OpenAI Open-Sources CodexSecurity: Testing AI Coding's Security Guardrails
数字生命卡兹克 · wechat · 2026-08-06
As Vibe Coding lowers the barriers to app development, security vulnerabilities in AI-generated products are often overlooked. OpenAI recently open-sourced Codex Security, an auditing tool originally built into Codex. It can now be integrated into third-party agents like Claude Code and supports non-OpenAI models via OpenRouter.
The author tested the tool's scanning capabilities on a real internal project:
- Cost & Results: Scanning 214 files with gpt-5.6-sol (xhigh reasoning) took about an hour and consumed $55 in credits. It identified 21 issues: 1 high-risk (SSO bypassing whitelist due to auth failure), 11 medium-risk (e.g., CSV injection, strict API rate-limiting), and 9 low-risk.
- Model Choices: High-end models are thorough but expensive. Alternatives like Kimi K3 or Qwen 3.8-Max are viable, while DeepSeek V4 Flash offers the best cost-effectiveness for routine checks. Because agent-based reasoning has inherent randomness, cross-scanning with two models before major releases is recommended.
- Limitations: The tool focuses on code-level vulnerabilities and cannot prevent infrastructure-layer attacks like DDoS, which still require CDN, WAF, and rate-limiting strategies.
Related event: OpenAI Introduces Codex Security Review for GitHub PRs(4 posts)→
More from coding & agent
- Dev builds MCP layer so Claude Code can work on servers without ever holding SSH keys — NETMESAFE · 2026-10-16
- 'Refusing to code with AI in 2026 is like refusing Google in 2005' — prasenx · 2026-10-16
- Claude Code adds idle compaction to save 1h prompt cache on idle sessions — EricBuess · 2026-10-16
- Handling agents that crash mid-task: the hard part is the unknown outcome across the network — Responsible-Dare5139 · 2026-10-16
- OpenAI DevDay Community Hackathon heads to Berlin with developer, founder and GTM tracks — paw_lean · 2026-10-16
- Data scientist career path is shifting: ML skills no longer enough, AI engineering is the new bar — mdancho84 · 2026-10-16