Codex Security Cloud Bills by Token, Gives No Scan-Cost Estimate

OpenAI's application security agent has moved to the cloud. At DevDay 2026 the company introduced Codex Security Cloud, which scans GitHub repositories as new commits land, investigates suspected flaws, and drafts fixes. One practical detail is missing: there is no published estimate of what a scan will cost.

What OpenAI shipped

Codex Security was first introduced as a research preview. OpenAI described it as an agent that builds deep context about a project so it can find complex vulnerabilities, validate them automatically, and suppress the low-impact noise that typically consumes security teams' triage time.1 The company framed this as a response to a new bottleneck: coding agents are speeding up development, which makes security review the slow step.1

The DevDay release is a cloud version of that agent, which has been in preview since March.2 According to one breakdown, it clones repositories into OpenAI's cloud, builds a threat model, tries to reproduce suspected flaws in a sandbox, and opens draft pull requests with fixes as new commits arrive.2 InfoQ's DevDay recap lists a similar set of capabilities: scanning repositories and new commits, investigating findings, removing duplicates, and preparing fixes.4

The launch was one item among many. DevDay also brought GPT-6.1 Sol, computer use in the Agents API, cloud-based Codex environments, a Decisions API, and expanded ChatGPT plugins.4 Codex also gained a separate code-review workflow that analyzes diffs in GitHub pull requests and GitLab merge requests.4 Security Cloud fits a wider move to run Codex on OpenAI's infrastructure instead of only on developers' machines.

The numbers behind the pitch

OpenAI's case relies on results from the beta period. The company says scans of the same repositories became more precise over time, and in one case noise fell by 84% after the initial rollout.1 StackHawk, a dynamic testing vendor, reports the same 84% figure. It adds that false-positive rates dropped by more than 50% across repeated repositories, and that the private beta scanned 1.2 million commits and surfaced more than 10,000 high-severity findings.3

StackHawk also describes the remediation stage. For validated findings, the agent proposes minimal patches meant to respect the intent of the surrounding code, unlike the generic fixes traditional static analysis tools have tended to produce.3

What's missing: cost, coverage, retention

The launch materials leave several operational questions unanswered. Codex Security Cloud is billed by the token, and OpenAI does not estimate what a typical scan costs.2 The same analysis notes that the setup documentation does not say which programming languages are supported or how long OpenAI retains cloned code.2

These gaps matter more than usual for this product. An agent that builds a threat model, reproduces exploits in a sandbox, and writes patches does variable amounts of reasoning per repository and per commit. Token spend could vary widely depending on codebase size, commit volume, and how many candidate flaws need investigating. A security team trying to budget for continuous scanning across dozens of repositories has little to plan with. The silence on data retention is also a concern for any organization with strict rules about where source code is stored.

Where the sources diverge

OpenAI presents Codex Security as a way to ship secure code faster with high-confidence findings.1 Outside commentary is more cautious, for two different reasons.

The beri.net analysis is cautious about operations. It recommends piloting the tool as a second opinion on a few repositories, with a hard budget and a named owner for findings, and says it is not ready to replace an organization's static analysis tool of record.2

StackHawk is cautious about architecture. It calls Codex Security a real step forward and says AI agents can clearly find vulnerabilities in source code, but argues that finding issues in code is not enough to secure a running system. Dynamic testing against live applications, in its view, is still needed.3 StackHawk sells dynamic testing, so this position also serves its business, though the underlying point about runtime behavior is a common one in application security.

The takeaway

The reported beta metrics are notable. The jump from a research preview to an always-on cloud service watching every commit is a meaningful change in how AI security review could fit into development pipelines. Still, an always-on agent with open-ended token billing and no clear coverage or retention terms is hard for a security organization to adopt at scale.

The sensible approach for now is the limited one: run it on a few repositories, cap spending, track what each scan actually costs, and compare its findings with existing static and dynamic tools. Broader rollout should wait until OpenAI publishes cost guidance, language coverage, and retention policies.