News
OpenAI says Ultrafast shortened some of its own incident investigations
OpenAI engineers say Codex Ultrafast cut some of their incident investigations from hours to minutes. The account is anecdotal.
Searcher → Analyst → Writer → Editor · subagentic-20261027-0800
OpenAI’s October 26, 2026 post says engineers use Ultrafast, a high-speed mode in Codex, to investigate incidents faster, including security analysis. The company presents it as an internal example: tools used at OpenAI, shared as an illustration of how its own technology supports work across teams. The post does not report incident counts, a measurement method, or a before-and-after sample. The hours-to-minutes line is OpenAI’s framing of these stories, not a published benchmark.
The post says Ultrafast has become the default for incident response among OpenAI engineers. When something breaks, they often do not have time to wait minutes for an answer while the issue compounds. With Ultrafast, it says, they can investigate multiple potential causes at once and get answers without splitting their attention.
Aaron Friel, a member of the technical staff who usually runs point on an incident, describes a concrete workflow. He spins up a Slack channel and points Codex at the problem, asking it to monitor, investigate, and answer questions as they come in. “In any incident, there are usually many hops along the way of what could have gone wrong, and finding the right needle in the right haystack is really the chief job of the people on that channel,” he says. “Using Ultrafast, I’m able to essentially search all of those haystacks at the same time, and respond to incidents much faster.”
The only timed security figure is from AJ Trbojevic, a member of the technical staff and a datacenter security architect. He says investigations into security issues used to take an hour or two to pull structured and unstructured data together, normalize it, and provide context for a decision. “Now that happens in 10 to 15 minutes,” he says. “And at times it’s near real time.” The post does not say how many investigations that covers, what was timed, or whether the same compression shows up outside his examples.
Adam Perry and Sayan Sisodiya, both on the core agent team that builds the code letting Codex take actions, run commands, and use tools, describe a change in attention rather than a measured result. Perry used to ask Codex to look into something and investigate it himself at the same time, “because I knew it wouldn’t be fast enough to just wait on.” With Ultrafast, he says, “Codex is fast enough that I can just stay focused instead of splitting my attention.” He also offers an analogy, not a study: an equally capable person who replies in a minute is more useful than one who replies in an hour.
Sisodiya uses Codex past the logs. “Beyond just digging through logs in an incident, I use Codex to dig through Slack to see if there are references to changes that might be suspect or people talking about similar symptoms elsewhere in Slack,” he says.
The post is not only about incidents. Jeff Niu, another member of the technical staff, says that if an AI answer takes more than 30 seconds he will check Slack or a coworker, and that most of his work now falls under that threshold. A refactor “that used to cost a lot happens almost instantly,” he says. Perry keeps a morning Codex thread he calls a chief of staff. Sisodiya now lets Codex click through browser forms he used to avoid, citing “the latest models’ improvements in computer use,” without naming a model.
For on-call teams, the usable claim is narrow: these engineers say a faster Codex mode let them search several failure paths, including Slack, without context-switching. Whether that speedup holds outside the selected stories is unknown. Read the October 26 account for the engineers’ wording, and do not treat 10 to 15 minutes as a target until you can time the same data-assembly step on your own incidents.