OpenAI Open-Sources Codex Security, Beating Snyk in True Positive Rate
dotey · x · 2026-07-29
OpenAI has open-sourced Codex Security (CLI and TypeScript SDK) under the Apache-2.0 license. The AI-powered tool automatically scans codebases for vulnerabilities, verifies them, and generates patches.
Key Details & Data:
- Capabilities: Evolved from a closed-source Codex plugin, the standalone version is built for security teams. It supports bulk repository scanning, deduplication, false positive tracking, and CI/CD pipeline integration.
- Pre-commit Hook: Features an install-hook command to automatically scan changed files before git commit, blocking high-severity issues.
- Testing Results: During public testing, it scanned over 1.2 million commits, finding 792 critical and 10,561 high-severity vulnerabilities in projects like OpenSSH and Chromium.
- Benchmark: On 162,000 lines of production code, Codex Security achieved a 74% true positive rate, significantly outperforming Snyk (28%) and Semgrep (20%).
- Tech Stack: Uses the gpt-5.6-sol model for high-reasoning scans. Requires Node.js 22+ and Python 3.10+.
More from coding & agent
- Open-Source Google Analytics MCP Server Lets LLMs Query GA Data via Natural Language — modelcontextprotocol · 2026-10-16
- a16z podcast: AI cut a 6-month feature to 10 days and widened engineer gaps 10x — a16z · 2026-10-16
- "Hold On, My Agents Are Freezing My Screen": The Daily Grind of the Agent Era — every · 2026-10-16
- Open-Source Muslim Prayer Reminder MCP: Zero-Dependency Astronomical Time Server — TareqN · 2026-10-16
- Dev builds MCP feeding Claude 3,000 real launch videos to fix samey AI output — Designer_Landscape25 · 2026-10-16
- Satire: 19 Claude agents 'reverse-engineer' Blender, forgetting it's already open source — Dan_Jeffries1 · 2026-10-16