Codex Security

Q: How do I run a Codex Security review on a pull request?

Comment @codex security review on the GitHub pull request, or turn on Auto security review for the repository in chatgpt.com/settings/code-review. Codex posts findings above your severity threshold on the pull request.

Codex Security is OpenAI's application security agent: it builds a threat model of a repository, looks for vulnerabilities, tries to confirm them in a sandbox and proposes patches. It began as Aardvark (announced Oct 30, 2025), became Codex Security in research preview on Mar 6, 2026, and now runs as a desktop plugin, a cloud plugin, a CLI and SDK, and pull request Security Review, alongside Daybreak for approved defenders.

Codex Security is OpenAI's agent for finding and fixing vulnerabilities in your own code: it reads a repository, writes a threat model of what the system does and trusts, searches for flaws, tries to reproduce each one in a sandbox, and attaches a proposed fix (OpenAI, Mar 6, 2026). As of Nov 6, 2026 you run it four ways: the Codex Security plugin in the Codex App or Codex CLI for local scans, the Codex Security Cloud plugin for GitHub repositories (research preview), the @openai/codex-security CLI and TypeScript SDK for CI and your own tools, and Security Review on GitHub pull requests (OpenAI docs). It was first announced as Aardvark, "an agentic security researcher", on Oct 30, 2025.

Codex Security checks the code you build. It is not the same as the sandbox and approval rules that keep Codex itself safe on your computer; those are on Codex CLI. OpenAI's separate program for security professionals, Daybreak, is covered below.

Quick facts

Maker	OpenAI
Announced as Aardvark	Oct 30, 2025, private beta
Renamed Codex Security	Mar 6, 2026, research preview
Status	Research preview for Cloud scans and Security Review, as of Nov 6, 2026
Security Review plans	Enterprise, Business, Edu and Pro; not Plus
CLI and SDK	`npm install -g @openai/codex-security` (CLI quickstart); command `codex-security` or `cs`
PR command	`@codex security review`
Cost	Included Codex usage or credits; Cloud scans set up after Oct 1, 2026 are billed by tokens (Cloud FAQ)

From Aardvark to Codex Security

OpenAI announced Aardvark on Oct 30, 2025 as an autonomous agent, powered by GPT-5, that watched commits, built a threat model, scanned changes against it, tried to trigger each suspected flaw in an isolated sandbox, and attached a Codex-written patch. It ran in a private beta; OpenAI said it found 92% of known and planted vulnerabilities in its "golden" test repositories, and that ten of the flaws it reported in open-source projects received CVE identifiers (OpenAI).

On Mar 6, 2026 Aardvark became Codex Security, in research preview for ChatGPT Pro, Enterprise, Business and Edu through Codex web, with a month of free use. OpenAI said that over the 30 days before, it had scanned more than 1.2 million commits in its beta group's outside repositories and found 792 critical and 10,561 high-severity issues, with critical issues in under 0.1% of commits; that false positives had fallen by more than half during the beta; and that it had reported flaws to projects including OpenSSH, GnuTLS, PHP and Chromium, with fourteen CVEs assigned (OpenAI, Mar 6, 2026). These are OpenAI's own figures; no independent test of them was found on Nov 6, 2026.

Ways to run Codex Security

Option	Use it to	Where
Codex Security plugin	Scan a local repository and work through findings	ChatGPT desktop app (Codex), Codex CLI
Codex Security Cloud	Scan connected GitHub repositories, or watch new commits	ChatGPT web and desktop app, research preview
Codex Security CLI	Repeatable terminal scans and CI checks	Any terminal, `@openai/codex-security`
Codex Security SDK	Scans and results inside your own tools	TypeScript, same package
Security Review	A security pass on each GitHub pull request	GitHub, research preview

Source: Codex Security, OpenAI docs, read Nov 6, 2026. OpenAI suggests the plugin for a first scan.

Scan a repository in the desktop app

In the ChatGPT desktop app, select Codex and open Plugins.
Search for Codex Security, install it and make sure it is enabled (a managed workspace may show "Disabled by admin").
Open Security in the sidebar and start a scan of the repository.
Review the findings in the Security workbench, which keeps saved scans and findings.

Source: Codex Security plugin quickstart, read Nov 6, 2026. The scan leaves your source unchanged and saves a report with evidence and fix guidance. From there you can fix and verify a finding, run a deeper repeated scan, review a pull request or local diff, triage findings from another scanner, or export findings to GitHub Issues or Linear (Codex Security).

Scan GitHub repositories in the cloud

Codex Security Cloud is a separate plugin, in research preview, that runs in Codex Cloud and needs workspace access and a GitHub connection (Codex Security):

Open Plugins in ChatGPT on the web or in the desktop app, search for Codex Security Cloud, install and enable it.
Select Scan and connect your own GitHub account if asked; each person who starts scans needs their own connection.
In New Scan, choose the repository and an environment (Auto creates one), select One-Time Scan, then Create.
Open Findings to see each issue's code, attack path and validation evidence. Fix with Codex starts a chat that checks the finding, writes a fix and runs tests.
To watch future work, start another scan with Continuous Scanning, which follows the default branch and can review recent commit history.

Source: Codex Security Cloud setup, read Nov 6, 2026. OpenAI warns that a scan with no findings "doesn't establish that the repository has no vulnerabilities". Cloud scanning arrived with the DevDay 2026 announcements, in the week of Sep 28 to Oct 2, 2026 (What's new).

The Codex Security CLI and SDK

The public @openai/codex-security package holds both. It needs Node.js 24 or 26 (or 22 from 22.13.0) and Python 3.10 or later; scans using OpenAI models need Codex Security access, and some need Trusted Access for Cyber (CLI quickstart).

Install: npm install -g @openai/codex-security, then codex-security --version (or run it with npx @openai/codex-security).
Sign in: npx @openai/codex-security login (--device-auth on a machine without a browser).
Dry run: npx @openai/codex-security scan "$REPOSITORY" --auth chatgpt --output-dir "$SCAN_DIR" --dry-run, with the results folder outside the repository.
Scan: the same command without --dry-run. It ends by printing the report path and the number of findings.

The CLI runs with your own system permissions and does not stop for approval, so OpenAI advises removing unrelated credentials from the environment first; reports can contain source code and secrets, so keep them private (CLI quickstart). --max-cost 5 sets an estimated spending limit in US dollars, which is "not a hard spending cap" (CLI FAQ). The CLI also runs in GitHub Actions and GitLab CI, uploads SARIF results, and scans many repositories in bulk. The package reached version 0.1.5 in late July 2026.

Security Review on pull requests

Security Review goes deeper than Codex Code Review on security risks in a pull request. It is available to ChatGPT Enterprise, Business, Edu and Pro, not Plus, and uses included Codex usage or credits (Security Review).

Ask for one: comment @codex security review on the pull request. The full report (severity, attack path, evidence, validation, fix guidance) is in the Codex task's Security Report tab.
Automatic: in Codex settings, choose the repository and turn on Auto security review under Review security vulnerabilities, then pick which pull requests and a Trigger (on open, on every push, or whenever code review runs).
Thresholds: automatic reviews post High and Critical findings by default, requested ones Medium and up. Findings posted on a public pull request are visible to anyone who can see it.

It reached research preview in the week of Aug 3 to 7, 2026 (What's new). A threat model file in the repository, or one from an earlier scan, gives it context; without one, Codex rebuilds the threat model for every review.

What does Codex Security cost?

Security Review and local scans draw on included Codex usage or credits (Security Review). For Cloud, repository and continuous scans set up after Oct 1, 2026 at 12:53 PM Pacific are billed by token use at the plan's rates; continuous scans set up before then stayed free until Oct 21, 2026, and some accounts hold free scanning credits that do not expire. Each scan shows its tokens and cost under Scans (Cloud FAQ). Open-source maintainers can apply to Codex for OSS, which OpenAI says includes Codex Security (OpenAI). Plan limits are on Codex Pricing and Limits.

Daybreak for security professionals

Daybreak is OpenAI's program for approved defenders who do authorized security work with fewer refusals. Daybreak Blue gives flagship models with reduced refusals for vulnerability discovery, secure code review, threat modeling, detection engineering, incident response, malware analysis and patch validation. Daybreak Red gives separately approved access to specialist cyber models for work such as exploit validation, penetration testing and red teaming (Daybreak). Both launched on Aug 10, 2026.

Access goes through Trusted Access for Cyber: individuals apply at chatgpt.com/cyber, organizations through an enterprise form. Approval for Blue does not include Red, and applying does not guarantee approval. In the CLI, /daybreak turns it on for eligible accounts (Daybreak, Developer commands). On the credit rate card, Daybreak Blue costs 100 / 10 / 500 credits and Daybreak Red 312.5 / 31.25 / 1,875 credits per million input / cached / output tokens (pricing). One privacy catch: during Daybreak sessions on a personal account, OpenAI may use your content to improve its models even when "Improve the model for everyone" is off (OpenAI Help Center); see Privacy and Data Controls. The models themselves are on GPT-Rosalind and Cyber Models.

Frequently asked questions

What is Codex Security? Codex Security is OpenAI's application security agent: it builds a threat model of a repository, finds vulnerabilities, tries to confirm them in a sandbox and proposes fixes. It runs as a desktop and CLI plugin, a cloud plugin for GitHub repositories, a CLI and SDK, and pull request Security Review.

What happened to OpenAI Aardvark? Aardvark, OpenAI's agentic security researcher announced on Oct 30, 2025, was renamed Codex Security and built into Codex on Mar 6, 2026, when it entered research preview.

Is Codex Security available on ChatGPT Plus? Partly. Codex Security Review on pull requests is for Enterprise, Business, Edu and Pro, not Plus; the local plugin and Cloud scans depend on your plan and workspace access, so check the Plugins page in the app.

How do I run a Codex Security review on a pull request? Comment @codex security review on the GitHub pull request, or turn on Auto security review for the repository in chatgpt.com/settings/code-review. Codex posts findings above your severity threshold on the pull request.

What is OpenAI Daybreak? Daybreak is OpenAI's program giving approved security professionals models with fewer refusals: Daybreak Blue for defensive work and, with separate approval, Daybreak Red for specialist work like exploit validation. Apply through Trusted Access for Cyber.