Codex 加强防护，降低误删用户文件风险

The team investigated reports of GPT-5.6 performing actions outside its intended work. The changes add multiple layers of protection. Engineer Dax Raad

false positive rates on detections have fallen by more than 50% across all repositories. These improvements help Codex Security better align reported severity with real-world risk and reduce unnecessary triage burden for security teams, and we expect the signal-to-noise ratio to continue to improve. [...] Formerly known as Aardvark⁠, Codex Security began last year as a private beta with a small group of customers. In early internal deployments, it surfaced a real SSRF, a critical cross-tenant authentication vulnerability, and many other issues which our security team patched within hours. Early deployments with external testers helped us improve how users provide relevant product context and move from onboarding to securing their code. We also significantly improved the quality of our findings over the course of the beta: scans on the same repositories over time show increasing precision, in one case cutting noise by 84% since initial rollout. We’ve reduced the rate of findings with o

Recapping some changes we have rolled out over the last couple of weeks that have further reduced the risk associated to potentially destructive

## Fewer findings, better signal The headline number changed from 11 findings in June to 4 findings in July. I would not frame that as "Codex Security got better because the number went down." That is too simple. The codebase changed during the month, and I had already fixed or reduced several classes of risk. The more interesting part was that the July run felt better calibrated. The findings clustered around practical application-security themes: public workflow abuse controls, safe rendering of metadata, and safer handling of URLs and filesystem writes in maintenance tooling. I am intentionally keeping that description high-level because the goal of this post is not to publish a playbook for the specific issues. [...] That may sound like a small UI change, but it made the scan easier to trust. Security reviews have a lot of quiet time. When the tool tells you what phase it is in, you spend less time wondering whether it is stuck and more time waiting for the right handoff point.

Recapping some changes we have rolled out over the last couple of weeks that have further reduced the risk associated to potentially

added clearer warnings, and further restricted especially risky permission combinations. - We updated Auto-review to better identify destructive actions. - We built targeted evaluations that replay the failures we observed. We’re also adding reinforcement-learning tasks and graders focused on these risks, and filtering destructive actions from training data. In those replay evaluations, the changes substantially reduced the behavior while preserving Codex’s ability to complete normal coding work. Two things to do on your end: - Keep the Codex app up to date. We are always improving safety, performance and many other things. - Use one of the sandbox modes: "Ask for approval" or "Approve for me". Only use Full access for environments you trust and can recover. Thanks and happy Codexing out [...] added clearer warnings, and further restricted especially risky permission combinations. - We updated Auto-review to better identify destructive actions. - We built targeted evaluations that repl