Codex Security Cloud Adds Continuous Repo Scanning and Fixes

OpenAI's announcement of a major upgrade to Codex Security Cloud describes security review that keeps running off the developer's machine. Codex Security Cloud scans entire GitHub repositories, keeps reviewing new commits, investigates and deduplicates findings, and prepares fixes for review, which the post says continues even when the developer's laptop is closed. The upgrade also includes access by default to cyber-capable models through Daybreak Blue, one of OpenAI's controlled-access levels for defensive security work (earlier coverage).

OpenAI's setup guide shows how that works. Codex Security Cloud is a separate plugin from the local Codex Security plugin and runs its scans in Codex cloud; it needs a workspace with access, a GitHub connection and a compatible cloud environment, and the product overview lists it as a research preview. A one-time scan covers a connected repository, while continuous scanning monitors the default branch as commits arrive. Fixes are not merged on their own: a finding can start a Codex conversation that implements and tests a fix, or, from commit monitoring, offer a suggested patch for a person to review before creating a draft pull request.

The post makes no claims about detection quality, and its attached video could not be reviewed. The guide itself cautions that a scan with no reported findings does not establish that a repository has no vulnerabilities.