arrow_back Back to AIFC
B
Brindha
Aug 02, 2026
pending Claude

OpenAI Open-Sources Codex Security: A CLI That Finds, Fixes, and Tracks Vulnerabilities

Grounded / Real Inflated / Uruttu
80% real
20% uruttu
article Original Content
OpenAI JUST open-sourced Codex Security CLI 🔥 It finds, validates, and fixes security vulnerabilities in your code: It's a CLI and TypeScript SDK under @𝗼𝗽𝗲𝗻𝗮𝗶/𝗰𝗼𝗱𝗲𝘅-𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆. Point it at a repo and it does four jobs: → Find: scans for security bugs, each rated by severity and confidence → Validate: separates real findings from noise, with evidence and location → Fix: suggests remediation and re-checks it on the next scan → Track: labels findings as new, persisting, reopened, or resolved across runs It runs three ways: local scans, a pre-commit hook that blocks high-severity bugs, and CI checks that fail the build past a severity threshold. It also reports its own coverage on every scan (complete, partial, or unknown) and lists what it skipped. And since it runs on a model, scans cost tokens, so there's a --𝗺𝗮𝘅-𝗰𝗼𝘀𝘁 flag to cap spend per run. Early beta. Needs Node 22+ and Python 3.10+. See what it can do: npx @openai/codex-security@latest --help Repo + npm + docs in the comments 👇 -- P.S. We’re building the best AI English tutor in the world. Try it to improve your speaking - it’s 15× cheaper than a human one → GetFluently.app
verified Validated Content

Confirmed accurate — this is a real, verified release:

  • OpenAI did open-source the Codex Security CLI and TypeScript SDK, published as @openai/codex-security on npm, in late July 2026 — confirmed via OpenAI's own X/Twitter announcement, the official GitHub repo (openai/codex-security), OpenAI's developer community forum, and multiple independent tech outlets.
  • It's licensed under Apache-2.0 (open source) — confirmed.
  • The exact install commands match: npm install @openai/codex-security and npx @openai/codex-security@latest --help are both directly confirmed by OpenAI's own posts.
  • The four core functions described (find, validate, fix, track) match OpenAI's own framing — the CLI scans for vulnerabilities, separates real findings from noise with evidence, suggests/verifies remediations, and labels findings as new/persisting/reopened/resolved across scans, per the GitHub README and OpenAI's community post.
  • System requirements — Node.js 22+ and Python 3.10+ — match exactly what's listed in OpenAI's official repo.
  • It runs on the same underlying scanner as OpenAI's existing Codex Security plugin, not a brand-new detection engine — confirmed by independent reporting.
  • The framing of this being an "early beta"/early release matches OpenAI's own characterization ("this is an early release, and we're listening to your feedback").

Not directly verified in what I found, but plausible given the tool's design:

  • The specific mechanics of the pre-commit hook blocking high-severity bugs and CI checks failing builds past a severity threshold are consistent with how the tool is described (CI integration, severity-based gating), but I didn't find a source spelling out those exact mechanics in that precise language.
  • The --max-cost flag to cap token spend per run — plausible given the tool explicitly runs on a paid model and needs cost controls, but I didn't find independent confirmation of that specific flag name.
  • The "complete, partial, or unknown" coverage reporting language — consistent with OpenAI's stated design (coverage data records reviewed areas, exclusions, and deferred work), though I couldn't confirm that exact three-way wording.

Unrelated add-on: The postscript promoting "GetFluently.app" as an AI English tutor "15× cheaper than a human one" is a separate, unverifiable marketing claim tacked onto the post — it has nothing to do with the Codex Security news and reads as a personal plug from whoever wrote the post.

Verdict: The core announcement is accurate and well-documented by OpenAI's own channels and independent tech press. A few granular implementation details (exact flag names, hook mechanics) are plausible but not independently confirmed from primary sources I could access.