OpenAI Open-Sources Codex Security CLI for Code Vulnerability Detection

新智元 · wechat · 2026-07-30

OpenAI has quietly open-sourced Codex Security CLI, a code security command-line tool that quickly gained traction on GitHub.

Core Features: Positioned as an application security agent, it automatically discovers, validates, and fixes vulnerabilities. The workflow involves reading the repository to generate a threat model, contextually identifying and ranking vulnerabilities, and validating them in a sandbox to reduce false positives.
Track Record: In its first 30 days, it scanned over 1.2 million commits, identifying 792 critical vulnerabilities. Repeated scans reduced false positives by over 50%.
Cost Controversy: Because it defaults to the expensive gpt-5.6-sol model with extra-high reasoning effort, actual usage costs are steep. Developers reported that scanning a small project consumed half of their weekly Pro quota, while rate-limited failures cost around $13 per run.
Strategic Shift: This move is seen as OpenAI's small step toward the open-source community following Jensen Huang's public endorsement of open-source AI, though only the application layer is open while the model layer remains closed.

More from coding & agent