Codex Security Scan Costs: Tiny Repo, $6 Bill, No Price Guide

OpenAI's new Codex Security tooling makes a strong pitch. It does more than flag suspicious code. It tries to confirm that a vulnerability is real and then drafts the fix. The obvious follow-up question is what a scan costs, and so far OpenAI has not given a clear answer. Early hands-on testing suggests the bill can be larger than the size of a codebase would lead anyone to expect.

What OpenAI shipped

Codex Security comes in more than one form. The cloud version, Codex Security Cloud, launched on September 29, 2026 as a research preview on web and desktop. It is a plugin that scans connected GitHub repositories inside Codex cloud, checks likely vulnerabilities, and presents findings with evidence and remediation guidance 2. It supports one-off repository scans and ongoing commit monitoring that watches new code as it lands 2. It also attempts to reproduce flaws in a sandbox and can open pull requests with proposed fixes 1.

There is also a command-line tool. One write-up describes it as an open-source TypeScript project that has already passed 11,000 GitHub stars 4. Its design is a pipeline of cooperating agents:

• Discovery workers run in parallel across different code paths.
• Validation agents use LLM reasoning to weed out false positives.
• Patch agents write fixes.
• Verification agents confirm those fixes work 4.

The CLI needs both Node.js and Python 3.10 or later 4. That source guesses the Python side wraps established scanners such as Semgrep or Bandit, but it presents this as a guess, not documented fact 4.

This is a different approach from conventional static analysis, which matches patterns and produces long lists of alerts. Codex Security spends compute reasoning about whether each issue is real, and that reasoning is where the cost comes from.

The pricing gap

Accounts of how scans are billed differ in emphasis. One analysis says Security Cloud has no separate price and no separate meter. Because it runs in Codex cloud, it draws from the same usage allowance as a subscriber's other Codex work 2. Another focuses on the token rate card. OpenAI's Codex pricing page lists Daybreak Blue, the defensive security model, at:

• 100 credits per million input tokens
• 10 credits per million cached input tokens
• 500 credits per million output tokens 1

The two accounts fit together. Scans consume tokens, and those tokens are deducted from a shared pool of credits or plan usage. The problem is what neither account can supply. The pricing page gives no dollar value for a credit and no estimate of how many tokens a scan of a given repository will use 1. Cost depends on repository size, how often you commit, how many findings the agent tries to reproduce, and how many fixes it drafts. None of that can be predicted before running it 1. The setup documentation also does not say which languages are covered or how long submitted code is retained 1.

A nine-line test case

One tester tried to measure the cost directly. They ran the CLI against a repository with a single file containing nine lines of Express code 3. After about eight and a half minutes, the scan stopped at a $6.00 spending cap. By then it had consumed 7.0 million input tokens and produced a 1,605-word threat model, with zero findings 3.

The tester's conclusion is that scan cost follows the agent's reasoning loop, not the line count. Their advice is to set the --max-cost flag before configuring anything else 3.

The test also exposed a quirk in the CLI's cost display. It always calculates its running total at OpenAI's list prices for GPT-5.6 Sol, whatever endpoint the traffic actually goes to 3. That figure is a token-count estimate, not an invoice. A run the CLI reported as $6.03 would cost roughly $3 on an endpoint priced at half of list, while the CLI would still show $6.03 3. Teams comparing the CLI's numbers against real bills should not treat them as the same thing.

How to read this

The agentic design that makes Codex Security interesting is also what makes its costs hard to predict. A pattern-matching scanner's cost grows roughly with the amount of code. An agent that builds threat models, chases hypotheses, and verifies patches spends tokens according to how much it decides to investigate. A tiny repository can still trigger a lot of reasoning.

One CLI run on one trivial repository is not a benchmark. A real application might cost proportionally less per line, or much more. Even so, the result is a useful warning, because OpenAI's own materials give buyers nothing to set expectations against.

Until OpenAI publishes per-scan guidance, sensible practice looks like this:

• Pilot the tool with a hard spending cap.
• Run it alongside existing SAST tools rather than replacing them 1.
• Track consumption against the plan's shared Codex allowance 2.

The technology may well earn its cost by cutting false positives and producing working patches. For now, buyers have to find out the price by running it.