Every pull request submitted by an OpenAI engineer now passes through an automated security review powered by AI, and the model can prevent code from being merged if it identifies a vulnerability, according to a recent interview with Thibault Sottiaux, engineering lead of OpenAI's Codex team, published on The Pragmatic Engineer. The security check is mandatory and doesn't need a human reviewer to enforce it. Beyond security, OpenAI is using its models to review code quality, detect regressions, manage dependency upgrades, and help engineers complete changes that Sottiaux says might previously have required months of work.
OpenAI began training specialized code-review models early in Codex's development, and Sottiaux described models capable of catching logic and reasoning errors that a human engineer might spend hours tracking down. Those capabilities started in standalone review models and have since been integrated into OpenAI's mainline models. For security issues specifically, a flagged problem blocks the merge without exception. The company's review, deployment, and regression-catching processes are already "pretty much automated," according to Sottiaux, and engineers can ship a pull request the same day to ChatGPT, which he said serves roughly a billion active users. OpenAI has even started benchmarking some of its code-review models as "superhuman."
"When we benchmark them, it's like they're superhuman in code review," Sottiaux said. "This is not just true for correctness. This is also true for security." As AI handles more of the mechanics of reviewing code, Sottiaux thinks the human role may shift earlier in the process. "Really what we see, and I see, is there's this sort of discussion around the intent that takes place around the pull request," Sottiaux said. "It's like, what are you even trying to do? And is that the right thing to attempt to do?" That thinking needs to happen earlier, he argued, back in planning instead of waiting for the review queue.
While security gets most of the attention, basic maintenance may be where engineering teams feel the impact first, especially with third-party libraries that push breaking changes and get deferred sprint after sprint because new features always take priority. Sottiaux's point is that as long as you have a clear changelog and decent documentation, an agent can complete those tedious updates in an afternoon, and the same goes for routine security patches. The same calculation applies to bigger refactoring jobs—a team might know exactly what it wants to clean up and even have a better architecture in mind, but once the estimate comes back at two or three months of engineering work, it's easy to understand why everyone keeps working around the problem instead. That changes when an agent can take on much of the work, turning a cleanup that would have been shelved into a project that might take days instead of months. Sottiaux also described a dynamic in agent development that runs opposite to how most software evolves: Codex had a command called /goal built to keep a model focused on a single objective for days or weeks without drifting, but newer models don't need it. The Codex team often has to build extra infrastructure around a model to make up for what it can't do yet, only to find that the next generation can handle the same behavior on its own and the code they built around the previous model is no longer needed.
The interview doesn't fully address the obvious objection: if AI writes more of the code and AI reviews that code, both systems can share the same blind spot. OpenAI trusts these models enough to let them block a pull request, which makes their mistakes matter in a practical way. If the model is too cautious, engineers end up waiting on code that was fine to begin with. If it misses a real vulnerability, that code could move ahead with an automated security check giving everyone reason to believe it was safe. The job also gets messier as AI-generated code proliferates—code can compile, pass its tests, and still have problems that aren't obvious from the pull request itself, and when the supply chain is the attack surface, the weak point could be a dependency compromised weeks or months earlier, leaving a reviewer to catch a problem that originated elsewhere. The question isn't whether the models can outperform humans on narrow benchmarks, but whether organizations deploying them understand where automated judgment ends and human accountability must begin. A system that blocks merges with confidence still depends on someone deciding what questions the model should never answer alone.