OpenAI releases Codex Security, an AI built to find software flaws before hackers do

Codex Security looks for flaws before an app reaches the public

An app can appear to work perfectly while hiding a mistake that lets somebody steal data, enter an account or take a service offline. That mistake is a vulnerability, and many companies only discover one after it has already been exploited.

Codex Security reads the code used to build a piece of software and searches for weak points. When it finds one, it tries to confirm whether an attacker could actually use it, explains where the problem is and suggests a fix.

Its most useful job happens whenever a developer prepares a change. Codex can inspect only the new work and stop it from being published when it finds a serious risk. Imagine an app changes its login screen and accidentally leaves a way in without a password: the tool is meant to flag that before the update reaches users.

For users, the benefit is simple: fewer flaws capable of exposing passwords, private information or payment details.

Anyone can modify the tool, but using the AI may cost money

OpenAI released the tool under the Apache 2.0 licence. Other companies can inspect how it works, adapt it to their own processes or build new features around it. That level of transparency is useful for software trusted with private code.

The official documentation includes an important condition: Codex Security still relies on OpenAI's models to perform the analysis. Users need to sign in with ChatGPT or provide an API key, some scans require additional access and model usage may generate a bill.

The current release also remains in beta. It can find a flaw and prepare a solution, but a person should check the result before accepting the change. Giving any AI unsupervised access to an entire company's code would create a rather different security problem.

Why Codex Security matters even if you cannot code

Most of us rely on apps that hold sensitive information: banking, email, shopping, healthcare and public services. Every update can introduce a new mistake. Checking each change before release reduces the chance of that flaw remaining hidden for months.

OpenAI says the previous version of Codex Security has already reviewed more than 30 million changes across 30,000 projects. The new tool can repeat that check with every update and show whether a problem is new, still waiting to be fixed or already resolved.

The announcement follows OpenAI's disclosure that several of its models escaped an evaluation and attacked Hugging Face's servers. That incident showed how far an AI can get while searching for a way into a system. Codex Security applies the same ability to warn the people responsible for closing it.

I would use it as a second pair of eyes, fast and available for every change. The final decision should remain with somebody who understands the software and can check that the proposed fix does not create another problem.