# OpenAI turns defense factory into Cloud product

_OpenAI demoed Codex Security Cloud at DevDay 2026, turning its internal defense factory into a GitHub scanner._

**Published:** 2026-11-11
**Source:** https://www.startuphub.ai/ai-news/technology/2026/openai-turns-defense-factory-into-cloud-product

---

[OpenAI](https://www.youtube.com/watch?v=gUQN7juxvVI) built Codex Security CLI and SDK first as open-source blocks. At DevDay 2026 Ian and Kyle demoed the change. Codex Security Cloud now scans GitHub repositories on every commit. It targets remote flaws where external actors gain access they should not have.

Months earlier [OpenAI](https://www.startuphub.ai/startups/openai) ran an internal security sprint. Ian said a quarter of product engineers joined the effort. Ian described the goal as a continuous defense factory. It scans systems, validates flaws, assigns owners and verifies fixes.

  
    

![Codex Security: From Vulnerability to Verified Fix | DevDay 2026](https://img.youtube.com/vi/gUQN7juxvVI/maxresdefault.jpg)

    
      
        
      
    
  
  Codex Security: From Vulnerability to Verified Fix | DevDay 2026

Ian, who works on cyber product engineering at OpenAI, warned "The cost of hacking stuff is going to basically zero." Kyle said broad scans failed without context. The team added custom scan prompts plus a shared knowledge base. OpenAI said 36% of findings were duplicates in its sprint.

Kyle said ownership mapping took the most human effort. The CLI now classifies flaws with a security rubric. It auto-generates patches and runs a verify-fix check as adversary. Ian said the false positive rate was 0.81% with rollbacks under 1%.

PatchBench tests use Codex Security patch skill to compare models. OpenAI said Astra at medium reasoning beats 5.6 Sol at X-high at less than half the cost per case. OpenAI said humans benchmark near 50%. That result builds on [5.6 Sol](https://www.startuphub.ai/ai-news/artificial-intelligence/2026/openai-launches-gpt-5-6-sol-leads-charge) work and earlier [Astra internal testing](/ai-news/technology/2026/openai-turns-astra-on-itself-to-catch-flaws).

Cloud runs the loop without manual orchestration. OpenAI said it uses Daybreak Blue models for security. The CLI ships as @openai/codex-security on NPM, per its GitHub repo. Find Codex Security Cloud in the plugin marketplace before the end of the week.

---

Original analysis from [startuphub.ai](https://www.startuphub.ai), the #1 AI startup directory.

© StartupHub.ai. All rights reserved. You may not republish this article in full without a license. Search engines and AI research tools may crawl and summarize for reference. Bulk reproduction or model training on this content requires a license. See https://www.startuphub.ai/terms.