OpenAI Open-Sources Codex Security: Beats Snyk and Semgrep in True Positive Rate
dotey · x · 2026-07-29
OpenAI has open-sourced its code security scanning tool, Codex Security, under the Apache-2.0 license, providing both a CLI and a TypeScript SDK.
Core Features & Use Cases
- Plugin Version: Ideal for direct integration within Codex projects.
- Standalone Open-Source Version: Built for security teams to batch-scan organizational repositories, featuring history tracking, deduplication, false-positive tracking, and CI/CD pipeline integration.
Technical Details & Performance
- Utilizes the gpt-5.6-sol model for high-reasoning scans. Requires Node.js 22+ and Python 3.10+.
- Exports to SARIF, CSV, or JSON. Includes an install-hook command to automatically block high-severity commits via pre-commit hooks.
- During its public beta, it scanned over 1.2 million commits, identifying 792 critical and 10,561 high-severity vulnerabilities in projects like OpenSSH and Chromium.
- Third-party benchmarks on 162,000 lines of production code show Codex Security achieving a 74% true positive rate, significantly outperforming Snyk (28%) and Semgrep (20%).
More from coding & agent
- Open-Source Google Analytics MCP Server Lets LLMs Query GA Data via Natural Language — modelcontextprotocol · 2026-10-16
- a16z podcast: AI cut a 6-month feature to 10 days and widened engineer gaps 10x — a16z · 2026-10-16
- "Hold On, My Agents Are Freezing My Screen": The Daily Grind of the Agent Era — every · 2026-10-16
- Open-Source Muslim Prayer Reminder MCP: Zero-Dependency Astronomical Time Server — TareqN · 2026-10-16
- Dev builds MCP feeding Claude 3,000 real launch videos to fix samey AI output — Designer_Landscape25 · 2026-10-16
- Satire: 19 Claude agents 'reverse-engineer' Blender, forgetting it's already open source — Dan_Jeffries1 · 2026-10-16