OpenAI's Codex Security finds 14 CVEs

This shows OpenAI is trying to turn AI coding from a speed tool into a trust tool. Finding bugs in mature projects like OpenSSH, GnuTLS, and Chromium matters because these are codebases already watched by expert maintainers, so producing 14 assigned CVEs suggests Codex Security can do more than flag suspicious code. It can surface real, reportable flaws and fit into an actual disclosure and patch workflow.1 2 3 4

• The product is built to act like a human security researcher, not a rules engine. It reads repository history and new commits, builds a project specific threat model, tries to reproduce the flaw in an isolated environment, then proposes a patch for review. That workflow is what makes a CVE outcome plausible rather than just a noisy alert.2 3
• The open source results span very different software categories, from cryptography libraries like GnuTLS to browsers like Chromium and infrastructure software like OpenSSH. That breadth suggests the core advantage is general code reasoning across large codebases, not narrow expertise in one stack or one bug class.1 2 4
• This also sharpens the competitive line versus traditional AppSec scanners. Aardvark, now Codex Security, was described from the start as using model reasoning and tool use instead of fuzzing or signature based scanning. The bet is that customers will pay for fewer but more actionable findings that already include a reproduction path and candidate fix.2 3 5

The next step is security agents becoming a standard part of the pull request and repository workflow. If Codex Security keeps converting scans into validated findings, coordinated disclosures, and accepted patches, AI coding products will compete not just on how much code they generate, but on how much risky code they prevent from shipping.1 2 3