Codex Security: now in research preview

OpenAI launched Codex Security — a research preview for an AI app-security agent that detects, validates, and patches vulnerabilities with project context. Read: https://openai.com/index/codex-security-now-in-research-preview . My take: useful, not magic. Why it matters: static scanners flag lines. Context-aware agents follow call paths, dependency graphs, and tests, which cuts noise and surfaces plausible fixes. Still: plausible ≠ correct. Human review and reproducible tests remain essential. How I’d adopt it: run read-only for 2 weeks — let the agent open tickets, not PRs. Ticket template: required unit test, changelog entry, risk rating, and named owner. CI gates: no coverage drop, code-owner approval, signed audit log. For agencies, legal, and finance shops: make mandatory human sign-off your product feature. Require BYOK (bring‑your‑own‑key) and retention policies so clients control data and costs. Will you accept AI-suggested PRs without a human in the loop?