OpenAI Quietly Ships Codex Security to Scan 30,000 Codebases for Bugs

OpenAI pushed Codex Security to GitHub and npm before announcing it, and Hacker News found the repo first. The tool is a CLI and TypeScript SDK that uses OpenAI's reasoning models to scan codebases for security vulnerabilities, validate findings in a sandbox, and plug into CI/CD pipelines. It is open source under Apache-2.0 and available now.

What it does

Codex Security scans repositories, reviews diffs, tracks findings across runs, and gates CI pipelines on severity thresholds. The persistence across runs is what separates it from a one-shot scanner: you can tell whether a fix held, not just whether the tool ran again.

The scan pipeline runs in three stages:

1. It analyzes the repository's security-relevant structure and generates an editable threat model capturing what the system does and where it is most exposed.
2. It uses that threat model to identify vulnerabilities and classify findings by real-world impact.
3. It pressure-tests flagged issues in a sandboxed environment. When configured with a project-specific environment, it can validate issues against the running system directly.

By default, scans use gpt-5.6-sol at extra-high reasoning effort. Switch to gpt-5.6-terra for lower cost. The SDK and CLI support macOS, Linux, and Windows and require Node.js 22 or later. Scanning and exporting findings also require Python 3.10 or later.

Up and running in three commands

npm install @openai/codex-security
npx codex-security login
npx codex-security scan /path/to/repo

For CI and unattended scans, set OPENAI_API_KEY or CODEX_API_KEY via your shell, CI secret, or secret manager. To keep costs down on large repos, scan only a diff against a branch:

npx codex-security scan . \
  --diff origin/main \
  --output-dir "$SCAN_ROOT/results" \
  --json \
  --fail-on-severity high

The --fail-on-severity high flag exits with code 1 when a completed scan contains a finding at or above that threshold, which is exactly what you need to gate a merge queue.

Tracking findings over time

The persistence layer is what makes this useful for teams rather than individual audits. The scans match command links findings with the same root cause across runs, and scans compare surfaces new, persisting, reopened, or resolved findings. One of the tool's authors explained the design intent on Hacker News: the CLI is built for running security across many repos over time, covering org-wide scans, historical results, deduplication, false-positive tracking, budget controls, and CI integration.

Other capabilities worth knowing:

• Bulk scans: Sign in with gh auth login, then run npx codex-security bulk-scan to discover GitHub repositories pushed in the last 90 days. Pass a CSV of repos for automation.
• Knowledge bases: Feed in threat models, architecture docs, or PDFs with --knowledge-base to give the scanner project-specific context.
• Export formats: Completed scans can export to SARIF files, CodeQL queries, or existing vulnerability management systems.
• Auto-patch: The patch command runs a fix-finding skill on a specific finding and generates a candidate patch for review.
• Git hook: install-hook scans staged and unstaged changes before each commit and blocks high-severity findings.
• Docker support: A bundled Compose setup runs noninteractive bulk scans with a hardened sandbox: all capabilities dropped, nonroot user, custom seccomp profile.

Scale and context

OpenAI introduced Codex Security as an application-security agent in March 2026. Since then it has scanned more than 30 million commits across over 30,000 codebases. As part of that work, OpenAI reported critical vulnerabilities to widely used open-source projects including Thorium, libssh, PHP, and Chromium, resulting in fourteen CVEs.

The release comes weeks after Anthropic launched Claude Code Security with similar goals, and sits inside a broader OpenAI initiative called Daybreak. The premise behind Daybreak: AI has made finding bugs tractable, so the bottleneck has shifted to patching them.

Real friction from early users

The Hacker News thread surfaced problems quickly. Early users hit auth errors on launch. One person ran a scan on a small repo for nearly an hour before it failed because the repository HEAD changed mid-scan; the partial output was saved but not resumable in any obvious way. Another hit rate limits after spending roughly $13 on a single interrupted scan.

The team acknowledged the tool was just open-sourced and asked for feedback. Support for local or third-party model endpoints is not yet official, though the team confirmed they are working on it, and because the code is open source, swapping the model backend is already technically possible.

Code is sent to OpenAI's APIs for analysis, which rules out the tool for teams with strict data residency requirements. Amazon Bedrock is mentioned as an alternative path that avoids sending data directly to OpenAI. The tool is free to install, but API calls are billed separately, and at extra-high reasoning effort on gpt-5.6-sol, a full repo scan carries real cost.

Whether the persistence layer, deduplication, and CI gating are enough to displace existing SAST tools in production pipelines is the question the community is now actively testing.