OpenAI Open-Sources the Codex Security CLI
On July 29, 2026, OpenAI publicly announced the open-source Codex Security CLI and TypeScript SDK—after Hacker News surfaced the github.com/openai/codex-security repo—so teams can scan repositories, track findings across runs, verify fixes, and wire security checks into CI/CD from the terminal.
TLDR
OpenAI on July 29, 2026 confirmed the open-source Codex Security CLI after the project surfaced on Hacker News. The CLI and TypeScript SDK (@openai/codex-security, repo github.com/openai/codex-security) let teams scan repositories, track findings across runs, verify fixes, and add security checks to CI/CD. OpenAI calls it an early release and is collecting feedback. Codex Security as a product line existed earlier in 2026 research preview; today’s news is the open-source CLI packaging.
What developers can install
| Path | Detail |
|---|---|
| npm package | @openai/codex-security |
| Quick start | npx @openai/codex-security@latest --help |
| Source | github.com/openai/codex-security |
| Docs | ChatGPT Learn / Codex Security CLI quickstart (scan, preflight, CI patterns) |
| Status | Early / beta; some cloud features still access-gated per docs |
OpenAI’s product account framed the release as quietly shipped, then amplified after community discovery—repo first, marketing second.
Product-line context
Codex Security sits next to:
- Codex coding agent / CLI (general development)
- Claude Security plugin (Anthropic, July 22 beta for Claude Code)
- OpenAI Daybreak / Patch the Planet defensive security initiatives earlier in 2026
Cloud Codex Security had already been scanning large commit volumes in research preview; the open-source CLI moves local and CI-native workflows into the open, not only hosted AppSec.
Why this story matters
Defensive coding agents are becoming a standard lab product lane, not a side demo. Open-sourcing the CLI is both a developer trust move and a distribution play: security teams can evaluate scanning/fix-verification loops without waiting for full SaaS procurement. Watch false-positive rates, fix quality, CI runtime cost, and how the OSS CLI relates to paid Codex Security cloud.