Codex Security: Powerful Repo Scanning in ChatGPT

The ChatGPT desktop app now carries a Security entry in its sidebar, and behind it sits a full application-security workbench. Install the Codex Security plugin, and Security appears alongside your chats and tasks, opening onto three panels — Scans, Findings, and Repositories — that let you point an agent at a repository you own and get back validated vulnerabilities with proposed fixes. It is the first time an application security programme has lived inside the same window as the chat client, and that placement is the whole story.

This is not a lint pass rebranded. Codex Security builds a codebase-specific threat model, explores realistic attack paths, tries to reproduce what it finds in an isolated environment before it tells you about it, and then writes structured artifacts to disk that you can diff between runs. The lineage runs back through Aardvark, the agentic security researcher OpenAI put into private beta in October 2025, which scored 92% recall against known and synthetically introduced vulnerabilities on benchmark repositories and picked up ten CVEs on open-source projects before it was renamed.

The numbers from the beta are unusual for a category that normally competes on rule counts. Across external repositories, Codex Security scanned roughly 1.2 million commits, surfaced 792 critical findings and 10,561 high-severity findings, and cut false-positive rates by more than half over the course of the run. The affected projects were not toys: OpenSSH, GnuTLS, GOGS, Thorium, libssh, PHP, and Chromium all appear on the list, with CVE identifiers to match.

This article covers exactly what the Codex Security section in the ChatGPT desktop app does, how the plugin gets into your sidebar, what happens during a scan and in what order, how findings are validated and triaged, which files land on disk and which one you should read first, how the desktop workbench differs from the CLI and the cloud service, what the tool genuinely cannot see, and how to fold it into a security programme without pretending it replaces one.

Codex Security: The Quick Answer

Codex Security is OpenAI’s application security agent. In the ChatGPT desktop app it arrives as a plugin; once installed and enabled, a Security item appears in the sidebar and opens the Codex Security workbench, where Scans, Findings, and Repositories sit side by side while Codex runs each scan as a task. You select a repository or a scoped folder, choose Codebase, decide whether you want a deep scan, optionally supply context about your threat model, and start. The agent works through threat modelling, discovery, validation, impact analysis, reporting, structural hardening, and finalisation, then writes a report and a set of machine-readable artifacts.

The distinguishing move is validation. Traditional static analysis pattern-matches and hands you a queue. Codex Security attempts to prove that a vulnerable path is genuinely reachable under stated preconditions and crosses a real security boundary before it labels a finding confirmed. Anything it cannot settle from repository evidence gets marked needs_review rather than being dropped or asserted.

Area	What Codex Security does	What it does not do
Placement	Security section in the ChatGPT desktop app sidebar	Replace your SAST, DAST, or SCA stack outright
Analysis	Repository-specific threat model, not generic rules	Reason about production configuration it cannot see
Validation	Reproduces candidate issues in an isolated environment	Prove exploitability against a running deployment
Triage	Assigns confirmed, not_actionable, or needs_review	Auto-close findings without preserving evidence
Output	report.md plus findings, coverage, and manifest JSON	Guarantee complete coverage of every surface
Remediation	Proposes patches for human review	Merge fixes autonomously
Scope control	Whole repository, one folder, a diff, or a working tree	Run deep scans against pull requests
Access	Research preview on Pro, Business, Enterprise, and Edu	Ship on the free tier

What the Codex Security Section in the ChatGPT Desktop App Actually Is

The Security sidebar entry is a workbench, not a chat shortcut. Opening it gives you three persistent views that survive across sessions, which is the practical difference between a security tool and a conversation about security.

Scans is where work starts and where it is remembered. You initiate scans from here, watch their progress through the phase indicator, and reopen completed runs later to inspect what they found and what they covered. Scan history is paginated and rerunnable, so a scan from three weeks ago can be re-executed against the current head without rebuilding the configuration by hand.

Findings is the triage surface. It aggregates issues across completed scans rather than trapping them inside one run, and every finding opens onto its source evidence, validation detail, reachability analysis, impact assessment, and remediation guidance in a single pane. You can filter and sort — sorting by highest confidence is the one most teams will live in — and the workspace preserves its state through refreshes, which sounds trivial until you have lost a triage session to a reload.

Repositories is the longitudinal view. It holds repository history and the currently open findings for each one, which is what turns Codex Security from a one-off audit into something you can run on a cadence and compare against itself.

Underneath all three, Codex runs each scan as a task. That matters because it means a scan behaves like every other long-running Codex job in the desktop app: it has a lifecycle, it survives you switching away, and it produces artifacts rather than a transcript.

How the Codex Security Plugin Gets Into the Sidebar

The Security section does not ship enabled. It arrives with the plugin, and the install path is short.

Open Codex in the ChatGPT desktop app, go to Plugins, and search for Codex Security. Install it, confirm it is enabled, and Security appears in the sidebar. That is the entire desktop setup. The plugin quickstart documents the equivalent terminal path for anyone who prefers it: run codex inside a repository, enter /plugins, search for Codex Security, select Install plugin, then /new to start a fresh chat scoped to that repository.

Prerequisites Worth Checking Before You Install

Two requirements sit behind the install and both are easy to skip past. The first is authorisation: Codex Security is a tool for reviewing code you own or have explicit permission to assess, and the starter prompts ask you to state that authorisation before a scan begins. That is not decorative. Pointing an agentic security researcher at a third-party repository and acting on what it finds is a different activity with a different legal footing.

The second is model configuration. The documentation is direct about it — use gpt-5.6-sol with xhigh reasoning effort for best scan quality. Codex Security will run at lower effort, and it will produce a shorter, cheaper, noticeably shallower scan. If you are evaluating the tool and you run it at medium effort on a fast model, you are evaluating something other than what OpenAI shipped.

There is also a plugin-version dimension that most teams will not think to check. The Codex Security plugin has moved quickly — the plugin changelog records the initial security review capability in 0.1.7 on 4 June 2026, the dedicated findings workspace and JSON, CSV, and SARIF export in 0.1.9 on 18 June, vulnerability write-ups and hardening portfolios in 0.1.11 on 10 July, cross-repository deep scan coordination in 0.1.12 on 23 July, deployment-context-aware findings review in 0.1.13 on 25 July, scan history and security-policy definition in 0.1.14 on 28 July, and scan lifecycle metadata, false-positive feedback, and Windows path handling in 0.1.15 on 30 July. Six weeks separates the first release from the current one, and the behaviour you read about in a review from June is not the behaviour you get today.

Inside the Codex Security Workbench: Scans, Findings, Repositories

The three panels are not arbitrary. They map onto the three questions a security programme actually asks: what did we look at, what did we find, and what is still open.

Scans Answers “What Did We Look At”

Every scan records its target, its scope, the producer that generated it, and the artifacts it sealed. Reopening a completed scan shows you findings, coverage, and the available report artifacts together, which is deliberate — coverage is the context that makes a finding count meaningful. Ten findings from a scan that covered four of eleven services is a different result from ten findings from a scan that covered everything.

Findings Answers “What Did We Find”

The Findings workspace carries severity and confidence for every issue, along with location, evidence, and remediation. Codex Security assigns a verdict and a confidence to each finding rather than dumping an undifferentiated queue, and the newer plugin releases let you submit false-positive feedback directly from the workbench so that a dismissal is recorded with a reason rather than lost in someone’s memory.

Repositories Answers “What Is Still Open”

Repository history plus open findings is the view that supports a programme rather than an audit. It is also where the value of running Codex Security repeatedly shows up, because a finding that persists across four scans is telling you something different from one that appeared once and was fixed.

Running Your First Codex Security Repository Scan

The desktop flow is four decisions and a button. Select Security in the sidebar, open Scans, and select + Scan. Choose an existing repository or point at another folder. Choose Codebase as the scan type. Leave the deep scan toggle off for the first run. Select the whole repository or one folder. Optionally add context describing attack vectors or security-sensitive areas. Select Start scan, and monitor progress in the workbench.

Two details are worth doing properly rather than quickly. Confirm the branch and the latest revision before starting — a scan of a stale checkout produces findings against code nobody is running, and the scan manifest will faithfully record that you did it. And be sparing with the free-text context. The guidance is to add context only when it clarifies threat models or security boundaries; a paragraph of general encouragement does nothing, while “the admin package is reachable only through an mTLS-authenticated internal ingress” changes what the agent considers reachable.

You can also launch a scan from inside a Codex conversation rather than the workbench, using $codex-security:security-scan and optionally naming a component to focus on. The result lands in the same Scans list. For teams that already work conversationally in Codex, this is usually the faster entry point.

Repository or Folder: Choosing Codex Security Scan Scope

Scope is the decision that most affects whether a Codex Security scan is useful, and the scan documentation gives a clean rule for it.

Scan the whole repository when the repository is a coherent review unit — one service, one application, one library, with a shared threat model and a single set of trust boundaries. The agent builds one threat model for what it is looking at, and a coherent target produces a coherent model.

Scan one folder when you are in a monorepo and a service, package, or component has a clear owner and a real security boundary. This is the more common enterprise case and the one people get wrong, because pointing Codex Security at a forty-service monorepo produces a threat model that is true of nothing in particular. Folder scoping is not a performance optimisation; it is how you get the threat model to match a system that actually exists.

The same instinct that governs scope here governs consolidation elsewhere in a security stack. We made the argument at length in our piece on avoiding security tool sprawl with unified SecOps: the failure mode is rarely too little tooling, it is tooling pointed at boundaries nobody owns.

The Seven Phases of a Codex Security Scan

A standard Codex Security scan runs through seven phases in sequence, and the workbench shows you which one you are in. Understanding the sequence is what stops people killing a scan at minute twelve because “it has not found anything yet.”

Threat modelling comes first. The agent reads the codebase to work out what the system is, what it trusts, where its boundaries sit, and what an attacker would want. Nothing is reported during this phase and it is the phase that most determines the quality of everything after it.

Finding discovery follows, exploring realistic attack paths rather than matching patterns. Validation comes next, and this is where Codex Security attempts to reproduce candidate issues in an isolated environment to confirm they are real. Impact analysis then classifies what a confirmed issue would actually cost, which is how severity gets assigned against your system rather than against a generic CVSS intuition.

Reporting assembles findings, evidence, and remediation guidance. Structural hardening produces recommendations that are not tied to a specific finding — the architectural changes that would remove whole classes of issue rather than the one instance discovered. Finalisation seals the artifacts.

The instruction in the documentation is blunt and correct: watch the phase indicator rather than halting prematurely. A scan that has spent twenty minutes in threat modelling is not stuck, it is doing the part that makes the rest worth reading.

Deep Scans: When Codex Security Should Take Longer

The deep scan toggle is the single largest quality lever in the workbench, and the guidance on when to pull it is specific.

A deep scan is a slower, more thorough review of a repository or scoped folder with reduced variability between runs. It searches the repository more extensively through repeated discovery passes, and it exists because a single discovery pass on a large codebase is stochastic in ways that make results hard to compare. If you have run the same standard scan three times and got three overlapping-but-different result sets, the deep mode is the answer to that specific complaint.

The costs are real. Deep scans need substantially more time and compute, they require delegated workers, and they lean harder on the high-effort model configuration. Plugin 0.1.12 added coordination of deep scans across repositories with visibility into worker capacity, which is an acknowledgement that this is a resource-scheduling problem at organisational scale rather than a checkbox.

The recommended sequence is to start with a standard scan to check your scope and your results, then escalate to a deep scan when you need a more thorough assessment. And there is one hard limitation to remember: deep scans do not support pull requests or diffs. For change review you use the diff workflow instead, which is a different command with a different shape.

How Codex Security Validates Findings Instead of Guessing

Validation is the claim that separates Codex Security from the previous generation of scanners, and it is worth being precise about what is being claimed.

After identification, the agent attempts to reproduce each candidate issue in an isolated environment. It is trying to demonstrate that the vulnerable path is reachable under the stated preconditions and that reaching it crosses a supported security boundary. Where it succeeds, the finding carries that evidence with it into the workbench. Where it cannot, the finding does not silently become a confirmed issue.

The measurable effect showed up in the beta: false-positive rates fell by more than 50% across scanned repositories over the run, and independent commentary has put the practical noise reduction against traditional SAST as high as 84%. Those are different numbers measuring different things, and both point the same direction — the value is not in finding more, it is in the queue being worth reading.

That said, validation in an isolated environment is not the same as exploitation against a live system, and the distinction is exactly where the honest limits of the tool sit. We come back to that below.

The Codex Security Triage Model: Confirmed, Not Actionable, Needs Review

Every finding gets exactly one verdict, and the triage documentation defines each one tightly.

A finding is confirmed when repository evidence shows the vulnerable path is reachable under the stated preconditions and crosses a supported security boundary. It is not_actionable when repository evidence eliminates the claim — an unaffected version, an unreachable path, an effective guard, a surface that is not shipped. It is needs_review when repository evidence is not enough to decide, because required information is missing, ambiguous, runtime-dependent, environment-dependent, or policy-dependent.

That third category is the one that makes the model credible. Most scanners force a binary and pay for it in either noise or silence. Codex Security has a place to put “I cannot settle this from the code alone,” and it uses it.

Exploitability ranks are positive integers starting at 1, maintained separately inside each verdict queue. Rank 1 in the confirmed queue is the most exploitable confirmed issue; rank 1 in the needs_review queue is the highest-priority thing to go and check. Keeping the two rankings separate is a deliberate choice that stops unresolved work from competing with remediation work for the same attention.

The recommended order follows from the structure. Work the confirmed queue in rank order using the fix workflow. Take needs_review findings to dynamic testing when runtime evidence would resolve the uncertainty. Escalate policy-dependent findings to whoever owns the policy. Archive not_actionable findings with their evidence intact rather than deleting them, because the next scan will rediscover the same code and you want the reasoning preserved.

The Artifacts a Codex Security Scan Leaves Behind

A completed scan writes a structured directory rather than a wall of text, and the file list is short enough to memorise.

scan-manifest.json records the target, the scope, the producer, and the sealed artifacts — it is the provenance record for the scan itself. findings.json carries severity, confidence, locations, evidence, and remediation for every finding. coverage.json records reviewed surfaces, exclusions, deferred work, open questions, and whether coverage was complete, partial, or unknown. report.md is the human-readable summary. An artifacts/ directory holds supporting data, a findings/ directory holds per-vulnerability reports, and hardening/ holds the structural recommendations. When produced, exports/results.sarif is the integration path into everything else that speaks SARIF.

The structural point is that Codex Security is designed to be consumed by other systems, not just by a person reading a chat window. SARIF export lands findings in the same pipeline as the rest of your static analysis. The JSON files make scan-over-scan comparison mechanical. That is what allows the tool to become part of a programme rather than an event.

Why coverage.json Is the Most Important File Codex Security Writes

If you read one artifact from a scan before you act on anything, read coverage.json.

Findings tell you what was discovered. Coverage tells you what the discovery was worth. It enumerates the surfaces that were reviewed, the ones that were excluded, the work that was deferred, the questions left open, and a completeness status of complete, partial, or unknown. A clean findings list against partial coverage is not a clean bill of health, and the documentation says so explicitly: verify coverage completeness before treating a scan as conclusive evidence.

This is the part most likely to be lost in translation when results move up a reporting chain. “Codex Security found no critical issues” is a sentence that survives being forwarded. “Codex Security found no critical issues across the 60% of the surface it reviewed, deferring the auth middleware and the payment integration” is the sentence that is actually true, and it is the one that has to reach the person making a release decision. The same discipline underpins any credible attestation work, which is why it maps so directly onto the evidence expectations we described in our look at the real benefits of SOC 2 compliance.

SECURITY.md: Giving Codex Security a Threat Model to Work From

The single highest-leverage thing you can do to improve scan results costs an afternoon and lives in your repository.

Add a SECURITY.md at the repository root containing persistent security guidance: your threat model, your security invariants, your trust boundaries, and severity context specific to your system. The agent reads it and uses it. Nested SECURITY.md files give directory-specific policy in a monorepo, which pairs naturally with folder-scoped scanning. Build and validation commands belong in AGENTS.md so the agent can actually exercise the code during validation.

Plugin 0.1.14 added $codex-security:define-security-policy specifically to help draft that file, which is a good indication of how much it affects output quality. Without it, Codex Security infers your threat model from the code alone and infers it reasonably well. With it, the agent knows which invariants you consider load-bearing, and findings get scored against your actual risk posture instead of a generic one.

There is an obvious second benefit. Writing down your trust boundaries and invariants is the exercise most engineering teams have never done, and the document outlives any particular scanner. The tooling that reads it will change; the artefact is the asset.

Codex Security in the CLI Versus the Desktop App

The desktop workbench is one of three front doors, and choosing the wrong one for a given job is a common early mistake.

The CLI installs from npm as @openai/codex-security, needs Node 22.13 or newer and Python 3.10 or newer, and is published under Apache-2.0. You authenticate with npx @openai/codex-security login, or login --device-auth on a headless box, or an OPENAI_API_KEY environment variable for CI — where API keys take precedence for unattended runs. Then scan does the work, with flags for model and effort, --path for targeted directories, --diff origin/main --head HEAD for committed changes, --working-tree --base HEAD for uncommitted ones, --mode deep for deep scans, --knowledge-base to attach architecture or policy documents, and --max-cost to stop a scan at a spend threshold. There is a --dry-run that validates inputs without invoking the model, which is the flag to reach for when you are debugging a CI integration.

The CLI also carries the operational commands the workbench does not: install-hook for a pre-commit check that blocks high-severity findings, scans list, show, and rerun, scans compare and scans match to classify findings across two scans as new, persisting, reopened, resolved, or unknown, findings false-positive to annotate a dismissal with a reason, and bulk-scan for driving many repositories at once with a CSV, a worker count, and optional Docker Compose containerisation on a Linux host with unprivileged namespaces.

The split is clean in practice. Use the desktop workbench for exploratory security work, manual triage, reporting, and hardening conversations. Use the CLI for automation, CI, fleet-wide sweeps, and anything that needs to be reproducible without a human present. The cloud service is the third door, connecting directly to GitHub repositories and scanning commit by commit against a repo-specific threat model — that is the continuous-monitoring posture rather than the point-in-time one.

Scanning Code Changes Instead of Whole Repositories

Whole-repository scanning is the wrong default for day-to-day work, and Codex Security has a separate workflow for the thing most teams need most often.

The change-review path reviews a Git-backed changeset — a pull request, a commit, a branch diff, or a working-tree patch — for security regressions before merge. In conversation it is $codex-security:security-diff-scan; on the command line it is the --diff and --working-tree flags. The documented focus areas are the ones that matter in review: authentication and authorisation logic, input handling and parsing, secrets and credential management, filesystem operations, network requests, and dependency changes.

The recommended discipline is to ask for review artifacts first without fixes, so the findings survive as a reference, and only then open bounded fix tasks against findings that are actionable and evidence-backed. Inline comments on affected lines go to humans for judgement rather than straight to a patch.

This is also where the AI-generated-code problem becomes concrete. A DryRun Security study found that when AI agents built applications, 87% of pull requests contained at least one software vulnerability, with broken access control dominant. Running Codex Security over agent-authored diffs before merge is the narrowest, highest-value application of the whole tool, and it is the one most likely to survive a budget conversation. The broader governance framing sits in our piece on where enterprise AI agent governance has not caught up.

From Aardvark to Codex Security: How This Got Here

The Security section in the desktop app is the visible end of a two-year programme, and the history explains the design.

OpenAI introduced Aardvark on 30 October 2025 as an agentic security researcher in private beta, powered by GPT-5. The method was already what Codex Security uses today: analyse an entire repository to build a contextual threat model, scan every new commit against it, reproduce candidate issues in a sandbox to confirm they are real, then propose a fix through Codex and hand it to a human. On benchmark “golden” repositories it identified 92% of known and synthetically introduced vulnerabilities. Applied to open-source projects, it found and responsibly disclosed enough issues that ten received CVE identifiers.

In early March 2026, Aardvark became Codex Security and moved to research preview, rolling out to ChatGPT Enterprise, Business, Edu, and Pro customers with a 30-day free beta. The desktop plugin followed on 4 June 2026, and the sidebar workbench in its current form assembled itself over the eight weeks after that.

The through-line matters because it tells you what the tool is optimised for. This was built as a security researcher that happens to be automated, not as a scanner that acquired an LLM. The threat-model-first sequencing, the sandbox validation, the refusal to assert what it cannot demonstrate, and the human-in-the-loop patch model all come from that origin.

What Codex Security Found in the Beta

The beta results are the strongest available evidence about the tool, and they are worth reading carefully rather than as a headline.

Across roughly 1.2 million commits in external repositories, Codex Security produced 792 critical findings and 10,561 high-severity findings, while false-positive rates fell by more than 50% over the period. The projects involved include OpenSSH, GnuTLS, GOGS, Thorium, libssh, PHP, and Chromium — heavily reviewed, security-conscious codebases with decades of human attention on them.

The CVE trail is specific: CVE-2026-24881 and CVE-2026-24882 in GnuPG, CVE-2025-32988 and CVE-2025-32989 in GnuTLS, CVE-2025-64175 and CVE-2026-25242 in GOGS, and CVE-2025-35430 through CVE-2025-35436 in Thorium. The bug classes are the ones that have resisted automation longest: heap buffer overflows, double frees, and authentication bypasses.

OpenAI’s framing is that Codex Security builds deep context about a project to identify complex vulnerabilities other agentic tools miss, surfacing higher-confidence findings. Two caveats belong next to that. Finding memory-safety bugs in C is a different problem from finding authorisation flaws in a business application, and the beta corpus is skewed towards the former. And a declining false-positive rate over a run is a statement about improvement, not about the absolute rate you should expect on your first scan of your own code.

Where Codex Security Still Cannot Reach

Every honest assessment of Codex Security has to name the surfaces it cannot see, because the tool reads code and a great deal of security does not live in code.

Runtime-only issues are invisible to it. Misconfigured CORS policies, debug modes left enabled in a deployed environment, weak TLS configuration, and proxy misconfigurations are all properties of a running system rather than a repository. A scan of the source will not tell you that staging is serving with a permissive origin header.

Authorisation flaws are the harder gap. Broken Object Level Authorization sits at the top of the OWASP API Security list, and confirming it requires sending authenticated requests across real identities to see whether one user can reach another’s data. That is a live-system test by definition. Codex Security can flag a suspicious pattern and mark it needs_review; it cannot close the question from the repository.

Business logic flaws that emerge from component interaction are the third gap — replaying a request with a modified price, chaining API calls into privilege escalation, exploiting a race between two services that are individually correct. None of that is legible in a single codebase.

The DAST-side critique is fair on all three counts, and the correct conclusion is complementarity rather than replacement. Code analysis catches source-level defects with unprecedented context; runtime testing validates exploitability against what is actually deployed. The needs_review queue is, in effect, the tool telling you which findings to hand to the runtime side. Treating it as a work queue for dynamic testing is the most useful thing you can do with it, and it fits the same layered posture we set out in our identity-centric zero trust architecture guide.

What Codex Security Means for the Security Tooling Budget

The commercial question arrives quickly, and the answer is less dramatic than either the marketing or the scepticism suggests.

Codex Security rides your ChatGPT plan rather than carrying separate licensing. It is a research preview available on Pro, Business, Enterprise, and Edu. Since 2 April 2026, Codex usage across Plus, Pro, and Business has been billed against token-based credits rather than per-message, and workspaces on flexible pricing can buy additional credits when they run out. Deep scans at xhigh effort on a large repository consume meaningfully more than a chat session, which is precisely why --max-cost exists in the CLI.

The realistic budget effect is not that Codex Security replaces a line item. It is that a capability which previously required either a specialist consultancy engagement or a mature internal AppSec function is now available to teams that have neither. A four-person product team can run a validated security review of their own repository this afternoon. That was not true in 2025.

What it does not do is eliminate the runtime testing line, the dependency scanning line, or the human review line. Teams that cancel one of those on the strength of a clean Codex Security report will discover the coverage gap the expensive way. The consolidation opportunity is real but it is in the noise-heavy middle of the stack — the legacy SAST products whose entire value proposition was pattern coverage — not at the edges.

The Governance Questions a Local Codex Security Scan Raises

Running an agentic security researcher over your source code is a data-handling decision, and it deserves a decision rather than a default.

The first question is what leaves the machine. The CLI stores scan history and workbench state locally, and the documentation describes Codex Security as a local tool for reviewing repositories you trust and have permission to assess. Analysis still requires the model, which means code context travels to OpenAI under whatever terms your plan carries. Enterprise and Business agreements handle this differently from consumer plans, and the answer has to come from your contract rather than from a blog post.

The second is authorisation, and it is not merely a formality. Scanning a vendor’s repository, a fork you do not own, or a client codebase without written permission is a category of activity with real consequences, and the fact that the tooling asks you to assert authorisation is a hint about how seriously to take it.

The third is what happens to findings. A scan produces a machine-readable list of confirmed, exploitable vulnerabilities in your product with reproduction evidence attached. That file is one of the most sensitive artifacts your organisation will generate. It should not sit in a repository, a shared drive, or a chat thread with default permissions, and the retention question deserves an answer before the first scan rather than after the first incident. The disciplines are the ones we walked through in why AI-era ransomware detection has to start with data handling.

Who Codex Security Is Actually For

The tool lands differently depending on where you sit, and being clear about that prevents a lot of disappointed evaluations.

For small engineering teams without a security function, this is the largest single capability jump available right now. A validated finding with reproduction evidence and a proposed patch is something a generalist developer can act on, which is not true of most SAST output. Start with the desktop workbench, scan one service, write a SECURITY.md, and run it again.

For platform and AppSec teams, the value is in the CLI and the cloud service rather than the sidebar. Bulk scanning across a fleet, SARIF into the existing pipeline, scans compare for regression tracking, and pre-commit hooks blocking high-severity findings are the integrations that change a programme. The desktop workbench becomes the triage surface for the hard findings that need a human.

For security consultancies and red teams, the honest position is that Codex Security compresses the discovery phase of a code review substantially and does not touch the parts of the engagement that require judgement, runtime access, or an adversarial mindset applied to a whole system. The needs_review queue is where the human work concentrates.

For organisations that are shipping AI-generated code at volume — which is now most of them — the diff-scan workflow before merge is the one to implement first, ahead of everything else on this list. The skills question that sits behind that decision is one we covered in the AI technical skills gap that matters most.

Codex Security Rollout Roadmap

The sequence below is how to adopt Codex Security without either wasting the capability or over-trusting it. It assumes a team that has the desktop app and no existing AppSec programme.

Confirm Authorisation and Plan Access

Establish in writing which repositories you are permitted to scan, and confirm your ChatGPT plan includes the research preview. Do this before the install, not after the first scan raises a question in a compliance review.

Install the Plugin and Set the Model

Install Codex Security from Plugins, confirm Security appears in the sidebar, and set gpt-5.6-sol with xhigh reasoning effort. A scan at default effort on a fast model is not the product being evaluated.

Scan One Coherent Service First

Pick a single service or package with a clear owner and a real boundary. Leave deep scan off. The goal of the first run is to calibrate scope and output shape, not to find everything.

Read coverage.json Before findings.json

Establish the habit immediately. Check what was reviewed, what was excluded, what was deferred, and whether completeness came back complete, partial, or unknown. Every downstream conversation depends on that number.

Write SECURITY.md and Rescan

Capture your threat model, trust boundaries, invariants, and severity context, using $codex-security:define-security-policy to draft it. Rescan the same target and compare. The delta between those two runs is the best available demonstration of what context is worth.

Work the Confirmed Queue in Rank Order

Fix confirmed findings by exploitability rank. Route needs_review findings to dynamic testing or to whoever owns the relevant policy. Archive not_actionable findings with evidence intact and a recorded reason rather than deleting them.

Automate the Diff Scan Before the Full Scan

Put change review into CI before you put full repository scanning there. Scan pull-request diffs, preserve artifacts, upload SARIF, and set a severity policy. Optionally add the pre-commit hook locally. Regression prevention pays back faster than periodic full sweeps.

Escalate to Deep Scans on a Cadence

Once standard scans are routine and the noise is calibrated, schedule deep scans against whole repositories at a cadence your credit budget supports — quarterly for most teams, before a major release for anything customer-facing. Use scans compare to track what changed rather than rereading each report from scratch.

Metrics That Matter

If you are running Codex Security as part of a programme rather than as a one-off, these are the measures worth tracking. Total findings is not one of them.

Metric	What it tells you	How to read it
Coverage completeness	Whether the scan was conclusive	Track complete / partial / unknown per scan; partial is the default reality
Confirmed-to-total ratio	Signal density in the queue	Rising over time usually means better SECURITY.md context
Needs_review backlog age	Whether runtime validation is happening	A growing queue means findings are being parked, not resolved
Time to fix by exploitability rank	Whether ranking drives behaviour	If rank 1 and rank 9 close at the same rate, the ranking is decorative
Regression catch rate on diffs	Value of change review in CI	Count issues caught pre-merge versus found in later full scans
False-positive annotations per scan	Calibration of your threat model	Annotate with reasons; a spike points at a missing invariant
Persisting findings across scans	Real remediation throughput	A finding on its fourth scan is a process problem, not a tooling one
Deferred surfaces per repository	Where your blind spots live	These accumulate silently and are the likeliest source of a surprise

Common Mistakes

The first mistake is treating a clean Codex Security report as a clean bill of health without reading coverage. Partial coverage with zero findings is the most dangerous output the tool produces, because it reads exactly like success.

The second is running at low reasoning effort to save credits and then judging the tool on the result. The documentation names the configuration for a reason, and a cheap scan is a different product.

The third is pointing Codex Security at an entire monorepo and expecting a coherent threat model. Scope to the unit that has an owner and a boundary, or accept that the model describes nothing in particular.

The fourth is skipping SECURITY.md. It is the cheapest quality improvement available and the one most consistently left undone, and the difference between a scan with and without it is not marginal.

The fifth is treating needs_review as a rejection queue. It is a routing instruction — those findings need runtime evidence or a policy decision, and quietly closing them converts an honest uncertainty into a silent gap.

The sixth is deleting not_actionable findings instead of archiving them with evidence. The next scan will rediscover the same code, and without the recorded reasoning someone will triage it again from scratch.

The seventh is assuming Codex Security covers runtime, configuration, and authorisation-in-practice. It reads code. CORS, TLS, debug flags, BOLA, and cross-service business logic live somewhere else, and pretending otherwise is how a coverage gap becomes an incident.

The eighth is letting scan artifacts sit with default permissions. A validated, reproducible list of exploitable vulnerabilities in your product is a target in its own right, and it should be handled like one.

Frequently Asked Questions

What is the Security section in the ChatGPT desktop app?

It is the Codex Security workbench. After you install and enable the plugin, a Security item appears in the desktop app sidebar, opening onto Scans, Findings, and Repositories, where you can run repository scans, triage results, and track open issues over time.

How do I add Codex Security to the sidebar?

Open Codex in the ChatGPT desktop app, go to Plugins, search for Codex Security, install it, and confirm it is enabled. Security then appears in the sidebar. The equivalent CLI path is /plugins inside a repository, then Install plugin.

Which plans include Codex Security?

It is a research preview available to ChatGPT Pro, Business, Enterprise, and Edu customers. It rides your existing ChatGPT plan rather than carrying separate licensing, and usage is billed against token-based credits.

How do I run a repository scan?

Select Security in the sidebar, open Scans, select + Scan, choose a repository or folder, choose Codebase, leave deep scan off for a first run, optionally add threat-model context, and select Start scan. Progress shows in the workbench phase indicator.

What is the difference between a standard and a deep Codex Security scan?

A deep scan is slower and more thorough, uses repeated discovery passes, and produces less variability between runs. It needs delegated workers and more compute. Start with a standard scan to check scope, then escalate. Deep scans do not support pull requests or diffs.

Can Codex Security review a pull request?

Yes, through the change-review workflow rather than a deep scan — $codex-security:security-diff-scan in conversation, or --diff and --working-tree on the CLI. It targets authentication, input handling, secrets, filesystem operations, network calls, and dependency changes.

What files does a scan produce?

report.md for humans, plus findings.json, coverage.json, and scan-manifest.json for machines, along with findings/, hardening/, and artifacts/ directories and a SARIF export when produced.

How reliable are the findings?

Codex Security validates candidates by attempting to reproduce them in an isolated environment, and false-positive rates dropped by more than half across the beta. Findings it cannot settle from repository evidence are marked needs_review rather than asserted, which is the mechanism that keeps the confirmed queue meaningful.

What can Codex Security not find?

Anything that only exists at runtime — CORS and TLS misconfiguration, debug modes in deployed environments, proxy issues — plus authorisation flaws like BOLA that require authenticated requests across real identities, and business logic flaws that emerge from component interaction. Pair it with dynamic testing.

Is my code sent to OpenAI?

Scan history and workbench state are stored locally, but analysis requires the model, so code context is processed by OpenAI under the terms of your plan. Enterprise and Business agreements differ from consumer plans; confirm the specifics against your own contract before scanning sensitive repositories.

Does Codex Security fix vulnerabilities automatically?

No. It proposes patches for human review. The workflow is deliberately human-in-the-loop, inherited from Aardvark, and fixes are opened as bounded tasks against findings you have accepted.

What was Aardvark?

Aardvark was OpenAI’s agentic security researcher, announced on 30 October 2025 in private beta. It scored 92% recall on benchmark repositories and earned ten CVEs on open-source projects. It became Codex Security in March 2026.

Final Verdict

Putting a Security section in the ChatGPT desktop app sidebar is a smaller engineering decision than it is a distribution decision, and the distribution is what makes it significant. Validated, context-aware application security review used to require a consultancy engagement or a dedicated function. It now requires installing a plugin, and the agent behind it has already found memory-safety bugs and authentication bypasses in OpenSSH, Chromium, and PHP.

The design choices are the right ones. Threat modelling before discovery. Sandbox validation before assertion. A needs_review verdict for things the code cannot settle. Coverage reported as a first-class artifact rather than buried. Patches proposed rather than merged. Every one of those is a decision to be less impressive and more useful, and collectively they are why the Codex Security output is worth reading in a way that most scanner output is not.

The limits are equally clear and should be stated as often as the capabilities. Codex Security reads repositories. It does not see your deployed configuration, it cannot confirm an authorisation flaw without live identities, and it cannot reason about business logic that emerges between services. Coverage on a real codebase will frequently come back partial. A team that treats a clean report as an assurance artefact has misunderstood what they bought, and the tool told them so in coverage.json.

The practical recommendation is narrow and confident. Install it, scan one service you own, write a SECURITY.md, and put diff scanning into CI ahead of everything else — particularly if AI agents are writing any meaningful share of your code, where the evidence on vulnerability rates in generated pull requests is genuinely alarming. Read coverage before findings, work the confirmed queue by rank, and route needs_review to whoever can test it against something running. Do that and Codex Security is the most valuable thing in your security stack that costs nothing extra. Skip the coverage discipline and it becomes a very sophisticated way to feel safe.