Why Codex Security Doesn’t Include a SAST Report

OpenAI explains why Codex Security, their agentic security review system, deliberately avoids seeding its analysis with SAST output. The core argument: SAST excels at source-to-sink dataflow but can't reason about whether security checks actually hold through transformation chains (e.g. validation before URL decoding). Codex Security instead starts from repo architecture and intent, then actively tries to falsify security invariants using micro-fuzzers, Z3 for constraint solving, and sandboxed PoC execution — raising confidence before surfacing findings to humans.