OpenAI Open-Sourced Its Security Scanner
Canonical version: OpenAI Open-Sourced Its Security Scanner.
Last week OpenAI pushed a repository called Codex Security to GitHub. No announcement, no blog post, no tweet. Hacker News found it anyway and sent it to 560 points before OpenAI said a word.
When they finally did post, five days later, they opened with this:
We quietly released the open-source Codex Security CLI, but Hacker News found it before we had a chance to share it here...
I like that they said it out loud. It also explains a lot about how the week went.
What it actually is
Codex Security is a CLI and TypeScript SDK, Apache-2.0, that scans your code for vulnerabilities using GPT-5.6 Sol. It scans whole organizations, keeps findings between runs, deduplicates, tracks false positives, verifies that your fix actually closed the hole, and plugs into CI.
The part worth your attention: the security skills are open-sourced. Thirteen of them, guiding how the model looks for each vulnerability class. Someone in the thread pointed out that those prompts represent billions of tokens of optimization work, now sitting in a public repo. Whatever happens to the tool, that library is a real contribution.
And this is not a new product. It shipped internally as Aardvark back in March 2026, as a research preview for ChatGPT Enterprise, Business and Edu customers. By April, OpenAI reported it had helped fix more than 3,000 critical vulnerabilities. So the underlying system works. What is new is the open client.
The catch nobody put in the headlines
Every article I read framed this as "OpenAI open-sources its security scanner." That is half the story.
The client is open source. The capability is not. Apache-2.0 covers the CLI, the SDK and the skills. Running an actual scan needs Codex Security service access, which is still a permissioned beta. You can read every prompt and run nothing.
I understand the reasoning for a tool that finds exploitable bugs at scale. It is just not what people heard.
Two problems that hurt
It burns money. The reports in the thread are not marginal. One person watched 25% of their weekly Pro credits go into a 42-minute scan that never finished. Another described using five years of Pro usage in five minutes. A third spent over $100 with --max-cost set, and the limit was exceeded anyway. Scans run silently with no progress output, and a failed scan does not resume, so you pay again from zero.
A budget cap that does not actually cap the budget is worse than no cap at all, because it invites you to walk away from the terminal.
It refuses to explain what it finds. This one is stranger. The tool locates a vulnerability, then the model's own safety guardrails block it from describing what the vulnerability is. To get fewer refusals you apply to a program called Trusted Access for Cyber. One maintainer said they applied twice and heard nothing back.
Sit with that for a second. A security scanner, whose entire job is explaining vulnerabilities, running on a model trained not to explain vulnerabilities. The workaround is an access allowlist rather than a technical fix.
That is the alignment tax made concrete, and I don't think it is a Codex problem specifically. It is what happens when you build a defensive tool on a general model that cannot tell your intent from an attacker's.
Anthropic shipped one too, six days earlier
Here's what makes this interesting rather than just a rough launch. On 22 July, Anthropic released the Claude Security plugin for Claude Code (see Claude Code Security Review). Same problem, opposite bets:
- OpenAI built the org-scale tool, open-sourced the prompts, and gated the service
- Anthropic built the developer-loop tool, kept it closed, and ran it on inference you already pay for
The shape difference matters more than the licensing. Codex Security scans repositories periodically. The Claude plugin scans at commit time, before anything lands. Pre-commit is the cheapest possible moment to fix something, and moving checks earlier is the same argument I keep coming back to in Loop Engineering: your leverage is upstream, not at review time.
Right now the org-scale one is the one people cannot afford to run.
What I'd do
If you want to try Codex Security, point it at one small repository with a hard spend limit set outside the tool. Not at your organization. Not overnight.
And read the skills regardless. Even if you never run a scan, thirteen well-tuned prompt libraries for vulnerability classes are worth an hour of your time. Tools get replaced. Good prompts get reused.
I'd also hold the criticism a little loosely. This was an unannounced early build that its own vendor had not finished documenting, and OpenAI's response ("this is an early release, and we're listening") is the right one. Budget enforcement and resumable scans are exactly the kind of thing that gets fixed fast once a team knows people are watching.
The refusals are the harder problem. That one is a policy decision, not a bug.
That's it for today! ✨
References
- Codex Security repository: https://github.com/openai/codex-security
- Hacker News discussion: https://news.ycombinator.com/item?id=49089755
- OpenAI's acknowledgement: https://x.com/OpenAI/status/2082263717916586117
- The Decoder, on the Aardvark history: https://the-decoder.com/openai-open-sources-codex-security-cli-to-help-developers-find-and-fix-vulnerabilities-from-the-command-line/
Related
About Sébastien
Ready to get to the next level?
Found this valuable? Share it with someone who needs it.