OpenAI Launches Codex Security to Automate Software Vulnerability Detection

OpenAI launched Codex Security in early March 2026, an AI-driven application security agent designed to identify, validate, and fix high-impact software vulnerabilities. Evolving from a private beta project called Aardvark, the tool is currently available in research preview for ChatGPT Enterprise, Business, Edu, and Pro customers via the Codex web platform.

The system utilizes frontier models and agentic reasoning to map attack paths and reproduce issues in sandbox environments, which reduced false positives by over 50% and noise by 84%. During its first 30 days of research testing, Codex Security scanned 1.2 million commits and identified 792 critical and 10,561 high-severity issues across proprietary and open-source projects, including PHP, GnuTLS, OpenSSH, and Chromium. These findings resulted in 14 assigned CVEs.

To ensure reliability, the tool includes automated validation mechanisms to verify that proposed patches resolve vulnerabilities without introducing new errors. While the agent proposes fixes for flaws like injection attacks and memory safety issues, OpenAI maintains that developers remain responsible for reviewing and approving changes before production integration. The tool was provided free for the first month starting March 9, 2026, and the company intends to expand resources for open-source maintainers to improve general ecosystem security.