OpenAI launches Codex Security Review tool

OpenAI has expanded its developer toolset by launching Codex Security Review in a research preview. This new capability integrates directly into GitHub pull request workflows to perform deep, context-aware security analysis. Developers can trigger the tool manually by typing @codex security review in any pull request comment, or they can configure it to run automatically whenever a pull request is opened or a new push is made. During this introductory period, the service is available for free with no credit consumption for users on Enterprise, Business, Edu, and Pro plans, though it is currently excluded from the Plus plan.

Unlike traditional static analysis tools that rely on signature-based scanning or fuzzing, Codex Security Review leverages language-model reasoning, test-time compute, tool use, and large context windows. It operates in three distinct stages: identifying potential vulnerabilities by exploring attack paths, validating those issues in a sandbox to confirm they are real, and generating concrete remediation patches. In independent testing on the same codebase, this methodology achieved a 74% true positive rate. By comparison, traditional security tools Semgrep and Snyk achieved true positive rates of just 20% and 28%, respectively.

For software practitioners, this development represents a significant shift away from the alert fatigue caused by noisy static analysis. By analyzing full repository context and project-specific threat models, the tool traces multi-step attack paths and validates findings before presenting them, ensuring developers only focus on actionable risks. However, users should note some current limitations: the tool is currently restricted to GitHub, lacks compliance reporting features, and can suffer from slow initial scans when analyzing large repositories.