OpenAI open-sources Codex Security CLI for code scanning

OpenAI has released its Codex Security CLI as an open-source project, making the AI-powered security scanning tool freely available to developers under the Apache-2.0 license. The release, which OpenAI acknowledged on July 29 after users on Hacker News discovered the GitHub repository, provides a command-line interface and TypeScript SDK for finding, validating, and fixing security vulnerabilities across codebases.developersdigest+1

How It Works

Published as the npm package @openai/codex-security, the tool uses AI models for contextual code analysis rather than relying solely on traditional pattern matching. Developers can scan entire repositories, review pull-request diffs, track findings across runs, verify fixes, and integrate automated security checks into CI/CD pipelines.openai+1

"We quietly released the open-source Codex Security CLI, but Hacker News found it before we had a chance to share it here," OpenAI posted on X. "You can now use it to scan repositories, track findings across runs, verify fixes, and add security checks to CI/CD."developersdigest

Installation requires Node.js 22 or later and Python 3.10 or later. Basic usage does not require a ChatGPT Plus subscription, though an OpenAI API key unlocks full scanning capabilities and is recommended for automated environments.openai

From Research Preview to Open Source

Codex Security first entered research preview in March 2026 as an AI agent designed to automate code security reviews. The tool is built on OpenAI's lightweight Codex coding agent and distinguishes itself from the Codex plugin by being designed for long-term security management across multiple repositories, including organization-wide scans, historical results, deduplication, false positive tracking, and budget management.developersdigest

Michael, a developer involved in the project, explained on Hacker News that while the Codex plugin is suited for scanning a single active repository, the standalone CLI and SDK are built for sustained security operations across organizations.developersdigest

Supporting Open-Source Maintainers

The release complements OpenAI's broader "Codex for Open Source" program, announced in March 2026, which provides eligible open-source maintainers with six months of ChatGPT Pro access, conditional access to Codex Security, and API credits for maintainer workflows. OpenAI has also expanded its Daybreak cybersecurity initiative with "Patch the Planet," a program pairing Codex Security with security firm Trail of Bits to work directly with open-source project maintainers on vulnerability discovery and remediation.openai+3

The repository had already accumulated roughly 1,500 stars on GitHub at the time of the announcement, suggesting early developer interest in AI-assisted security tooling as code generation accelerates.openai