JPMorganChase taps OpenAI for Codex and cybersecurity

By Elena Vasquez

OpenAI President Greg Brockman said JPMorganChase signed a contract with OpenAI for Codex coding agents and cybersecurity models, as CFO Jeremy Barnum put annual AI spending at roughly $700 million.

Brockman announced the agreement on social media. Codex AI agents will write, review, debug, and ship code. JPMorganChase will also use OpenAI models for cybersecurity, he said.

American Banker called the deal significant because JPMorganChase rarely announces vendor agreements and other banks tend to follow the technology choices of the largest U.S. bank.

The agreement, as Brockman described it, links a new coding layer with cybersecurity work at an institution whose internal AI costs have already reached $700 million a year.

“JPMorganChase is increasingly setting the architectural and economic blueprint for how banks adopt AI,” said Krish Subramanian, founder and managing partner at Rishidot Research.

Subramanian said treating AI as core infrastructure, rather than an innovation expense, could set new baselines for bank technology investment, operating models, and competitive expectations.

He also said the bank’s scale and investment could shape the technology architectures, infrastructure requirements, and vendor ecosystems adopted elsewhere in banking.

What does the contract put inside JPMorganChase?

Codex AI agents will write, review, debug, and ship code, according to Brockman. The bank will also use OpenAI models for cybersecurity, he said.

A JPMorganChase spokeswoman said the bank uses a variety of tools and will continue using multiple tools. She declined to disclose the contract’s terms or identify which OpenAI models the bank will use beyond Codex, American Banker reported.

The spokeswoman’s answer frames the agreement as an expansion of the bank’s AI stack, not a declared wholesale switch to one vendor. It also matches Barnum’s description of JPMorganChase’s model-agnostic strategy.

Brockman’s announcement gives OpenAI two connected workloads: code production and cybersecurity. For other banks, the deployment could offer a reference point for combining commercial AI services with internal infrastructure.

But American Banker noted that JPMorganChase rarely announces vendor agreements. Its technology choices can influence peers, making the contract more consequential than a routine purchasing decision.

What AI does JPMorganChase already use?

American Banker reported that JPMorganChase had already acknowledged a broad set of outside models. Its LLM Suite gives employees access to models including OpenAI’s GPT-4 and Anthropic’s Claude.

The same report said engineering and internal analysis teams use Claude. Developers use GitHub Copilot alongside other AI coding models.

The OpenAI deal adds Codex to that existing mix. It also extends the vendor’s role from employee tools and developer assistance into software delivery and security operations.

Barnum said JPMorganChase’s strategy focuses on minimizing lock-in while maximizing optionality and the ability to manage costs.

He described the approach as model agnosticism and harness agnosticism. That means keeping flexibility across models and the systems used to run them. The bank wants to run proprietary models alongside open-weight and open-source models, Barnum said.

JPMorganChase runs some open-source models in its own data center, according to Barnum. That supports a wider strategy in which OpenAI can gain workload while other model providers remain in the mix.

How much does JPMorganChase spend on AI?

During the bank’s third-quarter earnings call last month, Barnum said JPMorganChase spends something like $700 million annually on AI.

He said a higher total would emerge if the time employees spend thinking about AI were priced in. That cost is not isolated in one budget.

Barnum said AI spending has diffused throughout the institution and is now a very high priority. His description makes the OpenAI contract one part of an already large operating commitment, rather than a stand-alone experiment.

The benefits had not appeared in JPMorganChase’s quarterly results, Barnum conceded. He said visible effects can take a long time to emerge at an institution of the bank’s size.

JPMorganChase has run experiments in which AI rewrote minor legacy tools within a couple of weeks. Barnum said those experiments did not work perfectly.

The trials still showed what he called exciting opportunities for acceleration and productivity change. He said some eventual benefits will be offset by token costs, leaving the net financial result uncertain.

Barnum also said it remains unclear how long those gains will take to become visible. That uncertainty sits beside the bank’s high spending, broad model portfolio and preference for keeping its options open.

What does the security role change?

Linas Beliunas, a venture advisor at EQT Ventures, called JPMorganChase’s use of OpenAI models for cybersecurity the deal’s most noteworthy feature.

“Helping employees write documents is one thing, asking a vendor to help secure a bank means trusting it with a very different class of work,” said Linas Beliunas, a venture advisor at EQT Ventures. “This is a much bigger ambition than giving staff a chatbot.”

The distinction raises the operational stakes. A coding agent can work within a defined development process, while a cybersecurity model touches the bank’s broader protection requirements, according to Beliunas.

Regulators have not issued model-risk guidance specific to generative and agentic AI. The Office of the Comptroller of the Currency recently published a framework for examiners’ risk-based assessments of AI used in banks.

Under that OCC framework, examiners assess each AI deployment as they would any other technology deployment. That approach puts JPMorganChase’s Codex and security deployment inside the same risk-based supervisory process.

The policy setting remains less defined than the technology itself. Beliunas’s point is practical: security work demands more trust than document assistance, while OCC guidance leaves examiners to weigh AI risk deployment by deployment.

What happens next?

Brockman’s announcement gives OpenAI Codex and cybersecurity workloads at the largest U.S. bank, while JPMorganChase keeps a multi-model purchasing strategy. That combination could influence the vendors, infrastructure and operating models other banks choose, Subramanian said.

The bank also has to show returns. Barnum said productivity gains may take time, and he expects token costs to offset part of the benefit. JPMorganChase’s next test is whether its broad AI spending becomes visible without sacrificing its stated cost control and optionality.

For OpenAI and its rivals, the security role carries more weight than the coding contract alone. Beliunas said JPMorganChase is entrusting a vendor with a different class of work, and American Banker said other banks watch what the bank does.

The test will come later: whether Codex produces durable gains inside JPMorganChase, whether security benefits justify their cost, and whether the bank’s model-agnostic approach makes the OpenAI deal a repeatable template for peers.