OpenAI Uses Ultrafast Codex to Speed Incident Response

Introduction

At OpenAI, incident response used to be a slow, fragmented process. Engineers would spend hours gathering data, normalizing logs, and piecing together what went wrong. That changed when they adopted Ultrafast, a high-speed mode in Codex, which has become the default tool for investigating incidents. With response times now measured in minutes rather than hours, OpenAI's technical teams are not only reacting faster but also taking on tasks they previously avoided due to latency constraints.

Accelerating Security Investigations

According to AJ Trbojevic, a Datacenter Security Architect at OpenAI, security investigations that once took an hour or two to complete now finish in 10 to 15 minutes. In some cases, the analysis is nearly real time. This acceleration comes from Ultrafast's ability to process multiple data sources simultaneously, allowing engineers to search across logs, Slack conversations, and other internal systems without waiting for sequential responses. As Trbojevic notes, the core challenge in any incident is identifying the right issue among many potential causes, and Ultrafast enables that search to happen across all possible angles at once.

Maintaining Focus During Incidents

For Adam Perry and Sayan Sisodiya, who work on the core agent team that powers Codex, the speed improvement has changed how they collaborate during incidents. Previously, they would initiate a query with Codex and then manually investigate in parallel, knowing the AI would not return results quickly enough to rely on alone. With Ultrafast, they can now stay focused on a single workflow, asking follow-up questions and iterating on solutions without losing their train of thought. Perry describes using a running Codex thread as his “chief of staff,” which provides daily summaries of meetings and pending messages, enabling seamless continuity in conversations.

Real-Time Decision Making

Jeff Niu, another Member of the Technical Staff, highlights how Ultrafast keeps him productive during fast-moving situations. If a query takes more than 30 seconds, he switches to Slack or reaches out to a colleague. But with Ultrafast, most of his interactions fall well within that window. This near-real-time feedback loop allows him to delegate routine tasks such as browser automation and form filling—activities he previously avoided because of delays. It also makes tackling technical debt more feasible, as code refactors that once required significant effort are now quick to execute and iterate on.

What Security Teams Should Do Now

Security and engineering teams looking to improve their own incident response capabilities should evaluate whether their current AI or automation tools introduce unacceptable latency. If analysts are regularly switching contexts while waiting for responses, they are likely losing critical time and focus. Prioritizing low-latency AI integrations—especially those capable of querying multiple data sources in parallel—can dramatically reduce mean time to resolution. Additionally, teams should consider embedding AI assistants into existing communication platforms like Slack, where incident channels are already active, to streamline collaboration and ensure knowledge is captured and reused across incidents.

Conclusion

Ultrafast has transformed how OpenAI’s engineers approach incident response, code refactoring, and daily workflows by removing the friction of slow AI interactions. By enabling real-time decision making and continuous focus, it has unlocked new levels of productivity and confidence in automated tooling. As more teams adopt similar high-speed AI integrations, the boundary between human intuition and machine efficiency continues to blur—especially in environments where rapid analysis and adaptive response are essential. At Grivyonx, our AI automation and DevSecOps solutions are designed to bring that same speed and intelligence to cloud security and operational resilience for modern enterprises.