OpenAI DevDay 2026 live blog

What it is

The security-relevant content is OpenAI's Codex Security session at DevDay 2026 (presented by Kyle Brown and Ian Webster), detailing the "Defense Factory" internal security sprint and the resulting Codex Security Cloud / Codex Security CLI launch. The existing summary already covers the sprint's 53-fixes-in-a-day headline, the 36% duplicate-finding rate, the open-source CLI, SECURITY.md threat-model files, and the 1% rollback rate on auto-generated patches.

How it works

The page adds the operational detail that the sprint involved a quarter of OpenAI's product engineers, and that a major pain point was figuring out who owned what — described as "a surprisingly hard problem" at OpenAI's growth rate. The scanner workflow is a loop: it runs continuously ("keeps on looping until it can find no more issues"), then deduplication runs as a separate CLI workflow step. Patch generation (codex-security patch) is explicitly framed as a dial product owners turn up incrementally as they gain confidence in result quality, not an all-or-nothing switch — and the low 1% rollback rate is attributed specifically to a verify-fix command acting as an adversarial agent checking each generated fix before it ships.

Preconditions / Affected

Codex Security Cloud is distributed via the Codex plugins marketplace and runs on a specialized model called "Daybreak." The product requires "Daybreak Blue access" for the newly launched tier (scheduled scans, automatic deduplication). The CLI tool itself is open source, separate from the cloud offering.

What to do

• codex-security patch — generates patches and opens PRs for findings.
• codex-security verify-fix — adversarial-agent check validating a generated fix before merge; credited with keeping rollback rate at 1%.
• Deduplication is available as a distinct CLI workflow (not automatic unless you invoke it, though the Cloud tier runs it automatically on schedule).
• Define per-repo SECURITY.md files to give the tool a threat model and secure-coding guidelines specific to that codebase.

Caveats

These are live-blog notes, not documentation — commands and features are named but not shown with syntax, flags, or output examples. No CVE, version number, or pricing detail is given for Codex Security Cloud. The "1% rollback rate" and "36% duplicates" figures are OpenAI's own internal sprint metrics, not independently verified or necessarily representative of external users' results.