OpenAI Adds Security Scans and 'Ultrafast' Tier to Codex at DevDay 2026

OpenAI used its DevDay 2026 developer conference to push Codex further into everyday engineering work, adding reusable cloud environments, automatic security scans for GitHub repositories, and a code review view inside the desktop app. The company also expanded its Agents API with Computer Use support and introduced a separate Decisions API for fast, single-shot decisions. A new premium tier called Ultrafast rounds out the release, promising up to eight times the speed of the standard offering at six times the price.

The Codex changes target a persistent complaint from teams running agents on real repositories: setup and cleanup. Reusable cloud environments let a developer carry the same configured workspace from one session to the next instead of rebuilding dependencies each time. The security scans run automatically against linked GitHub repos, flagging problems before code review rather than after a merge. The desktop code review view keeps that feedback inside the app where the agent is already working.

On the API side, Computer Use support in the Agents API means developers can build assistants that click, type and read screens, not just call functions. That capability has been available in rival tooling for a while, and OpenAI's version arrives with the same controls enterprises have been asking for around permissions and audit trails. The Decisions API is a narrower product: it is built for single, quick judgments an application needs to make in-line, rather than the multi-step reasoning that Agents handles.

Ultrafast is the clearest pricing signal of the day. Eight times the speed for six times the cost is a steep multiple, but it is aimed at workloads where latency, not token spend, is the binding constraint — interactive coding, real-time review, or agent loops that stall on slow inference. OpenAI has not said which models back the tier or whether the speed figure applies across all task types, and per-token rates were not disclosed in the summary material.

For the field, the DevDay package puts OpenAI in closer competition with GitHub's own Copilot security features and with agent frameworks from Anthropic and Google that already emphasize computer control. Bundling scanning, review and persistent environments into one Codex workflow lowers the number of vendors a team needs to stitch together. It also raises the stakes on pricing transparency, since developers comparing agents now have to weigh a sixfold premium against the cost of their own time.

What to watch next is whether the security scans catch meaningful vulnerabilities or generate noise, and how Ultrafast's real-world latency compares with its marketing figure once developers stress-test it. OpenAI has also not explained how Decisions API calls are billed relative to full agent runs. Those answers will determine whether teams adopt the new tier or treat it as a niche option for a handful of latency-sensitive tasks.