Codex Security 0.10.0: the security agent learns to say why it couldn't fix it
OpenAI's open-source security agent was the number two repo on GitHub Trending on Thursday, picking up about 663 stars in a day on the back of a release that landed at 02:18 UTC. Codex Security (https://github.com/openai/codex-security, Apache 2.0, about 12,300 stars) scans a codebase, proposes patches and tries to verify them. Version 0.10.0 doesn't add a smarter model. It adds the boring parts that decide whether you can run it at scale. Release notes: https://github.com/openai/codex-security/releases/tag/npm-v0.10.0
Three changes stand out. Interrupted Standard scans can now pick up from a checkpoint with codex-security scans resume, keeping the usage and budget already spent. A new --max-total-cost flag shares one estimated budget across bulk and component scans, retries included, with an honest footnote that in-flight work can still go over the estimate. And when a patch gets blocked, the result now explains what changed, what stopped the fix, what to do next, and whether the change belongs somewhere outside the repo. It can also import ArmorCode SAST findings, and when a hosted patch run ends on a different commit than it started, it reports revision_changed with an execution receipt instead of quietly pretending nothing moved.
Read this next to the VulnCheck numbers from earlier this week: 37,966 findings reported in Anthropic's Glasswing program, 217 marked fixed. Finding bugs is cheap now. Getting them fixed is the bottleneck. A security agent that tells you why it couldn't land a fix, and stays inside a dollar cap while trying, is aimed straight at that gap. The receipts matter more than the scan count.
← Back to all articles
Three changes stand out. Interrupted Standard scans can now pick up from a checkpoint with codex-security scans resume, keeping the usage and budget already spent. A new --max-total-cost flag shares one estimated budget across bulk and component scans, retries included, with an honest footnote that in-flight work can still go over the estimate. And when a patch gets blocked, the result now explains what changed, what stopped the fix, what to do next, and whether the change belongs somewhere outside the repo. It can also import ArmorCode SAST findings, and when a hosted patch run ends on a different commit than it started, it reports revision_changed with an execution receipt instead of quietly pretending nothing moved.
Read this next to the VulnCheck numbers from earlier this week: 37,966 findings reported in Anthropic's Glasswing program, 217 marked fixed. Finding bugs is cheap now. Getting them fixed is the bottleneck. A security agent that tells you why it couldn't land a fix, and stays inside a dollar cap while trying, is aimed straight at that gap. The receipts matter more than the scan count.
Comments