OpenAI Open-Sources Codex Security CLI to Find and Fix Vulnerabilities

Key Takeaways

• OpenAI has released Codex Security, an open-source command-line interface (CLI) and TypeScript SDK.
• The tool leverages AI to identify, validate, and propose fixes for security vulnerabilities in codebases.
• It integrates into development workflows, supporting repository scans, pull request reviews, and CI/CD pipeline checks.
• Codex Security operates under the Apache-2.0 license and requires Node.js 22+, Python 3.10+, and access to Codex Security (via a ChatGPT session or OpenAI API key).

OpenAI has officially launched Codex Security, an open-source command-line interface (CLI) and accompanying TypeScript SDK, designed to empower developers in the proactive identification, validation, and remediation of security flaws within their code. This strategic move aims to embed AI-driven security analysis directly into daily development cycles, enabling teams to perform repository scans, review pull requests, and integrate automated security checks into their continuous integration and continuous delivery (CI/CD) pipelines.

Built upon the foundation of the lightweight Codex coding agent, Codex Security initially debuted as a research preview in March 2026. It is now publicly accessible under the Apache-2.0 license and has already garnered significant attention, accumulating approximately 1.5k stars on GitHub since its release.

AI-Powered Vulnerability Detection

Distributed as the npm package @openai/codex-security, the tool distinguishes itself by employing advanced AI models for contextual code analysis. Unlike traditional security tools that often rely on static pattern matching, Codex Security evaluates code behavior within its operational context. This sophisticated approach allows it to uncover more relevant findings and suggest targeted patches that developers can then scrutinize and implement.

Initial feedback from developers on platforms like Hacker News and X has underscored the tool’s potential, particularly as AI-assisted code generation gains momentum. Security teams are increasingly challenged to keep pace with the rapid influx of new code, making solutions like Codex Security vital. While some authentication issues were reported immediately after launch, OpenAI swiftly addressed these, reinforcing confidence in the project’s early progress.

Getting Started with Codex Security

The setup process for Codex Security is designed to be straightforward. Users require Node.js version 22 or newer, Python 3.10 or newer, and access to the Codex Security service. Installation is a simple npm command: npm install @openai/codex-security.

Following installation, users can authenticate by running npx codex-security login and initiate a scan with npx codex-security scan. Notably, basic usage of the tool does not necessitate a ChatGPT Plus subscription.

For comprehensive scanning capabilities and optimal integration into automated environments, an OpenAI API key is recommended. In CI pipelines, teams can simply define the OPENAI_API_KEY environment variable, bypassing the need for interactive sign-in procedures.

When both a ChatGPT session and an API key are configured, interactive scans will prompt the user to select their preferred credential. However, non-interactive operations will default to using the API key. Developers also have the option to enforce a specific authentication method using flags such as --auth chatgpt or --auth api-key. To make ChatGPT the default authentication method, any configured API keys can be unset.

Scan history is maintained within the Codex Security workbench state directory. Should this location lack write permissions, the CODEX_SECURITY_STATE_DIR environment variable can be configured to point to an alternative, writable directory outside of the repository.

Programmatic Control and Workflow Integration

For development teams seeking programmatic control, OpenAI also provides a TypeScript SDK. This allows for the creation of concise scripts to instantiate the CodexSecurity client, execute scans against the current working directory, log the path to the generated report, and ensure a clean client shutdown.

The practical benefit for security engineers and development teams lies in the creation of tighter feedback loops. Instead of relying on infrequent manual code reviews or time-consuming static analysis tools, Codex Security can analyze code changes as they are committed, track vulnerability findings over time, and propose contextually relevant fixes. This integration of repository scanning, pull request review, and pipeline security positions Codex Security as a valuable asset for modern application security programs, particularly as organizations increasingly adopt AI coding assistants.

As the research preview evolves into a mature product, widespread adoption and community input are expected to play a crucial role in shaping how AI-assisted vulnerability discovery becomes a standard component of secure software delivery practices.

What You Should Do

• If you are a developer, integrate Codex Security into your development workflow to proactively identify and address vulnerabilities.
• For automated environments, configure an OpenAI API key for full scanning capabilities and seamless CI/CD integration.
• Regularly review the findings and suggested patches from Codex Security, leveraging its AI-driven insights to improve code security.
• Stay updated with future releases and community feedback to optimize your use of this evolving tool.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.