Member-only story
A hands-on breakdown of Codex Security, the CLI OpenAI open-sourced without telling anyone. #
In March 2026, a scanner opened 13 pull requests against NVIDIA’s OpenShell repo. The bot was Aardvark, OpenAI’s agentic vulnerability hunter, before it had the Codex Security name. A principal engineer went through all 13 by hand.
Eleven were legitimate. Two weren’t.
One PR added a security header called x-sandbox-id
, meant to identify which sandbox a request came from. The header was self-asserted. Any client could set it to anything. It also broke every existing caller, because the sandbox client that was supposed to send the header never actually sent it. The engineer's note in the tracker: "security theater."
The second PR was worse. It proposed blocking AF_INET
and AF_INET6
sockets in proxy mode. Sounds like a sane lockdown, until you notice the proxy itself needs those sockets to reach its own upstream. The fix would have broken the exact system it was supposed to protect.
That’s the real story under this week’s headline, “OpenAI open-sources security scanning CLI.” It’s a better story than the press…