Codex Security: From Vulnerability to Verified Fix | DevDay 2026
Source: YouTube · OpenAI · published Nov 11, 2026 · 20:58
OpenAI's cyber product engineering team introduces Codex Security—open-source CLI/SDK plus cloud tools that scan codebases for vulnerabilities, validate findings with very low false positives, and generate patches, born from an internal "security sprint" 0:50.
Key Takeaways:
• AI is at a security inflection point: frontier models can find thousands of latent vulnerabilities, creating a "defender's window" to fix issues before attackers gain the same capabilities 1:19.
• OpenAI's internal "defense factory" achieved a 0.81% false positive rate and <1% rollback rate on auto-generated patch fixes 3:04.
• Agents need two context layers: narrow custom scan instructions and a reusable knowledge base (architecture docs, firewall configs, committed security.md files) 5:21.
• Deep scans fan out parallel agents and iterate until no new issues emerge; at OpenAI scale, hundreds of agents produced tens of thousands of findings, 36% duplicates, requiring automated deduplication 8:29.
The talk's five steps—context, scanning, enrichment, patching, SDLC integration—let any developer build their own defense factory before attackers catch up.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Hi, everyone. I'm Ian. I work on cyber product engineering here at OpenAI. And today, I'm going to share a bit about what we're building for AI security, how we've used it internally, and also how you can use it as well. Hi, and I'm Kyle. I work with Ian on the cyber product engineering team. And I'm focused on the Codex Security CLI, which provides building blocks to help secure your software with AI. Today, we'll walk through how the CLI works, from discovering and validating findings to generating patches that a developer can review and show a demo of our new Codex Security Cloud, which is a more turnkey solution of the CLI workflows that we announced today during the keynote. Great. So before we get all into that, I want to acknowledge the state of cybersecurity landscape today. We're …