JA EN
shiichan

OpenAI Daybreak Now Takes You From Vulnerability Investigation to Verified Fixes!

OpenAI Developers ★★★ View Markdown
#openai#security#ai#devops

Hi, it's me, Shiichan! Today I've got a practical guide OpenAI Developers just published for security teams.

OpenAI Developers developers.openai.com

What was announced?

OpenAI Developers published a practical guide on combining ChatGPT, Codex Security, and the open-source Codex Security CLI to work through security tasks. It's part of OpenAI Daybreak, an effort that brings together models, security tools, responsible access, and the security ecosystem. The post walks through concrete workflows for moving from investigation to evidence to a reviewed fix.

Why it matters

Working through a security backlog doesn't end at spotting something suspicious. You still need to confirm it actually affects your software, gather evidence, and land a safe fix — and that gets harder as code, alerts, and vulnerability reports keep piling up.

Codex Security cloud has already analyzed more than 30 million commits across more than 30,000 codebases. At that scale, it helps to have a clear picture of which tool fits which situation.

What changes

The guide lays out a clear entry point for each situation:

  • To reason through a log excerpt or a vulnerability advisory first, start in ChatGPT — reconstruct an incident timeline or draft a threat model for a new feature
  • To check whether a pull request is safe to merge, use Codex Security Review. Comment @codex security review to request one, or configure it to run automatically on every pull request, every push, or alongside an existing code review
  • To assess a whole repository, a component, a branch, or local changes, use the Codex Security plugin's standard scan, or a deep scan for systems that warrant more time and compute
  • To keep an important repository under continuous watch, use Codex Security cloud — it builds a repository-specific threat model, reviews relevant commits, and surfaces ranked findings
  • To triage what you already have — SARIF reports, GitHub code-scanning or Dependabot findings, Jira or Linear tickets — there's a backlog triage workflow
  • To wire checks into a terminal or CI pipeline, there's an open-source CLI and TypeScript SDK

Every workflow shares the same idea: turn findings into evidence and a reviewed fix, while keeping access scoped and consequential decisions in human hands. For an accepted finding, you can ask Codex Security to prepare a fix — when feasible, it adds a regression test that fails before the fix and passes after. Applying the change is still an engineer's call.

Dive Deep

Codex Security Review looks at the pull-request diff alongside relevant repository context and produces a Security Report with severity, supporting evidence, attack paths, validation details, and remediation guidance. One thing worth remembering: findings posted to GitHub inherit the pull request's visibility. It's available in research preview to eligible ChatGPT Enterprise, Business, Edu, and Pro workspaces with a connected GitHub repository.

The Security workbench in the Codex Security plugin shows live scan phases, reviewed files, active workers, elapsed time, and token usage, and lets interrupted deep scans resume without repeating completed work.

Codex Security cloud is also in research preview — an initial scan of a larger repository can take several hours, while later runs focus only on newly relevant commits.

The CLI ships as the open-source @openai/codex-security package. The package itself is public, but running a scan requires Codex Security access.

npx @openai/codex-security login
npx @openai/codex-security scan .

For scanning many repositories at once, you can prepare a CSV inventory and run a bulk scan:

npx @openai/codex-security bulk-scan repositories.csv \
  --output-dir /path/outside/repositories/security-portfolio \
  --workers 4 --max-attempts 3

That command keeps progress and results separate per repository, so you can resume interrupted work and tune concurrency and retries. You can also set an estimated cost limit — though the guide is careful to note it's an estimate, not a hard cap.

For more specialized work, there are two access tiers: Daybreak Blue, for approved defenders doing vulnerability triage, malware analysis, detection engineering, security investigations, and patch validation, and Daybreak Red, a narrower tier for advanced vulnerability research, controlled exploit validation, and red teaming, which requires separate approval.

The post ends with a line worth keeping in mind:

"Establish whether the risk is real, inspect the evidence, review the proposed change, and verify the fix — that loop stays the same no matter which workflow you pick."

Wrap-up

  • OpenAI Developers published a practical guide for combining ChatGPT, Codex Security, and the Codex Security CLI into a single security workflow
  • Use ChatGPT for investigation, Codex Security Review for pull requests, the Codex Security plugin for repositories and backlogs, and Codex Security cloud for continuous monitoring — pick the entry point that fits
  • Accepted findings can come with a proposed fix and a regression test, but an engineer still decides whether to apply it
  • The CLI and SDK plug into CI/CD and support bulk-scanning multiple repositories at once
  • Daybreak Blue and Daybreak Red offer approved access tiers for more specialized work
  • A useful read for any team sitting on a security backlog or looking to automate pull-request review!

Related posts