OpenAI has released Codex Security, an open-source command-line interface (CLI) and TypeScript SDK designed to help developers detect, validate, and remediate security vulnerabilities directly within their codebases.
The tool, published as @openai/codex-security, extends OpenAI’s Codex ecosystem into the application security space, offering automated repository scanning, change review, and continuous integration (CI) support.
Codex Security functions as a security scanning layer that integrates into existing developer workflows. It allows teams to scan entire repositories for vulnerabilities, review code changes for newly introduced risks, and track findings over time rather than treating each scan as an isolated event.
OpenAI Open-Sources Codex Security CLI
This persistent tracking capability distinguishes it from many standalone static analysis tools, since it builds a historical record of vulnerability status across a codebase’s lifecycle.
The tool runs both interactively on developer machines and non-interactively within CI pipelines, making it suitable for automated security gating in software delivery workflows.
Codex Security requires Node.js 22 or later and Python 3.10 or later, along with access to the Codex Security service.
Setup involves installing the package via npm, logging in through the CLI, and running a scan against a target directory; for CI environments, authentication uses the OPENAI_API_KEY environment variable instead of interactive login.
OpenAI has built-in flexible credential management. When both a ChatGPT sign-in and an API key are available, interactive scans prompt the user to choose which credential to use, while CI and other noninteractive scans automatically default to API-key precedence.
Developers can explicitly force a credential type using an --auth flag set to either chatgpt or api-key. To default permanently to ChatGPT sign-in, users can unset any configured API keys from their environment.
Scan history is stored in a local Codex Security workbench state directory. If this location is not writable, OpenAI recommends redirecting storage using the CODEX_SECURITY_STATE_DIR environment variable, pointed to a writable path outside the repository, a detail relevant for containerized or restricted-permission CI runners.
Beyond the CLI, OpenAI ships a TypeScript SDK for programmatic use, enabling developers to embed security scanning directly into build scripts or custom tooling.
The SDK exposes a CodexSecurity class that can be instantiated and run against a target path, returning a result object containing a report path, with a close method to clean up resources afterward.
According to GitHub, this SDK-first design suggests OpenAI is positioning Codex Security as infrastructure for other tools and platforms to build on, not just a standalone CLI product.
Codex Security arrives amid growing interest in AI-assisted vulnerability discovery and remediation, particularly as organizations look to shift security checks earlier in the development lifecycle (“shift-left” security).
By combining LLM-driven analysis with CI-native tooling, OpenAI is directly competing in a space occupied by established SAST and DevSecOps platforms, betting that Codex’s code-reasoning capabilities can offer higher-fidelity vulnerability validation than traditional pattern-matching scanners.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
 and TypeScript SDK designed to help developers detect, validate, and remediate security vulnerabilities directly within their codebases.){kind=link}