OpenAI Quietly Ships Codex Security to Scan 30,000 Codebases for Bugs
OpenAI's AI-powered vulnerability scanner is now open source — scan repos, track findings over time, and gate CI on severity.
- Open sourced: OpenAI released Codex Security CLI (Apache-2.0) on npm before announcing it — Hacker News found it first.
- What it does: Scans repos for vulnerabilities using GPT-5.6-sol, validates findings in a sandbox, tracks results across runs, and gates CI on severity.
- Scale: The underlying system has already scanned 30M+ commits across 30,000+ codebases and filed 14 CVEs in projects like Chromium, PHP, and libssh.
- Key features: Bulk scans via CSV, SARIF/CodeQL export, auto-patch generation, git pre-commit hook, Docker support, and a TypeScript SDK.
- Limitations: Early auth bugs, no official local model support yet, code is sent to OpenAI APIs, and full scans can be expensive at default reasoning settings.
- Install:
npm install @openai/codex-securitythennpx codex-security login && npx codex-security scan .— requires Node.js 22+ and Python 3.10+.
OpenAI quietly pushed Codex Security to GitHub and npm before it had a chance to announce it , Hacker News found the repo first. The tool is a CLI and TypeScript SDK that uses OpenAI's reasoning models to scan codebases for security vulnerabilities, validate findings in a sandbox, and plug into CI/CD pipelines. It is open source under Apache-2.0 and available right now.
What it actually does
Codex Security is a CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in your code. It lets you scan repositories, review changes, track findings over time, and run security checks in CI. That last part is the key differentiator from a one-shot scan: the tool is built around persistence across runs.
The scan pipeline works in three stages:
- It analyzes a repository to understand the project's security-relevant structure and generates an editable threat model that captures what the system does and where it is most exposed.
- Once the system context is built, Codex Security uses it as a foundation to identify vulnerabilities and classifies findings based on their real-world impact.
- The flagged issues are pressure-tested in a sandboxed environment to validate them. When configured with an environment tailored to your project, it can validate potential issues directly in the context of the running system.
By default, scans use gpt-5.6-sol with extra-high reasoning effort. You can switch to gpt-5.6-terra for a cheaper run. The SDK and CLI support macOS, Linux, and Windows and require Node.js 22 or later. Scanning and exporting findings also require Python 3.10 or later.