Codex Security: Research Preview Released

OpenAI has introduced Codex Security (formerly Aardvark), an application security agent, as a research preview. This tool grasps deep context of a project to identify complex vulnerabilities that existing AI security tools tend to miss, and provides fixes that enable substantive improvements.

Existing security tools have generated excessive low-impact results or false positives, adding to the workload of security teams. Codex Security combines the reasoning capabilities of frontier models with automated verification techniques to deliver high-confidence vulnerability discovery and actionable patches, resolving the security review bottleneck.

The key operating mechanism of Codex Security is as follows.

• Building system context and generating a threat model: It analyzes the repository to understand the system architecture, and generates an editable, project-specific threat model to identify the system's trust boundaries and exposure points.
• Issue prioritization and verification: Based on the threat model, it searches for vulnerabilities and tests them directly in a sandbox environment, reducing false positives and presenting concrete evidence (PoC).
• Patches that reflect system context: It proposes fixes that account for the system's intent and surrounding behavior, strengthening security while minimizing regressions.

During the beta testing period, Codex Security scanned over 1.2 million commits and identified 792 critical flaws and 10,561 high-severity flaws. Notably, it demonstrated high precision, reducing noise by 84% and lowering the false positive rate by more than 50%.

It is currently offered as a research preview via Codex web to ChatGPT Pro, Enterprise, Business, and Edu customers, and will be available free of charge for the next month.