OpenAI Codex lead Tibo says humans have limited ability to write secure infrastructure
OpenAI Codex lead Tibo (@thsottiaux) posted on X that it can be taken as certain that humans are not good at writing secure infrastructure. He said the final state would be ultra-secure infrastructure and software for everyone, but that there would be a turbulent period before reaching that state.
Tibo then posted that formal proofs for tens of millions of lines of code are no longer absurd and should be considered when designing new systems. The two posts were personal public statements, with no specific product launch or technical details attached.
Tibo is responsible for Codex-related product work at OpenAI. The posts discuss the historical limitations of secure infrastructure and the feasibility of formal verification, and did not announce any specific OpenAI actions or timeline.
Original source:
Title: I can confidently say that humans were not very good at writing secure infrastructure.
Posted by: Tibo (@thsottiaux)
Date published: 2026-11-06
URL: https://x.com/thsottiaux/status/2118569235953893573
Nature of source: Personal public post
Verification status: Original post and the immediately following reply post were read
Supporting content: Judgment on humans’ ability to write secure infrastructure, statement about an ultra-secure end state, view on the feasibility of formal proofs
ABAB AI Insight
Tibo’s statement frames human-written secure infrastructure as having systemic limitations and expects future infrastructure to reach a higher level of security. This judgment is related to his role in OpenAI’s Codex product line, but the post itself did not disclose any specific internal security project or resource changes.
The post about formal proofs says that proving tens of millions of lines of code is now within the realm of consideration. This contrasts with traditional software verification methods, but the post did not state the current achieved scale, the tools used, or application cases.
From the perspective of capital and technical pathways, secure infrastructure has long depended on manual writing and auditing. If the cost of formal verification falls, it could change system design priorities, but the observation here remains at the level of personal public commentary.
Structurally, the two posts place historical limitations, an end-state expectation, and a verification method side by side. They provide input for security discussions, but do not translate into any confirmed product changes or industry standard adjustments.
ABAB News · Laws of cognition
Human-written secure infrastructure is framed as having systemic limitations, and the end state is described as a higher level of security.
Formal proof for tens of millions of lines of code is moved from being considered absurd to being an option that can be considered in system design.
Personal public commentary is related to a product role, but does not directly equal implemented company security actions.