OpenAI's Codex Security Review Catches 74% of Real Bugs Semgrep Misses
Codex Security Review now automatically scans GitHub PRs for vulnerabilities using full repo context, threat models, and sandbox validation — free during preview.
- OpenAI launched Codex Security Review in research preview, adding deep security scanning directly to GitHub PRs.
- It goes beyond diff-level checks by using full repository context, a project-specific threat model, and sandbox validation to confirm findings before surfacing them.
- Trigger it manually with
@codex security reviewin any PR comment, or configure automatic reviews on PR open or every push. - Independent testing shows a 74% true positive rate vs. 20% for Semgrep and 28% for Snyk on the same codebase.
- Available free (no credit consumption) during the introductory period for Enterprise, Business, Edu, and Pro plans -- not available on Plus.
- Limitations include no compliance reporting, slow initial scans on large repos, and GitHub-only support for now.
OpenAI just expanded Codex Security Review into research preview, bringing deep, context-aware security analysis directly into your GitHub pull request workflow. Instead of a generic diff scan, it reads the PR alongside your full repository context and a project-specific threat model to surface findings that actually matter.
Security review that reads the room
The core problem with traditional static analysis tools like Semgrep or SonarQube is noise. If you've used tools like SonarQube, you know the pain: hundreds of alerts, most of them irrelevant. Codex Security takes a fundamentally different approach -- it understands your codebase contextually, how data flows between services, where authentication boundaries exist, which inputs reach sensitive operations.
Codex Security uses language-model reasoning, test-time compute, tool use, and large context, rather than fuzzing or signature-based scanning. That means it can reason about multi-step attack paths rather than just flagging a suspicious function call in isolation.
Codex Security is built around three stages: identification, validation, and remediation. During identification, it analyzes the repository and explores realistic attack paths. During validation, it attempts to reproduce each issue to confirm it is real. During remediation, it generates a concrete patch that teams can review and raise into a pull request.
What Security Review adds on top of Code Review
Codex already had a general-purpose Code Review feature for PRs. Security Review is a separate, deeper pass specifically for security risks. It reduces noise by validating findings before you review them, and moves findings toward fixes with ranked results, evidence, and suggested patch options. You may see some overlap between the two, but Security Review goes further by incorporating your threat model and repository-level context.