OpenAI Open-Sources CodexSecurity: Testing AI Coding's Security Guardrails
数字生命卡兹克 · wechat · 2026-08-06
As Vibe Coding lowers the barriers to app development, security vulnerabilities in AI-generated products are often overlooked. OpenAI recently open-sourced Codex Security, an auditing tool originally built into Codex. It can now be integrated into third-party agents like Claude Code and supports non-OpenAI models via OpenRouter.
The author tested the tool's scanning capabilities on a real internal project:
- Cost & Results: Scanning 214 files with gpt-5.6-sol (xhigh reasoning) took about an hour and consumed $55 in credits. It identified 21 issues: 1 high-risk (SSO bypassing whitelist due to auth failure), 11 medium-risk (e.g., CSV injection, strict API rate-limiting), and 9 low-risk.
- Model Choices: High-end models are thorough but expensive. Alternatives like Kimi K3 or Qwen 3.8-Max are viable, while DeepSeek V4 Flash offers the best cost-effectiveness for routine checks. Because agent-based reasoning has inherent randomness, cross-scanning with two models before major releases is recommended.
- Limitations: The tool focuses on code-level vulnerabilities and cannot prevent infrastructure-layer attacks like DDoS, which still require CDN, WAF, and rate-limiting strategies.
More from coding & agent
- Grok Agent Update: Background Tasks, Session Reattach and UI Improvements — elonmusk · 2026-08-06
- AI-generated SIMD drop-ins for Go stdlib cover 21 repos, 6 architectures — lemire · 2026-08-06
- One-Shot Prompt: AI Runs for 9 Hours to Build a AAA Racing Game — sharkymcstevenson2 · 2026-08-06
- GitHub Copilot CLI Update: Adds Concurrent Sessions Management — copilot-cli-release-app[bot] · 2026-08-06
- Codex Autonomously Scrapes Data, Installs Blender to 3D Model House — john__allard · 2026-08-06
- Gemini CLI Preview: Introduces PR Generator and State Machine Fixes — gemini-cli-robot · 2026-08-06