OpenAI quietly shipped something more useful to a small team than another chat model: it open-sourced Codex Security, a command-line tool and TypeScript SDK, under Apache-2.0. The one-line description in the repo is the whole pitch — "a CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in your code." Three verbs, and the middle one is the reason to care.

What it is, and who it's for#

If you already run an AI vulnerability scanner in GitHub Actions, you know the failure mode: the scanner is confident, verbose, and wrong often enough that within a week someone adds continue-on-error: true and the check becomes decorative. Pattern-based scanners — Semgrep, CodeQL — match rules; they're fast, deterministic, and free, and they hand you a pile of maybes you triage by hand.

Codex Security is aimed squarely at that pile. It's agentic: instead of only flagging a pattern, it runs passes that try to validate whether a candidate finding is actually reachable and exploitable before it reports it — and then it can draft the fix. That's the capability a linter structurally can't have, and it's the thing that decides whether founders can leave the check turned on.

It's a sibling to the Codex CLI coding agent, sharing its models and authentication, but pointed at review instead of general coding.

Run your first scan#

Requirements first: Node.js 22.13.0+, Python 3.10+, and Codex Security access on your OpenAI account (OpenAI recommends Trusted-Access verification for best results). Then it's three commands:

npm install @openai/codex-security
npx @openai/codex-security login
npx @openai/codex-security scan .

scan writes JSON results to stdout and keeps history in a local workbench state directory; each run exposes a reportPath. Point it at a model and turn up the effort when it matters:

npx @openai/codex-security scan . --model gpt-5.6-terra --effort high

For a thorough audit — the mode that actually does the validation work — hand it more agents and let it keep discovering until it stops finding new things:

npx @openai/codex-security scan . \
  --mode deep --workers 2 --subagents 0 \
  --stop-after-no-new 3 --max-discovery-runs 10

Prefer to drive it from code? The SDK is the same tool with a close():

import { CodexSecurity } from "@openai/codex-security";

const security = new CodexSecurity();
const result = await security.run(".");
console.log(result.reportPath);
await security.close();

The two moves that make it a real CI gate#

A scanner in CI lives or dies on two decisions.

Authenticate with an environment variable, not login. In CI, set OPENAI_API_KEY or CODEX_API_KEY. Keys supplied this way are not written to Codex's credential home or the system keyring — they stay in the job's environment and die with it, which is what you want on a shared runner.

**Gate on new findings only.** This is the part teams skip and then regret. Keep a baseline scan of your default branch and use scans compare to diff a PR against it, so the check fails only when a change introduces a vulnerability — not because the repo already carried forty. A gate that fails on pre-existing debt gets muted; a gate that fails on regressions gets respected. Same tool, opposite outcome.

The shape founders should actually read#

Here's the honest frame, because "OpenAI open-sourced a security tool" invites the wrong conclusion. The scanner is open source. The brain is not. Apache-2.0 buys you a client you can read, fork, self-host, and wire into your pipeline without vendor-specific config lock-in — genuinely valuable, and more than most "AI security" vendors offer. It does not buy you free scanning. You still authenticate against OpenAI, you still choose a --model, and you still pay per token for every validation pass.

That "open client, paid intelligence" pattern is going to be the default for this whole category, and it's the right thing to plan around: treat the cost as a variable you tune with --effort and scan scope, and treat the client as infrastructure you own. Run cheap deterministic scanners on every commit for coverage, and spend Codex Security's tokens on the pull requests and release branches where a validated, fixable finding is worth the money.

The false-positive tax is what has kept AI security scanning out of most founders' pipelines. A tool whose whole middle step is validation — with an open, auditable client and a CI subcommand built for baselines — is the first version of this worth turning on and leaving on.