Editorial illustration for OpenAI Enhances Codex to Boost Cybersecurity Defense and Analysis Capabilities
OpenAI Codex Revolutionizes Cybersecurity Code Analysis
OpenAI upgrades Codex, launches trusted access program for cyber defense
Every new AI tool is a dual-use weapon. OpenAI just sharpened its most dangerous one yet. The company has upgraded Codex, its model that writes and analyzes software.
It also launched a trusted access program specifically for cybersecurity, a direct attempt to hand this powerful code-picking AI to defenders and, ideally, keep it from attackers. Proof of the fragility of that line comes from a recent test. Security researcher Andrew MacPherson gave an older Codex version a known bug in the popular React framework.
The model didn't just spot the reported issue. It dug up three completely new, previously unknown vulnerabilities. Each could crash services or leak source code.
The increased ability to analyze code can be used for both defense and attack, and OpenAI cites a recent incident as proof. Security researcher Andrew MacPherson reportedly used an earlier version of the model to investigate a vulnerability in the React framework. The AI discovered unexpected behaviors that, after further analysis, led to three previously unknown vulnerabilities capable of paralyzing services or exposing source code.
According to OpenAI, the discovery demonstrates how autonomous AI systems can speed up the work of security researchers. OpenAI now rates the model at nearly a "high" level within its Preparedness Framework for cybersecurity.
Finding those unknown flaws is the holy grail. It's also a blueprint for a new attack. OpenAI's response is the trusted access program—an admission the genie is too powerful to bottle, so they're trying to control who rubs the lamp.
The model itself now sits near the "high" risk level on their internal scale. This isn't about features. It's about force multiplication.
A tool that audits a million lines of code in minutes changes the entire tempo of cyber conflict. Defenders get a monumental advantage. So would anyone else who gets it.
The upgrade makes Codex better. The trusted program is a bet its job can be kept constructive. A thin policy stands between a scalpel and a sword.
Related Reading
Browse all OpenAI news →
LLMs & Generative AI ChatGPT's 'Nerdy' tweak rewards goblin metaphors in answers, study finds
LLMs & Generative AI Google tests visual 'magazine-style' UI for Gemini 3 Pro users
LLMs & Generative AI AI Engineers Face Rising Costs, Need New Strategies for Efficiency
Related Topic OpenAI hires 630 ex-Meta staff as ChatGPT memory may turn data into ads
Business & Startups
Related Topic Sen. Warren urges Trump admin to expand AI credit after OpenAI letter
Business & Startups
From Archives OpenAI, Anthropic to spot underage users; ChatGPT controls, age checks
From Archives Prompt Engineering Guides LLMs to Audit Data Like Human Validators
From Archives GPT-5.2 leads FrontierScience test, but falters on real research tasks
Research & Benchmarks
From Archives ChatGPT Image-1.5 Generates Crowd-Sentiment Images from 11 Prompts
Common Questions Answered
How did Andrew MacPherson use OpenAI's Codex to discover vulnerabilities in the React framework?
MacPherson utilized an early version of the Codex model to investigate potential weaknesses in the React framework's code. Through autonomous analysis, he uncovered three previously unknown vulnerabilities that could potentially paralyze services or expose source code.
What makes OpenAI's Codex upgrade significant for cybersecurity research?
The Codex upgrade provides security researchers with powerful AI-driven tools to autonomously analyze code and detect hidden vulnerabilities. This capability represents a transformative approach to cybersecurity, enabling more sophisticated and proactive identification of potential security risks.
Why does OpenAI describe the Codex's code analysis capabilities as a 'double-edged sword'?
The Codex model can be used for both defensive and potentially offensive purposes in cybersecurity. While it can help researchers uncover and address security vulnerabilities, the same technology could potentially be misused to exploit those same weaknesses in digital infrastructure.
Further Reading
- OpenAI upgrades Codex with a new version of GPT-5 — TechCrunch
- Introducing upgrades to Codex — OpenAI
- Codex changelog — OpenAI for developers
- Addendum to GPT-5.2 System Card: GPT-5.2-Codex — OpenAI
