This article is a methodology writeup from Trail of Bits describing how they leverage OpenAI Codex's '/goal' autonomous agent feature within the 'Patch the Planet' initiative to conduct large-scale vulnerability research and variant analysis against major open-source projects (Rust, curl, zlib, Keycloak, kubernetes-client). It details prompt-engineering lessons learned (letting the model draft its own goal, defining outcomes precisely without prescribing method, and assigning one outcome per agent) and describes an automated Rust P-critical variant-analysis pipeline with a two-pass validation gate before human review. No specific exploit details, IOCs, or CVE numbers for the discovered bugs are disclosed in this post.
Codex
3 posts
How we use /goal to find bugs in Patch the Planet Context Engineering | Compaction & Agent Memory for Automated Malware Analysis SentinelLABS evaluated OpenAI's native compaction feature in the Responses API for automated binary analysis workflows. Compaction reduced input tokens by approximately 86% with no aggregate score degradation, but domain object modeling quality decreased, indicating that structural reasoning can be flattened during context compression. The research advocates for a context-engineering strategy that separates compacted working memory from durable artifact storage and treats compaction as lossy until validated.
Codex Red: Untangling a Linux Incident With an OpenAI Twist (Part 1) A Linux endpoint compromised by multiple threat actors deploying cryptominers was further complicated when the user utilized OpenAI's Codex to troubleshoot system issues. The AI agent generated commands that structurally resembled malicious activity, triggering EDR alerts and creating significant noise that hindered SOC triage and incident response.
