# Vulnerability Detection

OpenAI's Codex Security lets developers find, investigate and fix code vulnerabilities in one workflow, started from a Codex session or automated with the @openai/codex-security command line or TypeScript SDK. Scans cover whole repositories, selected paths and Git changes, and a deep scan repeats a standard scan and returns deduplicated findings. A completed scan saves a report and findings, and the report lists source evidence and exclusions for judging coverage.

OpenAI's Codex Security lets developers find, investigate and fix code vulnerabilities in one workflow, started from a Codex session or automated with the @openai/codex-security command line or TypeScript SDK. Scans cover whole repositories, selected paths and Git changes, and a deep scan repeats a standard scan and returns deduplicated findings. A completed scan saves a report and findings, and the report lists source evidence and exclusions for judging coverage.

Google released Gemini 4 Carbon, a next frontier model aimed at long-horizon agentic workflows and cybersecurity defense, ranking first on version 5.0 of the Artificial Analysis Intelligence Index at 59. It reports 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation and 71.0% on CWE-bench for patching, and says internal testing cut successful cheating on Terminal-Bench 4.0 to 0.0%. Access starts with a subset of cyber defenders and widens through the Fairwind Program, at the same price as Argon.

Google released Gemini 4 Carbon, a next frontier model aimed at long-horizon agentic workflows and cybersecurity defense, ranking first on version 5.0 of the Artificial Analysis Intelligence Index at 59. It reports 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation and 71.0% on CWE-bench for patching, and says internal testing cut successful cheating on Terminal-Bench 4.0 to 0.0%. Access starts with a subset of cyber defenders and widens through the Fairwind Program, at the same price as Argon.

Reasoning models draft code early inside their chain of thought, and SecReason scans the streaming tokens before delivery and inserts a warning so the model repairs the draft within the same reasoning trace, raising the share of runs that are both secure and functionally correct from below 15% to 72.8%–98.1%.

Reasoning models draft code early inside their chain of thought, and SecReason scans the streaming tokens before delivery and inserts a warning so the model repairs the draft within the same reasoning trace, raising the share of runs that are both secure and functionally correct from below 15% to 72.8%–98.1%.

On strictly paired vulnerable and patched C/C++ functions, whitened CodeBERT layer-3 embeddings with nearest-neighbour distance separate unfamiliar samples from familiar ones at a mean OOD AUROC of 0.739, and expose a cross-project patch false-positive rate as high as 0.507.

On strictly paired vulnerable and patched C/C++ functions, whitened CodeBERT layer-3 embeddings with nearest-neighbour distance separate unfamiliar samples from familiar ones at a mean OOD AUROC of 0.739, and expose a cross-project patch false-positive rate as high as 0.507.