OpenAI has made its Codex Security CLI available as an open-source project under the Apache-2.0 license. The release gives developers access to an AI-powered tool for finding, validating, and addressing security vulnerabilities in codebases.

Available as the npm package @openai/codex-security, the project includes both a command-line interface and a TypeScript SDK. It is designed for teams that need more than a one-time code review: developers can scan repositories, review pull-request changes, retain findings between runs, confirm whether fixes work, and add security checks to CI/CD workflows.

How Codex Security Scans Codebases

Codex Security uses AI models to examine code with context, rather than depending only on conventional pattern-matching approaches. That matters when a potential weakness depends on how code behaves across files, changes, or parts of a larger repository.

The CLI supports several practical security-review workflows:

  • Scan an entire repository for vulnerabilities
  • Review code changes in pull-request diffs
  • Keep track of findings across repeated scans
  • Verify whether a reported issue has been fixed
  • Add automated security checks to CI/CD pipelines

The project was released quietly before users on Hacker News identified its GitHub repository. OpenAI later confirmed that the tool could be used to scan repositories, maintain findings between runs, validate fixes, and add security checks to CI/CD processes.

Codex Security CLI Requirements and Access

Developers need Node.js 22 or later and Python 3.10 or later to install and use Codex Security.

Basic use does not require a ChatGPT Plus subscription. However, an OpenAI API key provides access to full scanning capabilities and is recommended for automated environments. That distinction makes the open-source CLI available for developers to explore while giving teams an option to use the broader scanning features needed in ongoing security workflows.

From Research Preview to Open-Source Security Tool

Codex Security began as a research preview in March 2026. It was introduced as an AI agent for automating security reviews of code.

The tool is built on OpenAI’s lightweight Codex coding agent, but it has a different job than the Codex plugin. The plugin is aimed at reviewing a single active repository. Codex Security’s standalone CLI and SDK are built for longer-running security operations across multiple repositories.

That broader focus includes capabilities for:

  • Organization-wide scans
  • Historical security results
  • Deduplication of findings
  • False-positive tracking
  • Budget management

This makes Codex Security better suited to organizations that need to keep security review work moving over time, rather than treating each scan as a separate task with no retained history.

Codex Security for Multi-Repository Security Management

A security finding rarely exists in isolation. Teams often need to know whether the same issue appeared before, whether it has already been addressed elsewhere, and whether a fix actually resolved the problem. Codex Security is designed around that ongoing work.

By tracking results across runs, the tool can support a more persistent view of code security. Deduplication and false-positive tracking are also part of that approach, helping organizations manage findings instead of simply collecting more alerts.

The ability to review pull-request diffs adds another layer. Rather than waiting for an entire repository scan, developers can assess security concerns around code changes as they move through the development process. When paired with CI/CD checks, this gives teams a way to bring AI-assisted security review into their existing delivery flow.

OpenAI Support for Open-Source Maintainers

The Codex Security release fits into OpenAI’s wider Codex for Open Source program. The program provides eligible open-source maintainers with six months of ChatGPT Pro access, conditional access to Codex Security, and API credits for maintainer workflows.

OpenAI has also expanded its Daybreak cybersecurity initiative with Patch the Planet. This program pairs Codex Security with the security firm Trail of Bits to work directly with maintainers of open-source projects on discovering and remediating vulnerabilities.

The project had accumulated roughly 1,500 GitHub stars at the time of the announcement, pointing to early interest from developers in AI-assisted security tooling as code generation continues to accelerate.