OpenAI Open-Sources Codex Security CLI for Finding, Validating, and Fixing Code Vulnerabilities
OpenAI has released Codex Security, an AI-powered command-line tool and SDK designed to help developers identify, validate, and patch code vulnerabilities directly within their development workflows.
OpenAI has open-sourced Codex Security, a command-line tool and TypeScript SDK designed to help developers find, validate, and fix security vulnerabilities in their codebases. The release marks a notable step in bringing AI-driven security analysis into everyday development workflows, allowing teams to scan repositories, review pull requests, and embed automated checks directly into CI/CD pipelines.
Built on the lightweight Codex coding agent, Codex Security entered research preview in March 2026 and is now available under the Apache-2.0 license, already earning roughly 1.5k stars on GitHub. The tool, published as the npm package @openai/codex-security, uses AI models for contextual analysis rather than relying solely on traditional pattern matching. This approach allows it to assess how code behaves in context, surface meaningful findings, and propose patches that developers can review and apply.
Early users on Hacker News and X have highlighted its potential at a time when AI-assisted code generation is accelerating, and security teams need faster ways to keep pace with new code. Some initial authentication glitches appeared after launch, but OpenAI addressed them quickly, reinforcing confidence in the project’s early momentum. OpenAI announced the release via X, stating, "You can now use it to scan repositories, track findings across runs, verify fixes, and add security checks to CI/CD. This is an early release, and we're…" Source: OpenAI on X
Getting started is straightforward. Codex Security requires Node.js 22 or later, Python 3.10 or later, and access to Codex Security. Installation is a single npm command: npm install @openai/codex-security. After that, users can authenticate with npx codex-security login and run a scan with npx codex-security scan. Basic usage does not require a ChatGPT Plus subscription. An OpenAI API key unlocks full scanning capabilities and is the preferred path for automated environments.
In CI pipelines, teams simply set the OPENAI_API_KEY environment variable instead of completing an interactive sign-in. When both a ChatGPT session and an API key are present, interactive scans prompt the user to choose a credential, while non-interactive runs follow API-key precedence. Developers can also force a specific method with flags such as --auth chatgpt or --auth api-key. To make ChatGPT the default, any configured API keys can be unset.
Scan history is stored in the Codex Security workbench state directory. If that location is not writable, the CODEX_SECURITY_STATE_DIR environment variable can point to a writable directory outside the repository. For teams that prefer programmatic control, OpenAI also ships a TypeScript SDK. A short script can instantiate CodexSecurity, run a scan against the current directory, log the path to the generated report, and close the client cleanly.
For security engineers and development teams, the practical value lies in tighter feedback loops. Instead of waiting for periodic manual reviews or slow static-analysis runs, Codex Security can examine changes as they land, track findings over time, and suggest fixes grounded in the surrounding code. That combination of repository scanning, pull-request review, and pipeline integration positions the tool as a useful addition to modern application security programs, especially as organizations adopt AI coding assistants at scale.
As the research preview matures, broader adoption and community feedback will likely shape how AI-assisted vulnerability discovery becomes a standard part of secure software delivery. This release from OpenAI underscores the growing trend of leveraging AI for proactive security measures throughout the software development lifecycle.