OpenAI Open-Sources Codex Security CLI for AI-Powered Vulnerability Scanning and Fixing
On July 29, OpenAI open-sourced Codex Security CLI and TypeScript SDK under Apache-2.0, now available on GitHub. The tool evolved from a closed-source security plugin within Codex, using AI to automatically scan code vulnerabilities, verify fixes, and generate patches, with CI/CD integration. According to @dotey's hands-on test, its true positive rate far exceeds Snyk and Semgrep, though no official benchmark has been released. OpenAI core executive @gdb confirmed ongoing work on local OpenAI-compatible API support, noting the product is rapidly evolving.
Confirmed
- Open Source & Core Features: The tool acts as an application security agent with a three-step workflow: reading repositories to generate threat models, verifying suspected vulnerabilities, and auto-generating fix patches. It supports deep security scanning, code change review, historical vulnerability tracking, and CI integration.
- Usage Scenarios: Per @dotey and @haltakov, the tool offers a plugin version for direct use in Codex and a standalone CLI for automation workflows.
- Local Support: @gdb stated the team is working on local OpenAI-compatible API support, and the product is still evolving rapidly.
Unconfirmed
- Performance Comparison: @dotey reported that the tool's true positive rate "far exceeds" Snyk and Semgrep. This claim is based on personal testing; no standardized third-party benchmark has been provided by OpenAI.
Why It Matters
- By combining vulnerability scanning with AI-driven auto-fixing and releasing it fully open-source, OpenAI significantly lowers the barrier for developers to integrate advanced code security. If the high accuracy observed in testing generalizes, it could reshape the code security audit landscape.
2026-07-29 ~ 2026-07-31 · 11 related posts
- Episode 1: OpenAI Open-Sources Codex Security CLI for AI-Powered Vulnerability Scanning and Fixing(2026-07-29, 11 posts)
- Episode 2: OpenAI Introduces Codex Security Review for GitHub PRs(2026-08-06, 4 posts)
Primary sources
- OpenAI Open-Sources Codex Security: Beats Snyk and Semgrep in True Positive Rate — dotey · 2026-07-29
- OpenAI releases Codex Security, a CLI and TypeScript SDK for code scanning — haltakov · 2026-07-29
- [source] OpenAI open-sources the Codex Security CLI — gdb · 2026-07-29
- [source] OpenAI open-sources Codex Security CLI for repo scans and CI/CD checks — OpenAI · 2026-07-29
7 near-duplicate retellings: dotey · soumitrashukla9 · Polymarket · rohanpaul_ai · 量子位 · 新智元 · emmanuelvivier