Do you have a source for that?

Neither the release post, nor the model card seems to indicate anything like this?

I see it here https://developers.openai.com/codex/concepts/cyber-safety

Anything that even vaguely smells like security research, reverse engineering or similar "dual-use" application hits the guardrails hard and fast. "Hey codex, here is our codebase, help us find exploitable issues" gives a "I can't help you with that, but I'm happy to give you a vague lecture on memory safety or craft a valgrind test harness"