixes

Quick Facts

• OpenAI launched Codex Security on March 6, 2026, as an AI agent that finds, validates, and fixes software vulnerabilities in GitHub repositories
• The tool reduced alert noise by 84%, over-reported severity by 90%, and false positives by more than 50% compared to traditional security scanners
• Codex Security scanned over 1.2 million commits in 30 days, identifying 792 critical vulnerabilities and 10,561 high-severity issues

OpenAI launched Codex Security, an AI-powered application security agent that automates vulnerability detection and remediation in software code. The tool evolved from an internal OpenAI project called Aardvark that the company used to analyze its own code files.

The system works through three stages: threat model creation, validation, and remediation. Codex Security first creates a detailed natural language description of how a program works and where it may be vulnerable. It then tests potential flaws in a sandbox environment to determine if hackers can exploit them. Finally, it generates remediation suggestions with both code fixes and explanations.

The tool demonstrated significant performance improvements over traditional security scanners. Early adopters detected more than 11,000 critical and high-severity vulnerabilities using the system. The 84% reduction in alert noise addresses a key pain point for security teams overwhelmed by false positives.

“We wanted to make sure that we’re empowering defenders,” said Ian Brelinsky, a member of OpenAI’s Codex Security team.

Codex Security’s impact extends beyond enterprise customers. OpenAI found 14 vulnerabilities severe enough for the CVE database across open-source projects including OpenSSH, GnuTLS, GOGS, and PHP. The company launched Codex for OSS, offering free access to qualifying open-source maintainers.

“Codex Security integrated effortlessly into our robust security development environment, strengthening the pace and depth of our review processes,” said Chandan Nandakumaraiah, Head of Product Security at NETGEAR and Member of CVE Board.

The launch comes weeks after Anthropic introduced its rival Claude Code Security tool, intensifying competition in AI-driven code defense. OpenAI enters a growing market for AI-enabled code security tools, competing against traditional application security vendors and rival AI labs.

Codex Security is available as a research preview in ChatGPT’s Enterprise, Business, and Edu tiers, with free usage for the first month. Open-source project maintainers can access the tool at no charge through the dedicated program.

The tool addresses developers’ increasing need for security review as AI agents accelerate software development. Most existing AI security tools generate excessive false positives, forcing security teams to spend significant time on triage rather than addressing real threats.

Read more: OpenAI introduces Codex Security to help developers fix software vulnerabilities