OpenAI's Codex Security Review Catches 74% of Real Bugs Semgrep Misses
Codex Security Review now automatically scans GitHub PRs for vulnerabilities using full repo context, threat models, and sandbox validation — free during preview.
- OpenAI launched Codex Security Review in research preview, adding deep security scanning directly to GitHub PRs.
- It goes beyond diff-level checks by using full repository context, a project-specific threat model, and sandbox validation to confirm findings before surfacing them.
- Trigger it manually with
@codex security reviewin any PR comment, or configure automatic reviews on PR open or every push. - Independent testing shows a 74% true positive rate vs. 20% for Semgrep and 28% for Snyk on the same codebase.
- Available free (no credit consumption) during the introductory period for Enterprise, Business, Edu, and Pro plans -- not available on Plus.
- Limitations include no compliance reporting, slow initial scans on large repos, and GitHub-only support for now.
OpenAI has expanded Codex Security Review into research preview, bringing context-aware security analysis directly into GitHub pull request workflows. Rather than scanning a diff in isolation, it reads the PR alongside the full repository and a project-specific threat model to surface findings that actually matter.
Why this differs from static analysis
Traditional tools like Semgrep or SonarQube generate noise: hundreds of alerts, most of them irrelevant to your specific application. Codex Security takes a different approach by reasoning about how data flows between services, where authentication boundaries sit, and which inputs reach sensitive operations. It uses language-model reasoning, test-time compute, tool use, and large context windows rather than fuzzing or signature-based scanning, which lets it trace multi-step attack paths instead of flagging suspicious function calls in isolation.
The analysis runs in three stages. During identification, it explores the repository and maps realistic attack paths. During validation, it attempts to reproduce each issue to confirm it is real. During remediation, it generates a concrete patch that teams can review and raise into a pull request.
How it differs from Code Review
Codex already includes a general-purpose Code Review feature for PRs. Security Review is a separate, deeper pass focused exclusively on security risks. It reduces noise by validating findings before surfacing them, incorporates your threat model and repository-level context, and ranks results with supporting evidence and patch suggestions. There may be some overlap between the two, but Security Review goes further on all three dimensions.