OpenAI has introduced Codex Security in research preview, positioning it as a project-contextual security capability within the Codex ecosystem. The feature is designed to build threat models for a codebase, validate potential findings in sandboxed environments, and surface proposed patches for human review.
The release is significant for teams evaluating AI-assisted application security because it frames security work as more than a static scan. OpenAI's current approach combines codebase context, validation, and reviewer oversight, while keeping the feature tied to its cloud and web product experience rather than presenting it as a standalone open-source security command-line tool.
What OpenAI has released
According to OpenAI's Codex Security research preview announcement, Codex Security is being introduced as a research-preview feature for customers using Codex web. OpenAI says the tool develops a threat model based on project context, investigates potential issues, validates findings in sandboxed environments, and presents patches for human review.
That sequence matters because security tooling can produce findings that require substantial engineering effort to triage. A system that can incorporate project context and test a potential issue before escalating it is intended to make findings more actionable. However, OpenAI's own description still places a human reviewer in the decision loop for proposed changes.
