{"slug": "codex-security-openai-built-an-ai-to-find-security-bugs", "title": "Codex Security: OpenAI Built an AI to Find Security Bugs.", "summary": "OpenAI's Codex Security CLI, an agentic vulnerability hunter, opened 13 pull requests against NVIDIA's OpenShell repo in March 2026, of which two were false positives: one proposed a self-asserted security header that broke existing callers, and another would have blocked sockets needed by the proxy itself, according to a principal engineer's tracker notes.", "body_md": "Member-only story\n\n# Codex Security: OpenAI Built an AI to Find Security Bugs. Its Own Commit History Caught it Lying About One.\n\n## A hands-on breakdown of Codex Security, the CLI OpenAI open-sourced without telling anyone.\n\nIn March 2026, a scanner opened 13 pull requests against NVIDIA’s OpenShell repo. The bot was Aardvark, OpenAI’s agentic vulnerability hunter, before it had the Codex Security name. A principal engineer went through all 13 by hand.\n\nEleven were legitimate. Two weren’t.\n\nOne PR added a security header called `x-sandbox-id`\n\n, meant to identify which sandbox a request came from. The header was self-asserted. Any client could set it to anything. It also broke every existing caller, because the sandbox client that was supposed to send the header never actually sent it. The engineer's note in the tracker: \"security theater.\"\n\nThe second PR was worse. It proposed blocking `AF_INET`\n\nand `AF_INET6`\n\nsockets in proxy mode. Sounds like a sane lockdown, until you notice the proxy itself needs those sockets to reach its own upstream. The fix would have broken the exact system it was supposed to protect.\n\nThat’s the real story under this week’s headline, “OpenAI open-sources security scanning CLI.” It’s a better story than the press…", "url": "https://wpnews.pro/news/codex-security-openai-built-an-ai-to-find-security-bugs", "canonical_source": "https://pub.towardsai.net/codex-security-openai-built-an-ai-to-find-security-bugs-b0c9fa47f673?source=rss----98111c9905da---4", "published_at": "2026-07-30 10:14:00+00:00", "updated_at": "2026-07-30 10:40:44.629327+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-products", "ai-tools", "ai-research"], "entities": ["OpenAI", "Codex Security", "NVIDIA", "OpenShell", "Aardvark"], "alternates": {"html": "https://wpnews.pro/news/codex-security-openai-built-an-ai-to-find-security-bugs", "markdown": "https://wpnews.pro/news/codex-security-openai-built-an-ai-to-find-security-bugs.md", "text": "https://wpnews.pro/news/codex-security-openai-built-an-ai-to-find-security-bugs.txt", "jsonld": "https://wpnews.pro/news/codex-security-openai-built-an-ai-to-find-security-bugs.jsonld"}}