OpenAI Launches Codex Security that Discover, Validate and Patch Vulnerabilities

OpenAI has announced the launch of Codex Security, an application security agent designed to autonomously identify, validate, and remediate complex vulnerabilities in enterprise and open-source codebases.

The tool, formerly known as Aardvark, utilizes advanced AI models to provide context-aware security assessments, aiming to replace static analysis tools that often produce low-impact findings and false positives.

Codex Security automatically tests potential exploits and generates actionable patches, addressing the increasing code review bottleneck resulting from AI-assisted software development.

The agent is now available in a research preview to ChatGPT Pro, Enterprise, Business, and Edu customers through the Codex web interface, starting today.

Unlike traditional application security testing tools, Codex Security begins its analysis with a project-specific, editable threat model that maps system trust boundaries and exposure points. This contextual understanding allows the agent to prioritize vulnerabilities based on real-world impact.

Codex Security validates its findings by executing proof-of-concept exploits in sandboxed environments. Confirmed vulnerabilities result in the generation of contextual patches designed to minimize regressions and align with the surrounding system architecture.

During its private beta phase, the system demonstrated substantial improvements in its signal-to-noise ratio. OpenAI reported an 84% reduction in alert noise, a 90% decrease in over-reported severity levels, and more than a 50% drop in false positive rates across monitored repositories.

Over the last 30 days of the beta, the agent scanned over 1.2 million commits from external repositories, identifying 792 critical vulnerabilities and 10,561 high-severity issues, with critical flaws appearing in fewer than 0.1% of all scanned commits.

A core component of the Codex Security rollout is its application to critical open-source software (OSS). OpenAI utilized the agent to audit widely relied-upon projects such as OpenSSH, GnuTLS, PHP, and Chromium, prioritizing actionable intelligence. These audits resulted in the discovery of high-impact zero-day vulnerabilities and the assignment of 14 official CVEs.

To strengthen the OSS ecosystem, OpenAI is launching "Codex for OSS," a program offering free access to ChatGPT Pro accounts, code review infrastructure, and Codex Security for eligible open-source maintainers.

The following table details a selection of critical vulnerabilities discovered and validated by Codex Security across major open-source projects:

CVE ID CVSS Score Affected Component Vulnerability Type & Context

CVE-2025-32990 8.2 (High) GnuTLS certtool Heap-Buffer Overflow (Off-by-One) in template parsing.

CVE-2025-64175 N/A GOGS Two-Factor Authentication (2FA) Security Bypass.

CVE-2026-25242 N/A GOGS Unauthenticated Access Control Bypass.

CVE-2025-35430 N/A Agent Framework Path Traversal leading to Arbitrary Write capabilities.

CVE-2025-35431 N/A LdapUserMap LDAP Injection affecting filters and distinguished names.

CVE-2025-35432 N/A Verification Systems Unauthenticated Denial of Service (DoS) & Mail Abuse.

CVE-2026-24881 N/A gpg-agent (ECC KEM) Stack Buffer Overflow via PKDECRYPT​.

CVE-2025-11187 N/A PKCS#12 PBMAC1 PBKDF2 KeyLength Overflow and MAC verification bypass.

Security and development teams are advised to review the official OpenAI developer documentation to configure repository integrations and establish baseline threat models. For open-source maintainers interested in leveraging these capabilities, applications for the Codex for OSS program are currently open through OpenAI's platform.

Organizations using the vulnerable software components listed above should immediately track vendor advisories and deploy the validated patches provided by their respective maintainers.

Based on reporting by Cyber Security News.