OpenAI Releases Codex Security: AI-Powered Automated Code Security Scanning Tool, 14 CVEs Already Discovered L1
Confidence: High
Key Points: OpenAI has launched Codex Security in research preview — an AI-powered application security agent that automatically analyzes codebases, identifies vulnerabilities, validates findings in a sandbox environment, and proposes patches. It is currently available free for the first month to ChatGPT Enterprise, Business, and Edu users, and extends to the open-source community through the 'Codex for OSS' program.
Impact: Enterprise developers and security teams can trial the tool at no cost, automating security review workflows. The tool has scanned over 1.2 million commits, identified 792 critical vulnerabilities and 10,561 high-severity issues, and helped disclose 14 CVEs in major open-source projects including OpenSSH, Chromium, and PHP. Compared to the beta version, the false positive rate has been reduced by more than 50% and severity overestimation by 90%.
Detailed Analysis
Trade-offs
Pros:
- Free for the first month (Enterprise/Business/Edu), lowering evaluation costs
- Open-source maintainers can apply for 6 months of ChatGPT Pro plus API Credits
- Generates project-level threat models rather than only reporting individual vulnerabilities
- Sandbox validation significantly reduces false positive rates
- Has discovered actual CVEs in mainstream open-source projects
Cons:
- Still in research preview; may be unstable
- Currently limited to ChatGPT Enterprise/Business/Edu; individual developers must wait
- Ability to identify complex business-logic vulnerabilities has yet to be validated
- Pricing after the first month has not been disclosed
Quick Start (5-15 minutes)
- Confirm your organization has a ChatGPT Enterprise, Business, or Edu subscription
- Go to the Codex Web interface and enable Codex Security
- Connect your code repository and configure scan settings
- Review the automatically generated threat model and adjust as needed
- Examine scan results and prioritize critical and high-severity vulnerabilities
- Open-source maintainers can apply for the Codex for OSS program
Recommendation
Enterprise security teams should apply for the free first-month trial immediately, especially organizations maintaining large codebases. Open-source project maintainers are encouraged to apply for Codex for OSS. It is recommended to treat this as a complement to existing security tools rather than a full replacement for traditional SAST/DAST tooling.
Sources: OpenAI Official Announcement (Official) | Axios - OpenAI Codex Security Coverage (News) | MarkTechPost Technical Analysis (News)