OpenAI Quietly Ships Codex Security to Scan 30,000 Codebases for Bugs
OpenAI's AI-powered vulnerability scanner is now open source — scan repos, track findings over time, and gate CI on severity.
- Open sourced: OpenAI released Codex Security CLI (Apache-2.0) on npm before announcing it — Hacker News found it first.
- What it does: Scans repos for vulnerabilities using GPT-5.6-sol, validates findings in a sandbox, tracks results across runs, and gates CI on severity.
- Scale: The underlying system has already scanned 30M+ commits across 30,000+ codebases and filed 14 CVEs in projects like Chromium, PHP, and libssh.
- Key features: Bulk scans via CSV, SARIF/CodeQL export, auto-patch generation, git pre-commit hook, Docker support, and a TypeScript SDK.
- Limitations: Early auth bugs, no official local model support yet, code is sent to OpenAI APIs, and full scans can be expensive at default reasoning settings.
- Install:
npm install @openai/codex-securitythennpx codex-security login && npx codex-security scan .— requires Node.js 22+ and Python 3.10+.
OpenAI pushed Codex Security to GitHub and npm before announcing it, and Hacker News found the repo first. The tool is a CLI and TypeScript SDK that uses OpenAI's reasoning models to scan codebases for security vulnerabilities, validate findings in a sandbox, and plug into CI/CD pipelines. It is open source under Apache-2.0 and available now.
What it does
Codex Security scans repositories, reviews diffs, tracks findings across runs, and gates CI pipelines on severity thresholds. The persistence across runs is what separates it from a one-shot scanner: you can tell whether a fix held, not just whether the tool ran again.
The scan pipeline runs in three stages:
- It analyzes the repository's security-relevant structure and generates an editable threat model capturing what the system does and where it is most exposed.
- It uses that threat model to identify vulnerabilities and classify findings by real-world impact.
- It pressure-tests flagged issues in a sandboxed environment. When configured with a project-specific environment, it can validate issues against the running system directly.
By default, scans use gpt-5.6-sol at extra-high reasoning effort. Switch to gpt-5.6-terra for lower cost. The SDK and CLI support macOS, Linux, and Windows and require Node.js 22 or later. Scanning and exporting findings also require Python 3.10 or later.