OpenAI Codex Security Scanned 1.2 Million Commits and Found 10,561 High-Severity Issues
OpenAI has started to deploy Codex Security, an AI-driven security agent built to detect, confirm, and propose remediations for software vulnerabilities.
The capability is being released as a research preview and is accessible through the Codex web interface to ChatGPT Pro, Enterprise, Business, and Edu subscribers. OpenAI is offering free access for the next month.
OpenAI describes the tool as one that develops a rich understanding of a codebase so it can surface complex vulnerabilities that other autonomous tools might overlook. The company says this improved context helps deliver higher-confidence results and suggested fixes while filtering out low-value noise.
Codex Security is the successor to Aardvark, which debuted in a private beta in October 2025 as a solution for developers and security teams to find and remediate vulnerabilities at scale. During the beta, over the past 30 days Codex Security examined more than 1.2 million commits in external repositories, uncovering 792 critical issues and 10,561 high-severity findings.
The scans flagged flaws across a variety of open-source projects, including OpenSSH, GnuTLS, GOGS, Thorium, libssh, PHP, Chromium and others. A selection of specific vulnerabilities identified includes:
GnuPG – CVE-2026-24881, CVE-2026-24882
GnuTLS – CVE-2025-32988, CVE-2025-32989
GOGS – CVE-2025-64175, CVE-2026-25242
Thorium – CVE-2025-35430, CVE-2025-35431, CVE-2025-35432, CVE-2025-35433, CVE-2025-35434, CVE-2025-35435, CVE-2025-35436
According to OpenAI, the newest version of the agent relies on the reasoning strengths of its frontier models and pairs that capability with automated validation steps to cut down on false positives and produce fixes that security teams can act on.
OpenAI reports that repeated scans of the same repositories have shown improved accuracy over time, with false positive rates dropping by more than half across all examined repositories.
OpenAI explains that Codex Security aims to improve the signal-to-noise ratio by tying vulnerability discovery to detailed system context and validating findings before presenting them to users.
Operationally, the agent follows a three-phase workflow. First, it inspects a repository to map the project’s security-relevant landscape and produces an editable threat model that documents what the system does and where it may be vulnerable.
Next, the tool leverages that contextual model to find and prioritize vulnerabilities according to their potential real-world impact. Findings are then stress-tested within a sandbox to confirm they are actionable. OpenAI notes that when Codex Security is configured with an environment specific to a project, it can validate suspected issues against the running system, which helps eliminate false positives and can generate working proofs-of-concept to support remediation efforts.
In the final phase, Codex Security recommends fixes that are designed to align with the system’s expected behavior, reducing the chance of regressions and simplifying review and deployment for engineering teams.
The announcement follows recent moves by other vendors: weeks earlier Anthropic introduced Claude Code Security, a tool for scanning codebases for vulnerabilities and suggesting patches.