OpenAI built Codex Security CLI and SDK first as open-source blocks. At DevDay 2026 Ian and Kyle demoed the change. Codex Security Cloud now scans GitHub repositories on every commit. It targets remote flaws where external actors gain access they should not have.
Months earlier OpenAI ran an internal security sprint. Ian said a quarter of product engineers joined the effort. Ian described the goal as a continuous defense factory. It scans systems, validates flaws, assigns owners and verifies fixes.
Ian, who works on cyber product engineering at OpenAI, warned "The cost of hacking stuff is going to basically zero." Kyle said broad scans failed without context. The team added custom scan prompts plus a shared knowledge base. OpenAI said 36% of findings were duplicates in its sprint.
Kyle said ownership mapping took the most human effort. The CLI now classifies flaws with a security rubric. It auto-generates patches and runs a verify-fix check as adversary. Ian said the false positive rate was 0.81% with rollbacks under 1%.
PatchBench tests use Codex Security patch skill to compare models. OpenAI said Astra at medium reasoning beats 5.6 Sol at X-high at less than half the cost per case. OpenAI said humans benchmark near 50%. That result builds on 5.6 Sol work and earlier Astra internal testing.
Cloud runs the loop without manual orchestration. OpenAI said it uses Daybreak Blue models for security. The CLI ships as @openai/codex-security on NPM, per its GitHub repo. Find Codex Security Cloud in the plugin marketplace before the end of the week.
