OpenAI Codex Security Scanned 1.2 Million Commits and Found 10,561 High
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-32988 +1 in the same advisory: …32989 | A flaw was found in GnuTLS. A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure. This vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior. NVD description · AI analysis pending | 8.2 group max | 1% |
| — | ||
| CVE-2025-35432 | CISA Thorium does not rate limit requests to send account verification email messages. CISA Thorium does not rate limit requests to send account verification email messages. A remote unauthenticated attacker can send unlimited messages to a user who is pending verification. Fixed in 1.1.1 by adding a rate limit set by default to 10 minutes. NVD description · AI analysis pending | 6.9 group max | <1% |
| — | ||
| CVE-2025-64175 | Gogs is an open source self-hosted Git service. Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, Gogs’ 2FA recovery code validation does not scope codes by user, enabling cross-account bypass. If an attacker knows a victim’s username and password, they can use any unused recovery code (e.g., from their own account) to bypass the victim’s 2FA. This enables full account takeover and renders 2FA ineffective in all environments where it's enabled.. This issue has been patched in versions 0.13.4 and 0.14.0+dev. NVD description · AI analysis pending | 7.7 | <1% |
| — | ||
| CVE-2026-24881 +1 in the same advisory: …24882 | In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-ag In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. This can easily be leveraged for denial of service; however, there is also memory corruption that could lead to remote code execution. NVD description · AI analysis pending | 9.8 group max | 2% | PoC |
| — | |
| CVE-2026-25242 | Gogs is an open source self-hosted Git service. Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled (default), any remote user can upload arbitrary files to the server via /releases/attachments and /issues/attachments. This enables the instance to be abused as a public file host, potentially leading to disk exhaustion, content hosting, or delivery of malware. CSRF tokens do not mitigate this attack due to same-origin cookie issuance. This issue has been fixed in version 0.14.1. NVD description · AI analysis pending | 6.9 | <1% | PoC |
| — |
Full article515 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMar 07, 2026DevSecOps / Artificial Intelligence
OpenAI on Friday began rolling out Codex Security, an artificial intelligence (AI)-powered security agent that's designed to find, validate, and propose fixes for vulnerabilities.
The feature is available in a research preview to ChatGPT Pro, Enterprise, Business, and Edu customers via the Codex web with free usage for the next month.
"It builds deep context about your project to identify complex vulnerabilities that other agentic tools miss, surfacing higher-confidence findings with fixes that meaningfully improve the security of your system while sparing you from the noise of insignificant bugs," the company said.
Codex Security represents an evolution of Aardvark, which OpenAI unveiled in private beta in October 2025 as a way for developers and security teams to detect and fix security vulnerabilities at scale.
Over the last 30 days, Codex Security has scanned more than 1.2 million commits across external repositories over the course of the beta, identifying 792 critical findings and 10,561 high-severity findings. These include vulnerabilities in various open-source projects like OpenSSH, GnuTLS, GOGS, Thorium, libssh, PHP, and Chromium, among others. Some of them have been listed below -
- GnuPG - CVE-2026-24881, CVE-2026-24882
- GnuTLS - CVE-2025-32988, CVE-2025-32989
- GOGS - CVE-2025-64175, CVE-2026-25242
- Thorium - CVE-2025-35430, CVE-2025-35431, CVE-2025-35432, CVE-2025-35433, CVE-2025-35434, CVE-2025-35435, CVE-2025-35436
According to the AI company, the latest iteration of the application security agent leverages the reasoning capabilities of its frontier models and combines them with automated validation to minimize the risk of false positives and deliver actionable fixes.
OpenAI's scans on the same repositories over time have demonstrated increasing precision and declining false positive rates, with the latter falling by more than 50% across all repositories.
In a statement shared with The Hacker News, OpenAI said Codex Security is designed to improve signal-to-noise by grounding vulnerability discovery in system context and validating findings before surfacing them to users.
Specifically, the agent works in three steps: it analyzes a repository to get a handle on the project's security-relevant structure of the system and generates an editable threat model that captures what it does and where it's most exposed.
Once the system context is built, Codex Security uses it as a foundation to identify vulnerabilities and classifies findings based on their real-world impact. The flagged issues are pressure-tested in a sandboxed environment to validate them.
"When Codex Security is configured with an environment tailored to your project, it can validate potential issues directly in the context of the running system," OpenAI said. "That deeper validation can reduce false positives even further and enable the creation of working proofs-of-concept, giving security teams stronger evidence and a clearer path to remediation."
The final stage involves the agent proposing fixes that best align with the system behavior so as to reduce regressions and make them easier to review and deploy.
News of Codex Security comes weeks after Anthropic launched Claude Code Security to help users scan a software codebase for vulnerabilities and suggest patches.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/03/openai-codex-security-scanned-12.html