← Back to feed

OpenAI released Codex Security as an open-source CLI on GitHub, making the tool available beyond its initial research preview. The tool scans codebases for vulnerabilities, validates findings against the surrounding context, and drafts fix suggestions grounded in actual code — not generic remediation templates.

In testing across 1.2 million commits, Codex Security surfaced 792 critical-severity and 10,561 high-severity findings. OpenAI framed those numbers as evidence of the tool’s detection breadth, not its false positive rate — the validation step is designed to filter noise before a finding surfaces to the developer.

What It Does

Codex Security integrates into the commit pipeline rather than sitting outside it as a periodic audit tool. It examines changes as they arrive, tracks findings over time, and links fix suggestions directly to the affected code region. The model grounding means suggested patches reference the actual implementation rather than copying from a generic vulnerability database.

The research preview was available to ChatGPT Pro, Enterprise, Business, and Edu subscribers. The open-source release on GitHub removes that gate and lets security teams run it against private codebases without routing data through OpenAI’s APIs.

The Security Tooling Moment

Codex Security enters a competitive window. Anthropic launched Claude Security Beta earlier this year as a codebase scanner that drafts patches rather than just flagging findings — the same design philosophy. Google’s Glasswing consortium has patched over 10,000 vulnerabilities using frontier AI models in a controlled environment.

The GPT-5.6 Sol variant demonstrated autonomous vulnerability discovery at commercial scale — finding a $500,000 WordPress RCE for approximately $25 in API costs. Codex Security is positioned below that autonomous-agent tier: it works inside a human review loop rather than operating end-to-end.

Open-Source vs. Claude Security

The key difference between Codex Security and Anthropic’s Claude Security Beta is the deployment model. Claude Security Beta routes findings through Anthropic’s infrastructure. Codex Security, now open-sourced, lets teams run the scanner in their own environment — relevant for organisations with strict data residency requirements or air-gapped development infrastructure.

NTT DATA Group has deployed Codex for enterprise use under OpenAI’s internal guidelines. The published guidance covers what data types can be processed, which systems the tool can connect to, how network traffic is managed, and which sandbox mode to apply — the documentation pattern that enterprise procurement teams need before a security tool touches production code.

Numbers

• Commits scanned in testing: 1.2 million
• Critical-severity findings: 792
• High-severity findings: 10,561
• Availability: Open source on GitHub; prior research preview required ChatGPT Pro, Enterprise, Business, or Edu subscription