OpenAI Open-Sources Codex Security, Beating Snyk in True Positive Rate
dotey · x · 2026-07-29
OpenAI has open-sourced Codex Security (CLI and TypeScript SDK) under the Apache-2.0 license. The AI-powered tool automatically scans codebases for vulnerabilities, verifies them, and generates patches.
Key Details & Data:
- Capabilities: Evolved from a closed-source Codex plugin, the standalone version is built for security teams. It supports bulk repository scanning, deduplication, false positive tracking, and CI/CD pipeline integration.
- Pre-commit Hook: Features an install-hook command to automatically scan changed files before git commit, blocking high-severity issues.
- Testing Results: During public testing, it scanned over 1.2 million commits, finding 792 critical and 10,561 high-severity vulnerabilities in projects like OpenSSH and Chromium.
- Benchmark: On 162,000 lines of production code, Codex Security achieved a 74% true positive rate, significantly outperforming Snyk (28%) and Semgrep (20%).
- Tech Stack: Uses the gpt-5.6-sol model for high-reasoning scans. Requires Node.js 22+ and Python 3.10+.
Related event: OpenAI Open-Sources Codex Security CLI for Code Vulnerability Scanning(7 posts)→
More from coding & agent
- Agensis, an agent workspace with persistent memory, joins DeepSeek's startup program — jasonkneen · 2026-07-29
- Dan Grover built a Stream Deck plugin for showing AI agents in Herdr — DanGrover · 2026-07-29
- Local lip-reading demo turns a mouthed prompt into Claude code — breath_mirror · 2026-07-29
- GitHub repo bundles battle-tested settings for Claude Code, Codex CLI and Cursor — tom_doerr · 2026-07-29
- A setup screen compares Codex, Claude, Copilot, Cursor, and Grok Build — draginol · 2026-07-29
- Beginner Asks How to Build a Local AI Project Manager for Creative Projects, Community Offers Advice — koreanalleyarcade · 2026-07-29