[Application security agent]

Codex Security and Aevral, at a glance

Codex Security is OpenAI's application security agent: scans from the Security workbench, the @openai/codex-security CLI and SDK, and cloud, plus Security Review on GitHub pull requests, per OpenAI's docs.

Codex Security runs security and deep scans from the Security workbench, bulk and CI scans through the @openai/codex-security CLI and SDK, and cloud scans of connected GitHub repositories commit by commit (cloud in research preview); its Security Review adds a security-focused PR review (research preview, as of September 7, 2026), per OpenAI's docs. Aevral is built for a reading of its own: does this diff widen who has access to what. Both read pull requests for security: Codex Security with its reviews, and Aevral's PR review, live and opt-in, on the same pull request.

Codex Security focuses on

Running security and deep scans from the Security workbench, the CLI and SDK, and Codex Security cloud.
Reviewing GitHub pull requests for security-specific risks with Security Review (research preview, as of September 7, 2026), with threat-model context.
Validating findings and proposing fixes reviewable in GitHub, per OpenAI's docs.

Aevral adds alongside

The access reading of the pull request: dropped ownership checks, caller-controlled object references, gates that went from a role to a login.
With the opt-in add-on: up to two findings per review, grounded on the added lines, posted as a Check plus inline comments. It never blocks a merge.
A finding as a lead with evidence: the author decides with full information.

Run them together

Let Codex Security run OpenAI's scans and Security Review; let Aevral add the authorization and business-logic reading of the same pull requests, with the opt-in add-on.

Codex Security and Aevral, in depth; Aevral PR security review.

Also alongside

Scan your whole repo for access bugs.

One GitHub App. A report with evidence. A prompt for the agent you already use.

Join waitlist