Codex at Ramp: Faster Code Review With GPT-5.5

Ramp put Codex into the review loop

Ramp engineers are using Codex with GPT-5.5 to speed up code review and build internal agentic tooling. The practical result is simple: pull request feedback that once took hours now arrives in minutes instead of hours.

That matters because review latency shapes everything downstream. When a first pass takes too long, engineers either wait, batch changes, or move on before feedback lands. Ramp’s AI Developer Experience team is using Codex to improve software development velocity and code quality at the same time.

The key detail here is not that Codex writes code. It is that Ramp has moved it into the review loop, where it can catch issues early, reason about changes, and help teams keep moving. That is a different use case from autocomplete. It is closer to having a second reviewer on demand.

---

How Codex changes code review

Austin Ray describes Codex code review as the "industry gold standard," and says Ramp engineers ask for it by name. He also says it has become a mandatory part of a lot of code review flows. That is a strong signal that the tool is not experimental at Ramp. It is part of the routine.

In practice, that changes the shape of review work:

• Review starts sooner.
• Feedback arrives before context goes stale.
• Engineers can move from waiting to fixing.
• Harder pull requests get a first pass without burning human reviewer time.

Ray says Codex can handle complexity that would otherwise take a lot of mental effort, sleep, and single-minded focus. He also says its reasoning produces a level of thoroughness that most human reviewers do not have time for. Those are not claims about replacing reviewers. They are claims about shifting the first layer of scrutiny to a system that can stay patient on every PR.

If you are trying to understand where this fits in a broader security workflow, start with AI Coding Tools and AppSec Risk: What to Audit Now. It covers the controls you need when AI enters the dev loop.

---

Why minutes instead of hours matters for security

The biggest security gain in a faster review loop is not speed for its own sake. It is feedback timing. When engineers can get substantive feedback in minutes instead of hours, they are more likely to fix issues while the change is still fresh in memory.

That matters for all the small decisions that turn into vulnerabilities later:

• A missing guardrail that should have blocked unsafe input.
• A risky refactor that changes trust boundaries.
• A helper function that copies insecure patterns across files.
• A permission check that looks correct in one path and breaks in another.

The faster the loop, the easier it is to keep a reviewer, a writer, and a patch in the same context window. Codex does not remove the need for human judgment. It shortens the distance between change and critique.

That kind of turnaround also matters when teams are shipping internal tools. Ramp says Codex has made its On-Call Assistant significantly faster to build. In a security context, that is important because internal agentic tooling often touches sensitive workflows, incident response, and operational permissions. Faster development can be good. Faster review becomes the counterweight.

---

What Ramp is using Codex for beyond review

Ramp is not limiting Codex to pull requests. The company says its AI Developer Experience team uses it to improve software development velocity and code quality, and to develop internal agentic tooling.

That combination is worth watching. Once a team uses an AI system for review, it is a short step to using the same system to help build the tools that orchestrate work across engineering and operations. At that point, the system is no longer just commenting on code. It is influencing how code gets produced, reviewed, and shipped.

Austin Ray says Ramp’s product surface area is "pretty immense," and that Codex with GPT-5.5 handles it "like it’s nothing." Whether you agree with the wording or not, the underlying point is straightforward: the system is being used where the codebase is broad and the review load is real.

That is also where teams tend to miss risk. Larger surfaces create more chances for inconsistent patterns, incomplete checks, and edge cases that only show up after merge. A reviewer that stays available and thorough can reduce that drift.

For a broader look at the shift toward agentic workflows, see Enterprise AI Agents: How to Secure Them in 2026.

---

What other engineering teams should copy

Ramp’s setup does not tell every team to adopt Codex. It does show a useful pattern.

First, put AI review tools into a narrow, visible lane. Start with pull requests, where feedback is easy to compare against human review.

Second, measure whether the tool is reducing wait time without lowering quality. Ramp’s own description points to faster first feedback and stronger review depth, not just faster output.

Third, keep the human reviewer in the loop. The goal is not to let the model approve code alone. It is to make sure the first pass is fast, substantive, and available when the team needs it.

Fourth, extend the same discipline to agentic tools. If an internal assistant or workflow helper is built faster, it still needs the same review standards as any other code path. Speed should not outrun control.

If your team is already experimenting with AI coding tools, this is the point where a structured review matters. A focused assessment can tell you where the workflow is solid and where it is creating new blind spots. That is the right time to look at an AI Code Security Audit.

---

The takeaway for security teams

Ramp’s story is not about a flashy demo. It is about making code review faster, more available, and more consistent. Engineers get substantive feedback in minutes instead of hours. Ramp says the tool has become a mandatory part of many review flows. And the company is using the same system to build internal agentic tooling.

The lesson for security teams is clear: if you let AI into review, treat it like a new control surface. Define what it may flag, what it may miss, and where a human must decide. Then test it on real pull requests, not toy examples.

Start with one repo. Put Codex, or any similar reviewer, on the first pass. Measure time to feedback. Measure defect escape. Keep the human sign-off. Then expand only when the data says the process is safe enough to scale.

---

Why this matters for AI code security

Ramp is showing how AI can compress the review cycle without removing oversight. That is useful for velocity, but it also raises the bar for governance. When a reviewer becomes a routine part of the workflow, teams need to know how it behaves on edge cases, how it handles sensitive code, and how it interacts with approval policy.

That is the right standard for any organization adopting agentic tooling. The more you rely on the system, the more important it becomes to verify its limits. Use the speed gain. Keep the guardrails.

If you are shipping with AI today, the next step is not more enthusiasm. It is a tighter review process, clearer ownership, and a human who can challenge the model when the model is wrong.