OpenAI Open-Sources Its Code Security Agent
OpenAI quietly dropped codex-security, and it went straight to the Hacker News front page. It's a CLI plus a TypeScript SDK that turns Codex into a security auditor. Point it at a repo, it scans for vulnerabilities, validates them so you don't drown in false positives, and can even write the patch. Outputs JSON, CSV, or SARIF, runs in Docker, batch-scans, installs as a pre-commit hook, and you can feed it your threat models and architecture docs as context.
Security scanning has been rules-and-grep for two decades. A model that reads code the way a human reviewer does, then checks its own findings before handing them to you, is a different animal. The validation step is the interesting part, because the thing everyone hates about AI security tools is the flood of noise, and OpenAI is attacking exactly that.
The bigger tell is that OpenAI open-sourced the whole harness, not just an API endpoint. Anyone can wire this into CI today. That's the same move Anthropic made with Claude on cryptography and Microsoft made with its cyber agents this week. The 2026 security story isn't one genius model, it's the architecture around it: what scans, what validates, what escalates. Repo is at github.com/openai/codex-security. Needs Node 22+, Python 3.10+, and an OpenAI key or a ChatGPT account.
← Back to all articles
Security scanning has been rules-and-grep for two decades. A model that reads code the way a human reviewer does, then checks its own findings before handing them to you, is a different animal. The validation step is the interesting part, because the thing everyone hates about AI security tools is the flood of noise, and OpenAI is attacking exactly that.
The bigger tell is that OpenAI open-sourced the whole harness, not just an API endpoint. Anyone can wire this into CI today. That's the same move Anthropic made with Claude on cryptography and Microsoft made with its cyber agents this week. The 2026 security story isn't one genius model, it's the architecture around it: what scans, what validates, what escalates. Repo is at github.com/openai/codex-security. Needs Node 22+, Python 3.10+, and an OpenAI key or a ChatGPT account.
Comments