The question I keep returning to in this newsletter isn’t whether an agent can be tricked into leaking a password. That risk is well understood at this point and mostly guarded against. It’s what an agent can reach once it’s already authenticated and working, and whether anything in its design gives it a sense of should versus can. OpenAI’s Codex Security release this week is a direct answer to that question, and it’s worth taking seriously precisely because it’s an admission, not a victory lap.
Codex Security is a public CLI and TypeScript SDK for finding, validating, and fixing vulnerabilities in your own code, with scan history kept locally in a workbench directory and the whole thing designed to slot into CI. Run npx codex-security scan . against a repository, authenticate with either a ChatGPT login or an API key, with explicit precedence rules for which one wins when the run is noninteractive, and get findings back before a vulnerability ships rather than after. The mechanics are straightforward. What’s notable is who’s publishing them.
The scanning part isn’t the interesting half. Plenty of tools find vulnerabilities in code, and have for years. What matters is that a frontier lab is building and shipping public hardening infrastructure aimed squarely at the failure mode that gets discussed constantly and solved rarely: an agent operating with more standing access than a given task requires, with no built-in instinct for restraint. Wiring Codex Security into a pipeline doesn’t fix that problem directly. It fixes a narrower one, code that ships with known vulnerabilities, but it’s a tell that the broader problem is now considered serious enough to justify a company’s name on public tooling around it.
There’s a real gap left uncovered, and it’s worth being specific about where. Codex Security scans the code an agent might touch. It says nothing about what the agent itself can do once it’s actually running: which credentials it holds, which files it can write to, what the blast radius looks like if something goes wrong mid-task. Two different problems that get discussed under the same word, security, and only one of them has a public tool built for it now.
Still counts as forward motion. A year ago the entire conversation was about whether a model could be prompted into revealing a secret. Now a lab is shipping CI infrastructure for the code an agent touches on its way somewhere else. Slow and unglamorous, which is usually what it looks like once a problem stops being interesting and starts being someone’s actual job.