FULL STORY

OpenAI Open-Sources Codex Security Tools and Launches Preview

OpenAI open-sourced the Codex Security CLI in late July, followed by the research preview launch of Codex Security Review for GitHub PRs in early August.

2026-07-29 ~ 2026-08-08 · 2 episodes · 15 posts

Episode 1 · OpenAI Open-Sources Codex Security CLI for AI-Powered Vulnerability Scanning and Fixing (2026-07-29, 11 posts)

On July 29, OpenAI open-sourced Codex Security CLI and TypeScript SDK under Apache-2.0, now available on GitHub. The tool evolved from a closed-source security plugin within Codex, using AI to automatically scan code vulnerabilities, verify fixes, and generate patches, with CI/CD integration. According to @dotey's hands-on test, its true positive rate far exceeds Snyk and Semgrep, though no official benchmark has been released. OpenAI core executive @gdb confirmed ongoing work on local OpenAI-compatible API support, noting the product is rapidly evolving.

Confirmed

  • Open Source & Core Features: The tool acts as an application security agent with a three-step workflow: reading repositories to generate threat models, verifying suspected vulnerabilities, and auto-generating fix patches. It supports deep security scanning, code change review, historical vulnerability tracking, and CI integration.
  • Usage Scenarios: Per @dotey and @haltakov, the tool offers a plugin version for direct use in Codex and a standalone CLI for automation workflows.
  • Local Support: @gdb stated the team is working on local OpenAI-compatible API support, and the product is still evolving rapidly.

Unconfirmed

  • Performance Comparison: @dotey reported that the tool's true positive rate "far exceeds" Snyk and Semgrep. This claim is based on personal testing; no standardized third-party benchmark has been provided by OpenAI.

Why It Matters

  • By combining vulnerability scanning with AI-driven auto-fixing and releasing it fully open-source, OpenAI significantly lowers the barrier for developers to integrate advanced code security. If the high accuracy observed in testing generalizes, it could reshape the code security audit landscape.

Episode 2 · OpenAI Introduces Codex Security Review for GitHub PRs (2026-08-06, 4 posts)

OpenAI has launched a research preview of Codex Security Review, a tool that automatically detects vulnerabilities in GitHub Pull Requests. Open-source and context-aware, it aims to secure AI-assisted coding projects by analyzing code diffs directly.