OpenAI launches Codex Security Cloud to scan GitHub repositories

OpenAI announced at DevDay 2026 on Tuesday, September 29, 2026, the launch of Codex Security Cloud, a cloud application security service that operates continuously within the Codex environment and scans GitHub repositories, monitoring new commits and proactively investigating potential vulnerabilities. The service allows teams to connect their repositories and choose a compatible cloud environment to run a full scan or enable continuous monitoring. The initial scan establishes a project-specific threat model and reviews the repository's historical record, while subsequent scans focus on newly added code. The service evolves from the research preview Codex Security launched on March 6, 2026, previously known as Aardvark, by moving operations to the cloud and integrating virtual access to cyber models via Daybreak Blue. The system supports authorized defensive tasks and requires the developer to remain in the approval loop, with recommendations for strict governance and human review. Operational figures cited come from the March 2026 pilot, while the current cloud version lacks independent performance data so far.