Code Is Free: Securing Software in the Agentic Future

Code Is Free: Securing Software in the Agentic Future

Speakers: Paul McMillan (Security Engineer, OpenAI); Ryan Lopopolo (Member of Technical Staff, OpenAI)

Conference: [un]prompted 2026 — The AI Security Practitioner Conference

Date: March 3–4, 2026, San Francisco

Watch on YouTube: https://www.youtube.com/watch?v=U2O14Jd3MBU

Reading time: ~8 minutes

TL;DR

OpenAI security engineer Paul McMillan and product engineer Ryan Lopopolo argue that AI-generated code has fundamentally broken the economics of security tooling. Instead of paying vendors and waiting quarters for features, teams can encode security expertise directly into their repositories as prompts, lints, and CI checks — and let Codex do the implementation in minutes.

Introduction

Security programs have always suffered from the same gap: practitioners know exactly what good looks like, but lack the engineering bandwidth to make it so. The vendor market exists to fill that gap, but the cure often feels as painful as the disease — months of integration work, stiff tooling built around someone else's assumptions, and feature requests that take quarters to resolve.

At [un]prompted 2026, Paul McMillan opened his talk with a disarming admission: "If your security program is perfect, I'm happy for you. This talk is not for you." For the rest of the industry, McMillan and his co-presenter Ryan Lopopolo offered a genuinely different premise. The bottleneck was never knowledge or intent — it was implementation cost. And that cost has collapsed.

▶ Watch: The Old Way of Doing Security (00:00)

The Core Claim: Software Doesn't Cost Anything to Build Anymore

The talk's thesis fits in three words: code is free. McMillan stated it plainly at the two-minute mark: "Software doesn't cost anything to build anymore, and the secret is that includes security software too."

The implication is significant. Every item on the perpetual "we wish we had time to do this" list — custom lints, dependency audits, automated threat model reviews, supply chain hardening — can now be delegated to a coding agent. Teams don't need a vendor contract or a dedicated engineering sprint. They need a text file and a CI pipeline.

The practical minimum McMillan demonstrated: a SECURITY.md file describing what you want checked, a tool call that returns zero or one with explanatory text, and a few lines connecting it to your CI framework. In the open source example he shared, the invocation looks like:

No vendor contracts. No frameworks. Just ask Codex to write the integration, customized to your environment.

▶ Watch: Code Is Free — The Core Argument (02:00)

Living Threat Models: Check Them In, Validate Them Constantly

Ryan Lopopolo, who has spent the last eight months leading a team that "writes zero of the code" and built a product with roughly a million lines of code (about 250,000 of which are prompts), took over to describe what this looks like in practice.

The first concrete pattern: threat models that live in the repository. Most organizations have threat models. Few use them. They end up locked in a Slack thread or a Google Doc that no one opens. Lopopolo's framing was direct: "A threat model that's locked in a Slack thread or some Google Doc that I know I am never gonna read is not something that I am able to build durable product with."

Coding agents, he noted, live in the universe of code, markdown, and scripts in repositories. A threat model trapped in an external document is invisible to them. The fix is to ask a model to deduce the threat model from the existing codebase, check it in, and then validate it on every PR. This is roughly forty lines of YAML in GitHub Actions — an agent tasked with ensuring the threat model remains current and that no PR invalidates documented assumptions.

If the team isn't ready for full autonomy, the agent can instead tag the relevant human expert when a material change occurs, explain why they've been brought into scope, and articulate what ambiguity needs resolution.

▶ Watch: Threat Models in the Repo (04:00)

Encoding Expertise: From Slack Messages to Executable Guardrails

Lopopolo described a mindset shift that sits at the heart of the approach: every piece of feedback — every Slack message flagging a concern, every PR review comment, every AppSec review finding — represents missing context. The goal is to stop treating that context as a point-in-time event and start treating it as a durable input to the codebase.

The concrete example: OpenAI's security.md contains a two-sentence principle — "Secure code comes from secure interfaces that are impossible to misuse." That single addition produced measurable uplift. Agents reading it started generating high-level primitives for file system access using safe, rooted operations instead of stitching together realpath calls and hoping for the best.

"You can take entire classes of vulnerabilities," Lopopolo said, "compress them into a paragraph of text, and then just have an agent review every PR against those guardrails."

The operational translation: every Slack message a security engineer has ever sent asking an engineering team to change behavior can be replied to with @Codex. Make it so. The agent writes the documentation, writes the tests, and migrates the codebase.

▶ Watch: Encoding Security Expertise Into the Codebase (10:00)

Supply Chain Hardening in 15 Minutes

The supply chain example illustrated the scale of what's now achievable with minimal investment. Lopopolo described having a 15-minute coffee conversation with McMillan about dependency sprawl in their Electron codebase — 1,500 dependencies in the lock file, no realistic path to auditing them individually.

Out of that conversation came a CI job that forks sixteen parallel agents to spider through the codebase and produce a daily snapshot of every direct dependency, every upstream transitive, and a "vibe check" on each upstream repository — including recent activity signals and author reputation.

The output gets published to an internal hosting platform and converted into SARIF reports pushed into GitHub Advanced Security. Other agents then pick up those reports and can propose dependency upgrades, removals, or migrations to alternative frameworks.

The incremental cost: a 15-minute conversation, then asking Codex to make it so. McMillan and Lopopolo refined the output asynchronously in Slack, with Codex picking up the thread via the new ChatGPT Slack connection and iterating on the scanner.

▶ Watch: Supply Chain Hardening Demo (16:02)

Token Economics and Human-in-the-Loop Design

A question from the audience surfaced the elephant in the room: OpenAI employees telling the rest of the world that "tokens are free" carries some irony. Lopopolo addressed it directly. The team deploys roughly a 50/50 split of their token budget — half toward producing code, half toward refining it through asynchronous reviewer and scanner agents.

The primary orchestration layer runs through GitHub: PR comments, GitHub Advanced Security as a broker, and GitHub Actions for coordination. The goal is to have reviewer agents produce tokens that get injected into the implementation agents so they can proceed with full context.

On insider risk and prompt injection — can an agent be convinced to approve malicious code? McMillan's answer: "There's a model looking for that." Standard two-party sign-off controls apply to agents as well as humans, and you can have two agents check each other's work. The Codex harness exports OpenTelemetry traces natively, providing audit logging of all agent session logs for DFIR review.

▶ Watch: Token Economics and Q&A (22:02)

Notable Quotes

"Code is free. Software doesn't cost anything to build anymore, and the secret is that includes security software too." — Paul McMillan (02:00)

"A threat model that's locked in a Slack thread or some Google Doc that I know I am never gonna read is not something that I am able to build durable product with." — Ryan Lopopolo (04:00)

"Secure code comes from secure interfaces that are impossible to misuse." — Ryan Lopopolo, quoting their security.md (10:00)

"Every Slack message you've ever sent letting an engineering team know they're not operating the way you need them to — just reply to it, at Codex. Make it so." — Ryan Lopopolo (10:00)

Key Takeaways

• Check your threat model into the repo. Threat models that live in external documents are inaccessible to coding agents. Use an LLM to generate one from the existing codebase, commit it, and add a CI step that validates it on every PR.
• Turn feedback into guardrails, not point fixes. When AppSec reviews or PR comments surface issues, the real output shouldn't be a patch — it should be an executable lint or test that prevents the whole class of mistake from recurring.
• Supply chain auditing is now a 15-minute investment. A single conversation with a security engineer plus a Codex task can produce a daily dependency audit CI job with SARIF output and GitHub Advanced Security integration.
• Treat humans as tools in the pipeline. When you need expert input, invoke the human the same way an agent would invoke a tool call — with a specific question and context — then encode the output durably in the codebase.
• Agents benefit from the same guardrails as humans. Two-agent sign-off, OTEL-based audit logging, and explicit "no slop" policies in your security.md all apply to agentic contributors as much as human ones.

Slides Reference

Slides are available as 2026-04-04-D1-S1-11-12-Code-Is-Free-Securing-Software-in-the-.pdf. Key slide topics include: "The Past" (security tool friction), "Code is Free," the CI command snippet for running Codex against a security file, threat model workflow (make one → validate constantly → make it part of code review → escalate to humans when it changes), supply chain hardening, and the closing message: "things stack incredibly well / just go build things."