The Pulse
OpenAI Adds Scheduled Security Scans to Codex Cloud
OpenAI added scheduled GitHub repository scans and ongoing new-commit checks to Codex Security Cloud. The service investigates findings, removes duplicates and prepares proposed fixes for human review.
AI.info Team · Written with AI ·
OpenAI’s Codex Security Cloud can now check GitHub repositories on a schedule and continue reviewing new commits, turning repository security scans into an ongoing cloud service rather than a task developers must keep running locally. The company added the feature to its release notes on September 29, 2026, alongside a separate Codex Code Review update for pull requests.
Scheduled scans, plus checks on new commits
Teams can run scans on demand or set them to recur. After setup, ongoing checks review new commits; scans run in OpenAI’s cloud and can continue after a user closes a laptop. The service investigates potential findings, removes duplicates and prepares proposed fixes for review, according to OpenAI’s release notes.
That workflow addresses two related but distinct jobs. Codex Security Cloud looks for vulnerabilities in connected repositories and changes over time, while the separate Code Review feature reads pull-request summaries and diffs, surfaces findings and lets users discuss changes before sharing feedback. Keeping the products distinct matters: the announcement describes security checks on new commits, not an automatic security review of every pull request.
From a repository model to a proposed patch
OpenAI’s Codex Security documentation says the service connects to GitHub and builds a threat model tailored to a codebase. The model maps attacker entry points, trust boundaries, sensitive data and high-impact code paths. Teams can inspect and edit it to reflect their application’s deployment assumptions.
For a potential vulnerability, Codex Security attempts to reproduce the issue in an isolated environment before surfacing it. For findings it validates, it proposes a patch that people can review and turn into a pull request. OpenAI says the tool does not automatically modify a team’s code. The documentation also describes revalidation after a confirmed fix is patched and merged, linking detection to a check on the remediation.
The process is intended to give reviewers more than an alert: the service can provide attack-path analysis, execution details and proof-of-concept artifacts for validated findings. OpenAI’s documentation says the system uses language-model reasoning, tool use and large context rather than fuzzing or signature-based scanning. That makes human review an important part of the workflow, especially when teams assess whether a proposed fix fits their code and operating conditions.
Access depends on permissions and billing
OpenAI’s release notes say access requires the applicable workspace permissions, repository setup and billing configuration. The company says existing Codex Security customers must opt in before paid usage begins. Its separate product documentation identifies Codex Security as a research preview for ChatGPT Enterprise, Edu, Business and Pro users, and says Cloud usage is token-billed.
For Enterprise and Edu workspaces, administrators must enable both Codex Cloud and Codex Security permissions, and can restrict access by role or group. The documentation recommends starting with a small set of repositories and dedicated reviewers, noting that onboarding and vulnerability sharing remain relatively manual. It also advises teams to keep generated patch pull requests in their ordinary review process.
Security scans are not the same as code approval
Codex Security Cloud’s new recurring checks could help teams revisit code as repositories change, but the launch does not make its proposed fixes self-approving. The product prepares patches for people to assess, and access carries workspace and billing requirements. OpenAI’s release notes also limit Daybreak Blue model access to the Codex Security Cloud product; the feature does not confer access to those models elsewhere.