OpenAI has announced the introduction of Codex Security, an application security agent formerly known as Aardvark. Designed to address the bottlenecks of accelerated software development and high rates of false positives in traditional security tools, Codex Security builds deep context about a project to identify complex vulnerabilities, validate them in sandboxed environments, and propose patches. During its private beta, the tool scanned over 1.2 million commits across external repositories, identifying 792 critical findings and over 10,561 high-severity findings while reducing false positive rates by more than 50 percent across all repositories. Starting today, Codex Security is rolling out in a research preview to ChatGPT Pro, Enterprise, Business, and Edu customers via Codex web, featuring free usage for the next month. OpenAI has also utilized Codex Security to scan critical open-source software, reporting vulnerabilities and securing assigned CVEs across projects such as OpenSSH, GnuTLS, GOGS, Thorium, libssh, PHP, and Chromium. Through its Codex for OSS program, OpenAI is onboarding initial open-source maintainers to provide free ChatGPT accounts, code reviews, and access to Codex Security, with plans to expand the initiative in the coming weeks.
Codex Security: now in research preview
OpenAI has introduced Codex Security, an application security agent previously known as Aardvark. The tool analyzes project context to detect, validate, and patch complex vulnerabilities while reducing false positives. It is currently rolling out in research preview to ChatGPT Pro, Enterprise, Business, and Edu customers.
Why it matters
The release addresses the critical security review bottleneck in fast-paced software development by using AI agents to minimize false positives and automate complex patching.
Topic dossiers OpenAI