OpenAI has quietly open-sourced Codex Security, a command-line tool and TypeScript SDK that finds, validates, and fixes security vulnerabilities in your code. The release landed on July 29, 2026 under an Apache-2.0 license, and it arrived without a launch post: developers spotted the repository on Hacker News first, and OpenAI acknowledged the drop on X only after the fact.
The move puts OpenAI in direct competition with Anthropic, whose Claude Security plugin reached open beta a week earlier. As The Decoder reported, both companies now ship terminal-native tools that scan a codebase, reason about the findings, and hand you a patch. For anyone building an app, a site, or an automation with AI, security review is shifting from a separate audit step into the same command line where the code gets written.
What OpenAI shipped
Codex Security is an npm-installable CLI (package name @openai/codex-security) plus a TypeScript SDK. It scans repositories, reviews individual changes, tracks findings across multiple scans over time, and runs inside a CI/CD pipeline so a failing security check can block a merge. Multi-repository scanning is supported, which matters for teams that split a product across several services.
The tool is not brand-new research. It began life inside OpenAI as an internal agent codenamed "Aardvark," which launched as a research preview for ChatGPT Enterprise, Business, and Edu accounts back in March 2026. The July 29 release open-sources the client side of that system. The repository already carries more than 4,000 stars and over a hundred commits, and the full command reference lives in OpenAI's Codex Security documentation.
How Codex Security works: the CLI workflow
The tool is built to sit inside an existing development loop rather than replace it. A typical first run looks like this:
- Install the CLI. Add
@openai/codex-securitythrough npm. You need Node.js 22 or later and Python 3.10 or later on the machine. - Authenticate. The CLI is open source, but the scanning backend requires access to Codex Security, so you connect an approved account before your first scan.
- Scan a target. Point the tool at a whole repository, a branch diff, a pull request, or a single commit. It maps the code, hunts for vulnerability patterns, and validates each finding to cut false positives.
- Review and apply fixes. Each confirmed issue comes with a proposed patch. You read it, decide whether it is correct, and apply it yourself rather than letting the agent commit blind.
- Wire it into CI. Add the scan as a step in your pipeline so every pull request gets checked, and track how findings change across scans.
That "find, confirm, fix" loop is the core pitch. Traditional static analysis is good at flagging suspicious patterns but drowns teams in noise. Codex Security tries to validate each issue before it reaches you, then closes the loop with a concrete patch instead of a lint warning.
Codex Security vs Claude Security
The obvious comparison is Anthropic's offering, which we covered when the Claude Security plugin reached beta. Claude Security runs a team of Claude agents that map your architecture, build a threat model, hunt for vulnerabilities, and run an adversarial verification pass before reporting. You invoke it with the /security-review command inside Claude Code, or through Anthropic's GitHub Action. Here is how the two stack up.
| Dimension | OpenAI Codex Security | Anthropic Claude Security |
|---|---|---|
| Interface | CLI plus TypeScript SDK | Claude Code /security-review plus GitHub Action |
| License | Apache-2.0 (client CLI) | Plugin, in beta |
| Backend access | Limited beta, approved accounts | Claude Code plugin beta |
| Runtime | Node.js 22+, Python 3.10+ | Runs inside Claude Code |
| Core method | Scan, validate, fix; track findings across scans | Multi-agent map, threat model, adversarial verification |
| CI/CD | Yes, pipeline step | Yes, via GitHub Action |
| Fix output | Proposed patch you review | Recommended patch you approve |
| Origin | Formerly "Aardvark" preview, March 2026 | Emerged from closed preview, July 2026 |
The philosophies rhyme. Both keep a human in the loop, both generate patches rather than auto-committing, and both stress reducing false positives through a validation pass. The clearest split is packaging: OpenAI leads with an open-source CLI and SDK you can script against, while Anthropic leads with a slash command woven into the Claude Code session.
Why it matters for builders
For solo builders and small teams, a dedicated security engineer is rarely on staff. That gap is exactly where AI-assisted review helps. A CLI that traces data flow across files can catch an authorization bypass or an injection flaw that a quick manual read would miss, and it can do it on every pull request instead of once a quarter.
The bigger shift is competitive. With OpenAI and Anthropic shipping rival vulnerability scanners within a week of each other, code security is becoming a standard feature of the AI coding stack rather than a premium add-on. That pressure tends to push capability up and price down, which is good news for anyone shipping software with a lean team. The Apache-2.0 license on the OpenAI CLI also means the client is auditable, so you can read exactly what the tool sends before you trust it with a private repository.
The catch: open CLI, closed backend
Open-source here does not mean fully open. The Apache-2.0 code on GitHub is the client. The actual scanning engine stays in limited beta for approved customers, a point Cybersecurity News flagged in its coverage. In practice the public release works as an on-ramp: you can read and script the CLI today, but you still need access to the Codex Security service to run a real scan. Treat this as an early beta, not a finished product, and expect the access model to change as OpenAI widens availability.
What to do next
If you already build with Codex or ChatGPT for coding, check whether your account has Codex Security access and run a scan against a non-critical repository to see the finding quality for yourself. If you live in Claude Code, compare the same repository through the /security-review command and judge which tool's patches you trust more. Either way, add one of these scans as a required CI step before your next release so security review stops being the thing you skip under deadline.
Frequently asked questions
Is OpenAI Codex Security free?
The CLI and TypeScript SDK are open source under Apache-2.0, so the client code is free. The scanning backend it connects to is in limited beta for approved accounts, so running a full scan currently requires Codex Security access rather than being free for everyone.
Does Codex Security send my code to OpenAI?
The scan runs against OpenAI's Codex Security backend, so code is analyzed by the service. Because the CLI is Apache-2.0, you can read the client source to see exactly what it transmits before pointing it at a private repository.
What are the system requirements?
The CLI requires Node.js 22 or later and Python 3.10 or later, and it installs through npm as the @openai/codex-security package.
How is Codex Security different from Claude Security?
Both scan code, validate findings, and propose patches with a human in the loop. OpenAI ships an open-source CLI and SDK you can script against, while Anthropic ships a /security-review slash command inside Claude Code plus a GitHub Action. The underlying approaches differ in packaging more than in goal.
Can I run Codex Security in CI/CD?
Yes. The tool is designed to run as a pipeline step so every pull request gets scanned, and it can track how findings change across multiple scans over time.
Is Codex Security production-ready?
It is best treated as an early beta. The client is public and usable, but the scanning backend remains in limited beta, so validate results carefully and keep a human reviewing every proposed fix before you apply it.
