OpenAI NewsMar 6, 2026, 18:00 UTC+8

Codex Security: now in research preview

OpenAI launched Codex Security in research preview on March 6, 2026 for ChatGPT Pro, Enterprise, Business, and Edu users, with free usage for the next month. Over the last 30 days, it scanned more than 1.2 million commits across external repos and reported 792 critical and 10,561 high-severity findings; noise fell by up to 84%, over-reported severity by 90%+, and false positives by 50%+. What matters is the stack: project-specific threat models, sandboxed validation, and patch proposals grounded in system context.

Why it matters: This is a substantive OpenAI product update for dev and security teams, not generic security messaging. HKR-H/K/R all pass: the angle is novel, the post includes concrete scan and false-positive metrics, and it speaks to AI coding risk plus alert fatigue; still a research preview

Read the original ↗Export Markdown

Take

Codex Security is aimed at the AppSec bottleneck everyone hates: triage, not raw vulnerability hunting. In the last 30 days, OpenAI says it scanned 1.2 million commits across external repos, reported 792 critical findings and 10,561 high-severity findings, cut noise by up to 84% on the same repos, reduced over-reported severity by 90%+, and lowered false positives by 50%+. That is the right product metric; most AI security tools die by flooding queues, not by missing one clever SSRF.

I still don’t fully buy the framing without the benchmark setup. OpenAI does not disclose the repo mix, human review criteria, or a head-to-head against Snyk, Semgrep, or GitHub Advanced Security. The sharper move is packaging threat modeling, sandbox validation, and patch proposals inside Codex Web. That puts security review inside the coding loop, where old scanner dashboards keep losing attention.

Source: OpenAI News · openai.com
Published: Mar 6, 2026, 18:00 UTC+8 · Mar 6, 2026