OpenAI lets an AI security review block its engineers' pull requests without a human

Every pull request submitted by an OpenAI engineer now passes through an automated security review, and the AI model can stop the code from being merged if it finds a vulnerability. There is no human in that loop. Thibault Sottiaux, the engineering lead of OpenAI's Codex team, described the system in a recent interview on The Pragmatic Engineer newsletter, and The New Stack wrote it up on 9 September.

Sottiaux said the security check is mandatory and does not need a human reviewer to enforce it. Other kinds of review, including code correctness, regressions and dependency upgrades, run on the same models. OpenAI has started benchmarking some of its code-review models as, in his words, "superhuman", meaning they catch issues that a human engineer might spend hours on.

What OpenAI is claiming

The claim came from Sottiaux, so treat it as OpenAI's own account. "When we benchmark them, it's like they're superhuman in code review," he said, adding that the same holds for security work. He also said OpenAI's review, deployment and regression-catching processes are "pretty much automated", and that engineers can ship a pull request the same day to ChatGPT, which he said serves roughly a billion active users.

Sottiaux argued the human role moves earlier in the process. Engineers agree on the intent of a change before the pull request is opened, and the model handles the mechanics of review. That is a different working shape from "AI drafts, human approves" and worth naming plainly, because the second one is what most teams have adopted so far.

Where this can go wrong

OpenAI trusts the model enough to let it block a merge, which makes its mistakes matter in a practical way. A model that flags too many things wastes engineer time on false alarms. A model that misses a real vulnerability sends that code forward under a green check, which is a stronger signal than no check at all and harder to argue against in a hurry.

There is also a shared-blind-spot risk. If the same family of models is writing the code and reviewing the code, the class of bug both are weak at will slip through both. Sottiaux's interview does not fully address that. A dependency compromised weeks earlier is another gap: the reviewer sees the pull request, not the history of the package.

For a team weighing this shape of workflow, the practical questions are narrow. What is the model allowed to block, and what only warn on. Who owns the security-review model when it misfires: the vendor, the platform team, or the engineer whose PR got stopped. How is a false-positive rate measured over time. If those questions do not have owners, an automated block is just a way to shift the cost of a bad review from the model to the developer waiting on it.

Source

• OpenAI gave an AI the power to block its own engineers' code, The New Stack, 9 September 2026
• Primary source: Building Codex with Tibo Sottiaux, The Pragmatic Engineer