OpenAI gave an AI the power to block its own engineers’ code

Every pull request submitted by an OpenAI engineer now goes through an automated security review, and the AI model doing the review has the power to stop code from being merged if it finds a vulnerability.

Thibault Sottiaux, engineering lead of OpenAI’s Codex team, described the system in a recent interview on The Pragmatic Engineer, explaining that the security check is mandatory and doesn’t require a human reviewer to enforce it.

Security review is only one of the jobs OpenAI is handing to its models. They’re also reviewing code, catching regressions, handling dependency upgrades, and helping engineers tackle changes that Sottiaux says might previously have taken months. OpenAI has even started benchmarking some of its code-review models as “superhuman.”

AI reviewers block every merge

OpenAI started training specialized code-review models early in Codex’s development. In the interview, Sottiaux described models that could catch logic and reasoning mistakes a human engineer might spend hours on.

“When we benchmark them, it’s like they’re superhuman in code review,” Sottiaux said. “This is not just true for correctness. This is also true for security.”

Those capabilities started in standalone review models and have since folded into OpenAI’s mainline models. For security, a flagged issue blocks the merge without exception.

“When we benchmark them, it’s like they’re superhuman in code review,” Sottiaux said. “This is not just true for correctness. This is also true for security.”

Intent replaces inspection

As AI takes over more of the mechanics of reviewing code, Sottiaux thinks the human role may move earlier in the process.

OpenAI’s review, deployment, and regression-catching processes are already, in Sottiaux’s words, “pretty much automated.” Engineers can ship a PR the same day to ChatGPT, which he said serves roughly a billion active users.

“Really what we see, and I see, is there’s this sort of discussion around the intent that takes place around the pull request,” Sottiaux said. “It’s like, what are you even trying to do? And is that the right thing to attempt to do?”

“Really what we see, and I see, is there’s this sort of discussion around the intent that takes place around the pull request,”

That thinking needs to happen earlier, Sottiaux argued, back in planning instead of waiting for the review queue. Engineers still have to agree on the goal and kick the tires on a proposed change. Passing the review burden to AI doesn’t take humans out of the loop; it just moves the gut-check to before anyone opens a PR.

Agents tackle maintenance backlogs

While security gets most of the attention, basic maintenance may be where engineering teams feel this first, especially when it comes to third-party libraries with breaking changes that get pushed off sprint after sprint because a new feature always takes priority. Sottiaux’s point is that as long as you have a clear changelog and decent documentation, an agent can knock out those tedious updates in an afternoon, and the same goes for routine security patches.

The same calculation starts to apply to bigger refactoring jobs. A team might know exactly what it wants to clean up and even have a better architecture in mind, but once the estimate comes back at two or three months of engineering work, it’s easy to understand why everyone keeps working around the problem instead. The code may be ugly, but it works, and there are always other things that need to ship.

That changes when an agent can take on much of the work. A cleanup that would have been shelved because nobody could justify spending a quarter on it might suddenly take days instead of months, which makes it a much easier project to say yes to.

When models outgrow their scaffolding

Sottiaux described a dynamic in agent development that runs opposite to how most software evolves.

Codex had a command called /goal, built to keep a model focused on a single objective for days or weeks without drifting. A “crutch” (Sottiaux’s own word) to patch the model’s tendency to lose the thread on long-running tasks, but newer models don’t need it.

“You don’t need slash goal anymore. You don’t need a harness around it,” Sottiaux said.

The Codex team often has to build extra infrastructure around a model to make up for what it can’t do yet, only to find that the next generation can handle the same behavior on its own and the code they built around the previous model is no longer needed.

Sottiaux said the team now factors that into its planning, sometimes deciding not to build a workaround if researchers expect the next model to solve the problem on its own within a few months. As the models improve, the system prompt and the code surrounding them can get smaller, while parts of the product that once seemed necessary disappear altogether.

The blind spot question

If AI writes more of the code and AI reviews that code, both systems can share the same blind spot. That’s the obvious objection, and Sottiaux’s interview doesn’t fully address it.

OpenAI trusts these models enough to let them stop a pull request from moving forward, which makes their mistakes matter in a very practical way. If the model is too cautious, engineers end up waiting on code that was fine to begin with. If it misses a real vulnerability, that code could move ahead with an automated security check giving everyone reason to believe it was safe.

The job also gets messier as AI-generated code proliferates. Code can compile, pass its tests, and still have problems that aren’t obvious from the pull request itself. Some of those problems may not even start with the code an engineer is submitting. When the supply chain itself is the attack surface, the weak point could be a dependency that was compromised weeks or months earlier, leaving a PR reviewer to catch a problem that originated somewhere else entirely.

Code can compile, pass its tests, and still have problems that aren’t obvious from the pull request itself.

The post OpenAI gave an AI the power to block its own engineers’ code appeared first on The New Stack.