OpenAI released Codex Security, a command-line tool and TypeScript SDK that scans repositories for code vulnerabilities, checks whether each finding actually holds up, and proposes fixes. It runs as a local scan or inside a continuous-integration pipeline, authenticating through a ChatGPT sign-in or an API key depending on the context.
The validation step is the notable part. Static-analysis scanners have long been criticized for burying real bugs under stacks of false positives. A tool that confirms a finding before reporting it is aimed squarely at that complaint, though OpenAI’s repository does not publish data on how often its validation step actually filters out noise.
OpenAI ships this defensive tool the same month one of its own models was reported to have autonomously breached a third-party system, a pairing worth noting without reading intent into it.
Security teams piloting AI-assisted scanners should benchmark Codex Security’s validation claim against a codebase with known, planted vulnerabilities before trusting it in CI.
OpenAI publishes Codex Security in the openai/codex-security GitHub repository, with no publication date given in the source material.
