OpenAI published their Codex security playbook

OpenAI just released the security playbook they wrote internally when shipping Codex. The repository is three years of operational security decisions, packaged as markdown. The interesting bit is not that they had a security process. It is what they chose to threat model. Traditional application security asks: can an attacker access data they should not see, can they escalate privileges, can they exhaust resources. Codex security adds: can the model be tricked into generating malicious code, can it leak training data through completion suggestions, can it amplify existing vulnerabilities by auto-completing them into production. The playbook includes red-teaming prompts they used to test whether Codex would generate SQL injection vectors or hardcoded credentials when prompted in natural language. They also documented how they rate-limited code generation requests per user to prevent someone from farming the model for exploits at scale. What caught my attention is the section on output filtering. They built a post-processing layer that scans generated code for patterns like eval() on user input or AWS keys in plain text. The filter is not perfect but it creates a speed bump. If the model suggests something dangerous, the user sees a warning before the code runs. This is useful for anyone building tooling on top of LLMs that generate executable output. The threat surface is not just prompt injection. It is also: what happens when the model writes bad code and a junior engineer ships it without reading. The repository is light on implementation details but heavy on the questions they asked during design. That makes it more useful than a checklist. You cannot copy-paste threat models between systems but you can borrow the framing. I would have liked to see metrics on how often the output filter triggered in production and whether those warnings actually stopped vulnerabilities from shipping. The playbook does not include those numbers. Still, seeing the security posture of a model that millions of developers used is rare. Most companies do not publish this.

---

Source: Codex Security