OpenAI Open-Sources Codex Security CLI and SDK

OpenAI has released Codex Security as open-source software, publishing both a command-line interface and TypeScript SDK that let development teams scan repositories, track findings over time, and integrate AI-powered vulnerability detection into existing CI/CD pipelines.

The release, now available on GitHub under the openai/codex-security repository, requires Node.js 22 or later and Python 3.10 or later. Codex Security exists as both a plugin that runs within Codex chat and a standalone CLI/SDK; the open-source release makes the standalone tooling publicly available for running security assessments across many repositories over time.

What the Tool Does

Codex Security is designed for finding, validating, and reviewing security issues in code that teams own or have permission to assess. The tooling supports organization-wide scans, historical result tracking, deduplication of findings, false-positive tracking, budget controls, and CI integration for enterprise deployments.

The open-source release enables security teams to build custom white-hat security agents and integrate AI-driven vulnerability detection more deeply into their infrastructure. Developers can also swap models, a flexibility not available in the closed plugin version.

Beta Results

During beta testing, the Codex Security AI agent scanned 1.2 million commits across open-source projects. The scan identified 792 critical-severity vulnerabilities and 10,561 high-severity issues, according to OpenAI's official announcement.

Competitive Landscape

The move puts pressure on traditional security scanning companies by providing an AI-native alternative that can be customized by the community. By open-sourcing the SDK and CLI rather than keeping them proprietary, OpenAI is positioning Codex Security as infrastructure that security teams can extend rather than a black-box service. The npm package @openai/codex-security is now available for installation alongside the GitHub repository.