OpenAI Open-Sources Codex Security: Beats Snyk and Semgrep in True Positive Rate
dotey · x · 2026-07-29
OpenAI has open-sourced its code security scanning tool, Codex Security, under the Apache-2.0 license, providing both a CLI and a TypeScript SDK.
Core Features & Use Cases
- Plugin Version: Ideal for direct integration within Codex projects.
- Standalone Open-Source Version: Built for security teams to batch-scan organizational repositories, featuring history tracking, deduplication, false-positive tracking, and CI/CD pipeline integration.
Technical Details & Performance
- Utilizes the gpt-5.6-sol model for high-reasoning scans. Requires Node.js 22+ and Python 3.10+.
- Exports to SARIF, CSV, or JSON. Includes an install-hook command to automatically block high-severity commits via pre-commit hooks.
- During its public beta, it scanned over 1.2 million commits, identifying 792 critical and 10,561 high-severity vulnerabilities in projects like OpenSSH and Chromium.
- Third-party benchmarks on 162,000 lines of production code show Codex Security achieving a 74% true positive rate, significantly outperforming Snyk (28%) and Semgrep (20%).
Related event: OpenAI Open-Sources Codex Security CLI for Code Vulnerability Scanning(7 posts)→
More from coding & agent
- Agensis, an agent workspace with persistent memory, joins DeepSeek's startup program — jasonkneen · 2026-07-29
- Dan Grover built a Stream Deck plugin for showing AI agents in Herdr — DanGrover · 2026-07-29
- Local lip-reading demo turns a mouthed prompt into Claude code — breath_mirror · 2026-07-29
- GitHub repo bundles battle-tested settings for Claude Code, Codex CLI and Cursor — tom_doerr · 2026-07-29
- A setup screen compares Codex, Claude, Copilot, Cursor, and Grok Build — draginol · 2026-07-29
- Beginner Asks How to Build a Local AI Project Manager for Creative Projects, Community Offers Advice — koreanalleyarcade · 2026-07-29