Security audit · Pilot 01

Codex vs. Grok on a real smart-contract audit

A one-target case study of frontier coding agents on PoolTogether V5, measuring detection, precision, speed, tokens, and cost across differing harnesses.

PublishedCase study1 run/modelManual GT
100%Codex detection score
80%Codex F1
3.1×Faster wall time
4.9×Fewer processed tokens

On this pilot, GPT-5.6 Sol found both canonical high-severity vulnerabilities in PoolTogether V5. Grok 4.6 Build found one. Codex also finished in roughly one-third the time while processing about one-fifth as many tokens.

Bottom line. Codex scored higher in these two non-equivalent runs. This is a single-target case study, not evidence of universal model superiority or a causal model ranking.

The result in one view

Figure 01 · Finding coverage

Codex recovered both canonical findings

GPT-5.6 SolGrok 4.6 Build
Figure 01Canonical findings matched in the PoolTogether V5 audit pilot. Codex matched both reconstructed ground-truth issues; Grok matched one.

One run per model. Harnesses differed. Manually reconstructed ground truth; not an official EVMbench grader result.

BMSbms.kyokasuigetsu.xyz
Share figure
Static image: https://bms.kyokasuigetsu.xyz/charts/reference-detection.png

Figure 03 · Award-weighted detection

The missed issue carried nearly all of the award

GPT-5.6 SolGrok 4.6 Build
Figure 03Award-weighted detection score against the reconstructed canonical findings. Higher is better.

One run per model. Harnesses differed. Manually reconstructed ground truth: Codex received 2,183.69 available points; Grok received 2.25.

BMSbms.kyokasuigetsu.xyz
Share figure
Static image: https://bms.kyokasuigetsu.xyz/charts/detect-score.png

Codex found the two issues that mattered

The reconstructed ground truth contained two canonical high-severity findings. Codex matched both and added one unmatched report heading, producing 100% recall and 66.7% manual precision. Grok matched one canonical issue and reported three unmatched headings, for 50% recall and 25% precision.

Figure 02 · Audit quality

Codex scored higher on the reconstructed finding set

GPT-5.6 SolGrok 4.6 Build
Figure 02Recall, manual precision, and F1 for submitted audit findings. Higher is better.

One run per model. Harnesses differed. Manually reconstructed ground truth under a closed-world policy; unmatched headings are not automatically invalid. Accuracy is undefined.

BMSbms.kyokasuigetsu.xyz
Share figure
Static image: https://bms.kyokasuigetsu.xyz/charts/quality-metrics.png

The award-weighted gap is much larger than the raw recall gap because the missed issue carried nearly all of the canonical award. Codex received the full 2,183.69-point award; Grok received 2.25 points.

The weighted result was driven by the benchmark’s most consequential reconstructed issue.

The efficiency gap was also material

Codex completed the task in 506 seconds. Grok took 1,567 seconds. Codex processed 813,424 tokens against Grok’s 3,949,038 and generated around one-sixth the output tokens.

Figure 04 · Runtime efficiency

Codex finished faster and processed fewer tokens

GPT-5.6 SolGrok 4.6 Build
Figure 04End-to-end wall time and total processed tokens for the pilot. Each measure is normalized to the larger run; lower is better.

Absolute values remain printed on every bar. Harnesses differ, so this is descriptive evidence rather than a causal model ranking.

BMSbms.kyokasuigetsu.xyz
Share figure
Static image: https://bms.kyokasuigetsu.xyz/charts/efficiency.png

Figure 05 · Token composition

Most of each context was served from cache

GPT-5.6 SolGrok 4.6 Build
Figure 05Token composition by model. Segments show cached input, non-cached input, and output tokens.

Processed-token totals are 813,424 for Codex and 3,949,038 for Grok.

BMSbms.kyokasuigetsu.xyz
Share figure
Static image: https://bms.kyokasuigetsu.xyz/charts/token-composition.png
MetricGPT-5.6 SolGrok 4.6 Build
Detection score100%0.1%
Recall100%50%
Precision66.7%25%
Wall time8m 26s26m 7s
Processed tokens813k3.95m
Estimated cost$1.32$3.24

Cost is not directly comparable across subscription products, so we report its basis. Codex’s $1.32 is an API-equivalent estimate at published standard rates; Grok’s $3.24 comes from provider-reported telemetry ticks. Neither figure proves the user’s subscription charge.

Figure 06 · Cost basis

The pilot cost less on the Codex estimate

GPT-5.6 SolGrok 4.6 Build
Figure 06Reported or estimated USD cost for each pilot run. Lower is better, but the pricing bases are not identical.

Codex uses published API-equivalent rates ($1.32–$2.41); Grok uses provider-reported telemetry ($3.24). Neither proves subscription invoice impact.

BMSbms.kyokasuigetsu.xyz
Share figure
Static image: https://bms.kyokasuigetsu.xyz/charts/estimated-cost.png

What we controlled

Both systems received fresh workspaces, the same target repository, high reasoning settings, no web search, and no live targets. The harnesses and prompts were not identical: the Codex run prohibited proof-of-concept authoring, while the Grok workflow used its native multi-agent audit pipeline and produced proof-of-concept material. These differences limit causal claims.

Findings were graded manually against reconstructed canonical ground truth. Titles did not count as matches by themselves; root cause and impact had to align.

What this result does not prove

This pilot has one target and one completed run per model. It measures one security-audit task, not general coding ability. The harnesses are not perfectly identical, and pricing bases differ. Accuracy is intentionally undefined because an open-ended audit has no finite true-negative universe.

The controlled campaign adds preregistered targets and replicates to address these limits. Until it is graded, this publication should be read as a strong case study—not a final leaderboard.

Read the methods behind the numbers.

View methodology