OpenAI's Open Source Security Tool Meets AI-Era npm Threat

The open source ecosystem spent this summer being attacked and defended by artificial intelligence at the same time, and the three stories that dominated security coverage make more sense read together than apart. OpenAI published its Codex Security CLI under an open source license, effectively handing the community an AI-driven vulnerability scanner it can inspect, fork, and wire into CI pipelines. Days later, Amazon publicly attributed four of the most damaging npm supply chain compromises on record to a single North Korean operation that had spent more than a year refining its tradecraft against volunteer maintainers. And Anthropic's restricted Mythos model demonstrated that AI can now make real inroads against the cryptographic foundations that open source software runs on. The through-line is uncomfortable but clear: the same force — capable AI models — is now operating on both sides of the open source security equation, and the humans maintaining the software supply chain are caught in the middle.

OpenAI open-sources its security scanner

In late July, OpenAI released the Codex Security CLI and TypeScript SDK as a public, Apache 2.0-licensed package, installable with a single npm command and already sitting in a repository with roughly 11,000 stars and 846 forks1920. The tool scans repositories, selected paths, or Git changes for vulnerabilities, validates candidate findings, generates and verifies patches, drafts security policies, exports SARIF for CI integration, and maintains a workbench of scan history with false-positive feedback for subsequent runs19. According to the community announcement, the CLI runs the same scanner as the interactive Codex plugin, packaged so security and engineering teams can repeat scans from a terminal with fixed scope, severity policies, and machine-readable output1420.

The move completes a rapid evolution. What began in October 2025 as Aardvark, a private-beta agentic security researcher that used LLM reasoning rather than traditional fuzzing to read code like a human auditor, was folded into Codex in March 2026 as Codex Security, then scaled into a broader "Daybreak" effort that includes the Patch the Planet initiative with Trail of Bits and HackerOne131611. The stakes the tool addresses are not hypothetical: OpenAI says the system has scanned more than 30 million commits across over 30,000 codebases, and that findings from early open source work earned actual CVE identifiers, including a string of GnuTLS, GOGS, and GnuPG bugs catalogued in its research preview1116.

The genuinely open-source part of the story deserves scrutiny, though. The package boundary is open — teams can audit the client code, pin commits, and override the bundled plugin — but the model boundary is not. Live scans authenticate through ChatGPT or an OpenAI API key, meaning inference remains a hosted service, and some full-repository scans may require enrollment in OpenAI's Trusted Access for Cyber program20. This is open source orchestration around a proprietary brain, a model that will shape how much the community can actually trust and extend it.

The maintainer-focused framing, however, is the part that matters most right now. OpenAI says its conversations with maintainers surfaced a consistent complaint: not a shortage of vulnerability reports, but a flood of low-quality ones. Its response, including the Codex for OSS program that gives eligible maintainers free accounts, code review, and security scanning, is explicitly aimed at cutting triage burden rather than generating more speculative findings1612. That diagnosis aligns precisely with the attack pattern Amazon just documented.

Amazon ties four npm attacks to one North Korean crew

Amazon Threat Intelligence published findings in late July attributing, with medium confidence, the compromises of the typo-crypto, debug, chalk, and axios npm packages to a single DPRK-linked threat actor tracked variously as Sapphire Sleet, Stardust Chollima, BlueNoroff, CageyChameleon, and Alluring Pisces2122. The axios incident, affecting a library with over 100 million weekly downloads, had already been publicly attributed to the group; Amazon's new contribution was connecting the earlier typo-crypto, debug, and chalk incidents to the same hand2123.

The operational arc is a case study in how nation-state actors now treat open source maintainers as the softest entry point. In March 2025 the actor trojanized typo-crypto with a file masquerading as the legitimate core-js package — an operation Amazon now views as a testing ground given its low download volume, tracked in the Open Source Vulnerabilities database as MAL-2026-34002125. By September 2025 the group had escalated to debug and chalk, an event Wiz Research found touched roughly one in ten cloud environments within two hours, and by March 2026 it had hit axios2123. In each case, the group socially engineered a trusted maintainer, obtained publishing credentials, and pushed malicious updates through the channels developers already trusted, rather than exploiting zero-days or attacking npm's infrastructure itself2130. ComputerWeekly quotes Amazon CISO CJ Moses calling it "one hand on the keyboard behind four different supply chain attacks," and — the line that should sit with every maintainer — noting that adversaries are not breaking open source systems but "using them as designed, just for a different purpose"29.

The tradecraft Amazon describes is built to defeat exactly the kind of automated review that defenders are rushing to deploy. The group fragments a single malicious workflow across several individually benign packages, decouples malicious behavior from package contents by housing it in remotely fetched scripts and endpoints, uses real cryptography — AES-GCM encrypted blobs with runtime-fetched keys, per-call-keyed string arrays, native loaders — rather than cheap obfuscation, and builds payloads smart enough to stay dormant in sandboxed analysis environments2322. Amazon also flags slopsquatting, in which attackers register package names that AI coding assistants hallucinate, and warns that hidden prompt injection in READMEs and comments is being explored to trick AI-based code reviewers into approving malicious packages2528.

Attribution has caveats worth noting. AWS holds its call at medium confidence, based on shared C2 infrastructure and tactics, and the industry's naming maps do not fully converge — ESET placed the axios compromise under the broader Lazarus umbrella, while Google and Microsoft track it as Sapphire Sleet or UNC10692330. That divergence does not undermine the core finding of shared infrastructure and reusable tradecraft, but it is a reminder that these are vendor assessments, not government verdicts.

Mythos cracks crypto's foundations

The third story explains why the defenders' side of this race is accelerating. Anthropic's Claude Mythos Preview, a model the company deemed too dangerous for general release and confined to trusted access, was recently pointed at cryptography itself — and produced results that ended a post-quantum candidate's candidacy. With roughly 60 hours of work and about $100,000 of compute, prompted by a researcher with no cryptography expertise, Mythos improved the best-known attack against HAWK, a lattice-based digital signature scheme that had survived two NIST evaluation rounds, effectively halving its key strength by finding a novel method for locating automorphism symmetries in the Lattice Isomorphism Problem3. The developer withdrew HAWK the next day; Google's Sophie Schmieg's verdict was blunt: "with this paper, HAWK is dead"3.

The second result, an improved meet-in-the-middle attack against weakened, seven-round AES instances using a technique Anthropic calls a Möbius Bridge, could reduce attack time by 200- to 800-fold — though the reduction applies to challenge instances rather than specification-compliant AES, and the underlying primitives remain safe for now3. Johns Hopkins cryptographer Matthew Green's observation cuts to the heart of why this matters: the attack "does not invent fundamentally new mathematics" but assembles well-known tools nobody had thought to combine — precisely the kind of combinatorial reasoning where large models excel3.

For the crypto industry, the implications were already reverberating from Mythos's earlier disclosure of thousands of zero-day vulnerabilities, including in cryptography libraries like TLS, AES-GCM, and SSH that DeFi infrastructure depends on26. Coinbase and Binance reportedly approached Anthropic to test the model against their own systems, and analysts noted that the access-control failures and supply chain attacks responsible for the majority of 2025's $3.3 billion in crypto losses map directly onto the multi-step attack chains Mythos can autonomously execute96.

Why these stories are one story

Read separately, these are three news items. Read together, they describe a closed loop. State-linked attackers are using generative AI to fabricate maintainer personas, draft convincing code, and obfuscate payloads so well that static analysis fails — and they are doing it against open source maintainers who, as Amazon itself frames it, are the supply chain's most time-starved and over-trusted nodes2428. OpenAI's answer — an Apache-licensed CLI, free maintainer access, and a Patch the Planet initiative that has drawn commitments from cURL, Go, Python, Sigstore, and pyca/cryptography — is a genuine and welcome transfer of frontier defensive capability into the open1112. AWS is simultaneously funding the Akrites initiative with $12.5 million and coordinating with OpenSSF to harden the registries themselves2528.

The honest reading is that open-sourcing the tooling is necessary but not sufficient. The Codex Security CLI's orchestration is inspectable; the model that powers it is not, and its cost structure and access controls make sustained, community-wide adoption an open question20. Meanwhile the offensive side needs no permission slip — the same capabilities are emerging in models that anyone can run. The most durable lesson from this stretch of coverage is that open source security has stopped being a technical problem and become a trust problem: whoever can most credibly scale expert attention — attacker or defender — wins. Right now, defenders are finally shipping their tools. Whether they arrive before the next axios is the open question, and it is not guaranteed to resolve in their favor.