Summary
OpenAI’s cyber product engineering team, Ian and Kyle, introduce Codex Security and explain how it grew out of the company’s internal security sprint. They argue that the cost of finding vulnerabilities is falling toward zero and that frontier models currently lead open-weight models in cyber capability, creating a “defender’s window” in which software owners can find and fix weaknesses first.
The talk describes OpenAI’s internal “defense factory,” a continuous loop that scans systems, validates vulnerabilities, assigns owners and verifies fixes. According to the presenters, it reached a false positive rate of 0.81% and a rollback rate under 1% for Codex-generated fixes, and 36% of findings across scans turned out to be duplicates. Codex Security is offered as an open-source plug-in, CLI (Apache 2.0) and SDK, and a major update to the turnkey Codex Security Cloud is launching.
Kyle walks through five steps with the CLI: giving agents context, running scans across hundreds of parallel agents, enriching findings through deduplication, prioritization and owner assignment, generating patches for developer review, and integrating the process into the software development lifecycle. The session is a practical guide for engineering and security teams building AI-assisted vulnerability management.
📺 Source: OpenAI · Published November 11, 2026
🏷️ Format: Keynote Launch
