Codex Security Open Source: OpenAI Opens the CLI, Not the Engine

What OpenAI actually released

OpenAI has published the command-line client for Codex Security, its AI vulnerability scanner, under the Apache 2.0 licence. It ships as the @openai/codex-security package on npm 3. Reports put the release date at 29 July 2026 3. Repository data suggests a slightly longer runway: the GitHub repo was created on July 13 and first published to npm on July 28 2. By late August the project had roughly 10,000 stars, 718 forks, and 17 releases in under four weeks, reaching version 0.1.16 2. Another account cites more than 11,000 stars 5. The figures differ, but they point the same way: developers have shown strong interest very quickly.

The release seems to have arrived quietly. The code appeared publicly before OpenAI had formally announced it 4. The tool has a longer history than its version number suggests. It began as an internal project codenamed Aardvark, became a research preview in March 2026, and then ran as an invitation-only beta. During that beta, OpenAI says it found and helped fix more than 3,000 critical vulnerabilities in customer codebases 3.

How it works

Codex Security is not a pattern-matching static analyser. It uses a model to read a repository the way a human reviewer might. It traces data flow across files, considers what the application is meant to do, and asks whether a suspicious code path can actually be reached by an attacker 2. The CLI organises this into stages: a scan phase for discovery, which can split work across parallel workers, followed by validation that re-checks each candidate finding 2. One technical breakdown describes the full pipeline as discovery, validation, patch generation, and verification. Separate agents handle each step, so the tool can filter false positives and confirm that its own fixes work 5.

The CLI needs both Node.js (22.13.0+ within the 22.x line, or 24.x/26.x) and Python 3.10+ 5. One writer guesses that the Python side may wrap existing security tools such as Semgrep or Bandit 5. That is speculation, not documented fact.

The CLI also exists alongside a hosted product. OpenAI runs a SaaS version at chatgpt.com/codex/security. It connects to GitHub repositories, builds a threat model for each codebase, attempts exploits in a sandbox to confirm findings, and opens fixes as pull requests for human review 1. That hosted scanner is distinct from the openai/codex-action GitHub Action, which serves the general coding agent 1. Teams evaluating the tool should not confuse the two.

The asterisk on "open source"

The central caveat is that the public code covers the CLI and its prompt definitions. The scanning engine still runs on proprietary OpenAI models that require approved API access 3. The Next Web put it bluntly: the wrapper is open, but the part that actually hunts for bugs stays gated to approved customers 4.

This matters because the value of an AI security tool lies in the model's judgment, not in the code that orchestrates it. Developers can read, fork, and audit how Codex Security calls the model, structures findings, and plugs into CI. They cannot run the engine on their own hardware, swap in their own model, or use it without OpenAI's permission. Apache 2.0 makes the harness free. It does nothing to make the core capability portable.

That is not inherently cynical. Publishing the orchestration layer lets security teams inspect what the tool does with their code, which counts for something in a field built on trust. But "open source" here describes the packaging more than the product.

The competitive angle

The timing and distribution strategy suggest a race for market share. Placing security scanning in the terminal puts it in front of Codex's roughly five million weekly users. The move is widely read as a direct challenge to Anthropic's Claude Security 4. An npm package that drops into existing pipelines is a low-friction way to become the default before a rival does.

Our read

Codex Security looks like a serious tool. A beta record of thousands of critical fixes 3 and a validation-first design 25 address the main complaint about older scanners, which is a flood of noisy alerts. Still, it should be understood as an open client for a closed service. For teams that already depend on OpenAI's API, that distinction may not matter much. For anyone who wants an AI security engine they can control or self-host, this release does not provide one. Codex Security's open-source status is real, but limited, and it mainly helps OpenAI extend its reach into the AppSec market.