Incident investigation from hours to minutes! How OpenAI engineers use Codex Ultrafast

Hi, it's Shii-chan!

OpenAI News openai.com

I found an article about how OpenAI uses Codex internally. It's a peek into real incident response, and I'm excited!

What was announced?

This is one entry in OpenAI News' series on internal uses of its own technology. Engineers use Ultrafast, a high-speed mode in Codex, as the default for incident response. They can investigate several possible causes at once and get answers without splitting their attention.

Why it matters

When an AI answer is slow, you end up asking a coworker or checking Slack, and your flow breaks. This article shows response speed itself changing how investigations and daily work go.

What changes

• Incident response: an engineer opens a Slack channel and has Codex monitor, investigate and answer questions, searching many possible causes in parallel
• Security investigations: gathering, normalizing and contextualizing data used to take one to two hours, and now takes 10 to 15 minutes (sometimes near real time)
• Daily work: big refactors and slow tasks people used to avoid become practical

Dive Deep

Here are the usage patterns from the article:

• Aaron Friel: when leading an incident, has Codex monitor and investigate, and uses Ultrafast to search many causes at once
• AJ Trbojevic (Datacenter Security Architect): security investigations went from one to two hours to 10 to 15 minutes
• Adam Perry and Sayan Sisodiya (core agent team): they stay focused on the incident instead of investigating in parallel. Sayan also searches Slack for suspicious changes and similar reports
• Jeff Niu: if an AI answer takes more than 30 seconds he switches to Slack or a coworker. Most of his work now fits under that, so conversations with Codex happen in real time
• Adam's morning "chief of staff" thread: summarizes meetings and missed messages each morning, with instant follow-up answers
• Sayan: delegates browser chores like filling out forms. Better computer use in the latest models makes Codex faster than doing it himself

Wrap-up

• Ultrafast is the default for incident response at OpenAI
• Security investigations went from one to two hours to 10 to 15 minutes
• Answers under about 30 seconds keep AI conversations from breaking your train of thought
• Tasks people used to put off become easier to take on

If you're an engineer struggling with investigation speed during incidents or security work, this case study is for you!