OpenAI says Codex’s Ultrafast mode became the default for its engineers’ incident response. In an account published October 26, the company describes engineers directing Codex to monitor an incident, investigate possible causes and answer follow-up questions while it searches sources such as logs and Slack in parallel.
How Codex fits into OpenAI’s incident workflow
OpenAI describes an engineer starting a response channel in Slack and asking Codex to monitor and investigate. Codex can search several possible causes and information sources at once. OpenAI staff also describe using it to look through incident logs and Slack for suspicious changes or similar symptoms elsewhere in the conversations.
The company’s August 13 preview gives more detail on the work: Codex can read application logs, analyze traces, synthesize conversations and identify next checks. It can also help prepare or validate a fix. OpenAI says engineers retain responsibility for judgment and deployment.
What the 10–15-minute figure covers
AJ Trbojevic, an OpenAI security architect, says gathering, normalizing and contextualizing structured and unstructured data for security investigations used to take one or two hours. He reports that process taking 10–15 minutes with Ultrafast, sometimes near real time.
That figure describes the information-gathering and contextualization work in Trbojevic’s account. It is an employee-reported result, not a measure of the full time to resolve an incident.
Model speed and investigation time measure different things
OpenAI’s August 13 preview says GPT‑5.6 Sol on Ultrafast can generate up to 750 output tokens per second and run up to 14× faster than Standard processing. Those are model-level speed claims. Trbojevic’s 10–15 minutes, by contrast, describes a particular security-investigation process. The two figures measure different things.
