{"slug": "openai-open-sources-codex-security-cli-for-repository-scans-and-ci", "title": "OpenAI open-sources Codex Security CLI for repository scans and CI", "summary": "OpenAI open-sourced the Codex Security CLI and TypeScript SDK on July 28th, enabling developers to scan, validate, and patch vulnerabilities in software repositories locally or in CI pipelines. The Apache-2.0-licensed tool, announced by Codex lead Thibault Sottiaux, can scan entire repos, selected paths, or Git diffs, and supports export to SARIF, JSON, or CSV formats. The release extends OpenAI's push into application security, competing with vendors like Snyk, Semgrep, and GitHub.", "body_md": "[Thibault \"Tibo\" Sottiaux (@thsottiaux)](https://x.com/thsottiaux), OpenAI's Codex lead, released an open-source command-line interface and TypeScript SDK on July 28th for finding, validating and patching vulnerabilities in software repositories.\n\nSottiaux announced the release [in a post on X](https://x.com/thsottiaux/status/2082241164850364555?s=46), pointing developers to the new [Codex Security repository](https://github.com/openai/codex-security). The Apache-2.0-licensed package can scan complete repositories, selected paths or changes against a Git diff. It can also preserve scan history, compare findings over time and run inside continuous-integration pipelines.\n\nThe release extends the remit of a product Sottiaux has been building from inside OpenAI's coding operation. An [OpenAI Forum biography](https://forum.openai.com/public/events/codex-is-for-everyone-why-codex-matters-beyond-code-fa40puy7wi) says he previously led human-data work for Gemini and built machine-learning workflow infrastructure at Google DeepMind. He holds degrees in computer science, computational mathematics and applied mathematics from Universite catholique de Louvain.\n\n### From a connected service to a pipeline tool\n\nOpenAI [introduced Codex Security on March 6th](https://openai.com/index/codex-security-now-in-research-preview/) following a private beta under the name Aardvark. The research preview connected directly to GitHub repositories, generated editable threat models, inspected repository history, tried to reproduce suspected vulnerabilities in isolated environments and proposed patches for human review.\n\nThe CLI and SDK put that scanner into local development and automated workflows. Developers can install the package with `npm install @openai/codex-security`\n\n, authenticate through an OpenAI account or API key and run `npx codex-security scan`\n\nagainst a repository. The package supports macOS, Linux and Windows, requires Node.js 22 or later, and uses Python 3.10 or later for scanning and exporting findings.\n\nThe scanner can ingest architecture documents and threat models as external knowledge, review only specified folders, or inspect changes relative to a branch such as `origin/main`\n\n. Results can be exported as JSON, CSV or SARIF, the standard format used by code-scanning systems. CI jobs can set a severity threshold that returns a failing exit code when the scan finds an issue at or above that level.\n\nCodex Security also includes `validate`\n\nand `patch`\n\ncommands. The first asks the agent to test a candidate finding; the second generates a proposed fix. OpenAI's [current product documentation](https://developers.openai.com/codex/security) says patches still require human review and that the CLI and SDK remain a limited beta for approved customers and partners. The source code is public, while access to the underlying scanner remains gated.\n\nOpenAI warns that generated scan artifacts may contain source excerpts, reproduction steps and vulnerability details. The repository instructs users to store those files outside the scanned Git worktree and away from public issue trackers or shared directories. A pre-commit hook can also block changes when a scan produces high-severity findings or fails to complete.\n\n### OpenAI pushes Codex into application security\n\nCodex Security moves OpenAI deeper into a market already served by Snyk, Semgrep, GitHub, Checkmarx, Veracode and other application-security vendors. [GitHub's Copilot Autofix](https://docs.github.com/en/code-security/concepts/code-scanning/autofix-for-code-scanning), for example, can generate fixes from CodeQL alerts, while its agentic mode explores a repository and reruns CodeQL to validate a proposed change. [Semgrep](https://semgrep.dev/products/semgrep-code/) combines deterministic static analysis with AI-backed analysis and remediation. [Snyk](https://snyk.io/platform/) is similarly adding agent-focused controls and automated fixes across development workflows.\n\nOpenAI's pitch centers on project-specific reasoning. Codex Security builds a model of trust boundaries, sensitive data and attacker entry points, then attempts to validate an attack path before presenting a finding. Traditional scanners frequently depend on rules, signatures or known data-flow patterns, though established vendors are increasingly combining those systems with language models.\n\nThe performance figures remain OpenAI's own. At the March research-preview launch, OpenAI said Codex Security had scanned more than 1.2 million commits across external beta repositories during the preceding 30 days, identifying 792 critical and 10,561 high-severity findings. OpenAI also listed 14 assigned CVEs associated with vulnerabilities reported to open-source projects. Those totals describe findings generated during a controlled beta, rather than an independent comparison with competing scanners.\n\nDistribution gives Sottiaux's product a substantial opening. OpenAI [said on June 2nd](https://openai.com/index/codex-for-knowledge-work/) that Codex had passed 5 million weekly active users. The new package lets approved customers insert security checks into the same terminal, repository and CI environments where coding agents already operate, turning vulnerability review into another programmable Codex task.", "url": "https://wpnews.pro/news/openai-open-sources-codex-security-cli-for-repository-scans-and-ci", "canonical_source": "https://runtimewire.com/article/openai-open-sources-codex-security-cli-typescript-sdk", "published_at": "2026-07-28 23:47:23+00:00", "updated_at": "2026-07-29 00:03:33.575601+00:00", "lang": "en", "topics": ["developer-tools", "ai-tools", "ai-products", "ai-safety"], "entities": ["OpenAI", "Codex Security", "Thibault Sottiaux", "GitHub", "Snyk", "Semgrep", "Google DeepMind", "Apache-2.0"], "alternates": {"html": "https://wpnews.pro/news/openai-open-sources-codex-security-cli-for-repository-scans-and-ci", "markdown": "https://wpnews.pro/news/openai-open-sources-codex-security-cli-for-repository-scans-and-ci.md", "text": "https://wpnews.pro/news/openai-open-sources-codex-security-cli-for-repository-scans-and-ci.txt", "jsonld": "https://wpnews.pro/news/openai-open-sources-codex-security-cli-for-repository-scans-and-ci.jsonld"}}