1Password Lifts Engineering Productivity 21% with Codex, Without Compromising Security

Hi, I'm Shii-chan! Today I want to share a case study I found on OpenAI's News about the password manager 1Password!

OpenAI News openai.com

What was announced?

OpenAI's News (OpenAI's official blog) published a case study on how 1Password wove Codex into its entire engineering process.

1Password brought Codex into nearly every stage of the software delivery lifecycle, from planning through implementation, review, testing, security checks, and production investigation. As a result, engineering productivity for its core cohort improved by about 20.9%, and median pull request cycle time dropped by 10.9%.

Here's how 1Password CTO Nancy Wang put it:

"What's been really eye-opening for a lot of our engineers is shortening the lifecycle between planning and being able to see a feature in production."

Shortening the gap between planning a feature and seeing it live in production turned out to be a real eye-opener for the engineering team.

Why it matters

Software development used to follow a fairly staged process: breaking a project into sprints and assigning each sprint to an engineering scrum team. At 1Password, moving from a user story to a prototype to something running in production meant a lot of handoffs.

With Codex, engineers can hand over a user story plus a description of the desired user experience, and go from idea to a near-final working prototype in one shot. This approach has already produced several new tools, including Knox (a fully agentic frontend design system), an internal AI site reliability engineering (SRE) agent, and an AI spend management tool.

What's also notable is that, based on engineering's results, leadership is now expanding Codex access to teams like finance and marketing, so people outside engineering can build their own tools and features too.

What changes

Codex now touches every stage of the software delivery lifecycle:

• Planning and technical design: turns requests into specs, dependency checks, and work items
• Implementation across stacks: helps engineers navigate unfamiliar Rust and TypeScript code via CLI, with parallel worktrees running tasks simultaneously
• Pull request review: reviews changes before a human does, flagging logic issues and missing context
• Testing and release readiness: runs acceptance criteria and automated tests in parallel with other work
• Security and access: ties into 1Password's internal AppSec harness, using secret references so plaintext credentials never enter the model's context
• Production investigation: pulls evidence from incident management, telemetry, source control, paging, and feature flags

The concrete results are pretty striking. An engineer working outside their usual stack cut a typical three-day merge down to just one day. A team facing a fixed beta launch date completed four release-critical tickets instead of the roughly two they'd normally expect. And for a defect spanning more than 10 microservices, investigation time dropped from about two hours down to just 5-20 minutes.

Dive Deep

For a modeled cohort of 50 consistently active Codex users, 1Password estimates about $784,000 in annual engineering capacity value, and a 553% ROI. That model assumes a fully loaded annual cost of $250,000 per developer, 40% directional Codex attribution, and 75% realization of the measured productivity improvement. At 100 consistent users, the modeled annual capacity value could reach roughly $3.1 million.

There's a security angle here too. Instead of storing credentials directly, 1Password keeps secret references in its repositories. When Codex calls an approved internal tool, the actual credential is resolved and injected at that point, so plaintext values never enter the model's context. On top of that, 1Password engineers have baked the company's security policies into reusable "AppSec skills," so those standards travel along with the development workflow wherever it goes.

According to Wang, the company is now in what she calls a "second wave": it's no longer just engineers who are AI-assisted builders, but also product managers, designers, and researchers shipping code and features. She expects this trend to spread across every role over the next 12 months, with more people who never thought of themselves as builders confidently shipping code.

Wrap-up

• 1Password integrated Codex across its entire development lifecycle, from planning to production investigation
• Core-cohort productivity improved by about 20.9%, and PR cycle time dropped by 10.9%
• A three-day merge became a one-day merge, and investigating a defect across 10+ microservices dropped from about two hours to 5-20 minutes
• Secret references keep plaintext credentials out of the model's context, preserving 1Password's security posture
• A modeled cohort of 50 users points to about $784,000 in annual value and a 553% ROI
• Codex adoption is spreading beyond engineering into other roles at the company

This one is especially worth reading for engineering managers and security folks who want to boost dev productivity without compromising on security!