AI News — March 16, 2026

OpenAI explains why Codex Security takes a fundamentally different approach to code security than traditional SAST tools — using AI-driven constraint reasoning to find real vulnerabilities rather than generating noisy false-positive reports. The post digs into the technical rationale and what this means for developers integrating security checks into AI coding workflows.

Today's stories:

• Why Codex Security doesn't include a SAST report (OpenAI News) — OpenAI explains why Codex Security takes a fundamentally different approach to code security than traditional SAST tools — using AI-driven constraint reasoning to find real vulnerabilities rather than generating noisy false-positive reports. The post digs into the technical rationale and what this means for developers integrating security checks into AI coding workflows.
• Tool Annotations as Risk Vocabulary: What Hints Can and Can't Do (MCP Official Blog) — The MCP team reviews the state of tool annotations — the metadata that tells clients whether a tool is read-only, destructive, or reaches outside its local environment. Five community SEPs have proposed new annotations, and this post provides a clear framework for evaluating them: what annotations can actually communicate, where the limits are, and how clients should treat them as hints rather than guarantees. Essential reading for MCP server developers.
• Securing Our Codebase with Autonomous Agents (Cursor Blog) — Cursor's security team built a fleet of autonomous agents to find and fix vulnerabilities across their fast-moving codebase — and open-sourced the result. The post covers how they designed the agent fleet, what vulnerability classes they targeted, and the lessons learned from running security agents in production on a real codebase. Practical reference for teams considering AI-driven security automation.
• Giving you more transparency and control over your Gemini API usage (Google AI Blog) — Google added new usage transparency and control features to the Gemini API — per-request cost attribution, usage dashboards, rate limit controls, and API key scoping. Addresses the enterprise need to govern and audit AI API usage across large teams and multiple products. Practical for any organisation managing Gemini API spend at scale.