OpenAI says AI finds flaws by the thousand and the backlog takes a big push to clear

A speaker at OpenAI's DevDay 2026 said hacking is getting almost free. They also said the latest models have found thousands of hidden flaws in everyday software. The session was "Codex Security: From Vulnerability to Verified Fix." The recording does not name the speakers.

What was said

The speaker called this an inflection point for security: "The cost of hacking stuff is going to basically zero." Over the past few months, they said, the latest models have made it possible to find thousands of latent vulnerabilities. These are hidden flaws in software people use daily. They said this matters to any developer, not only security specialists.

A speaker explained how OpenAI handled it. It split its code into smaller areas and ran hundreds of agents in parallel. Different scanners can report the same flaw. So findings must be deduplicated, ranked, given an owner, and checked once fixed.

Tens of thousands of findings arrived. Deduplication was the first major bottleneck, a speaker said, and agents helped with it. Across the scans, 36% of findings were duplicates. A speaker said Codex also helped create the fixes.

Still, a speaker said part of the process "took actually a large amount of human effort." OpenAI put a quarter of its product engineers on a security sprint. A speaker showed a curve of that workload: a huge spike of effort and a large backlog. OpenAI says it eventually reached a steady state with far fewer vulnerabilities, found much faster than before.

The speaker also described a "defender's window." Defenders have a lead now, they said, and should fix weaknesses before attackers get the same capabilities.

Why it matters

Our reading is that automation shrinks some steps but moves the bottleneck to people. Agents can sort duplicates, and Codex can draft fixes. Someone still has to validate findings, own each one, and verify the fix. That work does not vanish.

If attackers find flaws as cheaply as defenders do, a team that cannot patch as fast carries more risk. Managers might ask how many findings their team can triage in a week, and who owns each fix.

The other side

The speaker was optimistic. The 0.81% false positive rate and the fix rollback rate under 1% are OpenAI's own figures. They come from a talk that launched its own product.

The excerpts do not say which step took that large human effort. The answer offered to others was OpenAI's tooling: an open-source CLI and SDK, plus Codex Security Cloud. In the portions reviewed, nothing showed that a team without OpenAI's resources could clear a comparable backlog.