Codex Security Open Source: OpenAI Frees CLI, Gates the Scanner

OpenAI has published the code for Codex Security, a command-line tool and TypeScript SDK that hunt for vulnerabilities in codebases, confirm what they find, and propose fixes. The "open source" framing deserves scrutiny, though. The public code is the wrapper. The scanning capability it connects to is still restricted to approved customers in a limited beta 1.

What actually shipped

The repository went live at github.com/openai/codex-security with little fanfare. By one account, the CLI appeared before OpenAI had formally announced it 1. The package is distributed on npm as @openai/codex-security. It is ESM-only, includes TypeScript declarations, and bundles the Codex runtime 2. It is still pre-1.0, and the maintainers warn that minor releases may change the public API 2. That caution matches an independent health review of the related @openai/codex-sdk. The review found no known vulnerabilities and pinned workflow actions, but it flagged inherited secrets, an archived action, and a release history dominated by prereleases 4.

The scanning logic itself is not new. It already existed as a plugin inside the Codex app 3. The new part is the operational tooling around it [3]:

• organization-wide scanning across many repositories
• historical result tracking
• deduplication across runs
• false-positive tracking
• CI integration

Results come back with a disposition of reportable, suppressed, not_applicable, or deferred. Each also carries a Markdown report and an evidence directory. A "deferred" result signals insufficient evidence 2.

An agent pipeline, not a pattern matcher

Codex Security is built as a multi-stage agent system rather than a classic static analysis (SAST) rule engine [5]:

1. Parallel discovery workers sweep different code paths.
2. Validation agents use LLM reasoning to weed out false positives.
3. Patch agents draft fixes.
4. Verification agents check whether the fixes hold 5.

The CLI needs both Node.js (22.13.0+ within 22.x, or 24.x/26.x) and Python 3.10+ 5. One writeup guesses the Python side runs established tools such as Semgrep or Bandit. That is speculation, not documented behavior 5.

The npm documentation adds a caveat. A "reportable" finding may rest on static analysis alone 2. The agentic validation layer is meant to raise confidence, but a reportable flag does not mean a human-grade proof of exploitability.

Who built it

The release also shows where some of OpenAI's security talent came from. A Promptfoo co-founder said in the Hacker News discussion that he is one of the people building Codex Security at OpenAI 3. Promptfoo is the open-source LLM evaluation framework. The thread reached the HN front page with 392 points and 122 comments. Commenters focused on cost, guardrails, and whether local models could be supported 3.

Reported traction varies. One outlet counted 2.1k stars and 114 forks shortly after release 3. Another cited more than 11,000 stars 5. The gap likely reflects when each snapshot was taken, but neither figure is independently confirmed here.

The pricing tell

The budget controls may reveal OpenAI's intent more than the license does. The CLI exposes a --max-cost flag 3. The SDK accepts a maxCostUsd option, with the documentation's own example capping a run at $5 2. Spending caps exist when a workload is metered. Here, every discovery worker, validation pass, and patch attempt consumes model inference. That points toward security scanning billed by consumption rather than by seat or by repository.

This is the core of the open-source asterisk. The free code lowers the barrier to adoption and wires the tool into the CI pipelines where developers already work. The value, and the billing, sit on OpenAI's side of the API boundary. Codex already reaches roughly five million weekly users 1. Putting security scans into those same terminals is a distribution play aimed squarely at Anthropic's Claude Security 1.

Our read

The opened code is useful and real, but it covers less than the label implies. The harness is open: the orchestration, result tracking, deduplication, and CI glue. It is arguably the more interesting engineering artifact, as one analysis notes 3. The engine remains gated 1, and generated patches still need human review before merging 1.

For AppSec teams, the practical questions are economic and operational:

• Cost: How predictable is per-run spending once scans run org-wide on every commit?
• Quality: How well do LLM-validated findings compare with established SAST output?
• Stability: How much will the pre-1.0 API shift underneath integrations?

OpenAI has made it easy to try Codex Security. It has not made the tool independent of OpenAI. Calling it "open source" mostly describes how it is distributed, while the scanner itself stays a proprietary, metered service.