Codex Security CLI Goes Open Source—Repo First, Marketing Second
OpenAI confirmed the open-source Codex Security CLI and TypeScript SDK after Hacker News surfaced the repo—scan, track findings, verify fixes, wire CI/CD. Early release; cloud features still partly gated. Defensive coding agents move onto the developer’s critical path.
Defensive coding agents are becoming a standard lab product lane, not a side demo. Open-sourcing the CLI is both a developer trust move and a distribution play: security teams can evaluate scanning and fix-verification loops without waiting for full SaaS procurement.
OpenAI confirmed the open-source Codex Security CLI after the project surfaced on Hacker News. The CLI and TypeScript SDK (@openai/codex-security, repo github.com/openai/codex-security) let teams scan repositories, track findings across runs, verify fixes, and add security checks to CI/CD. OpenAI calls it an early release and is collecting feedback. Codex Security as a product line existed earlier in 2026 research preview; today’s news is the open-source CLI packaging.
What developers can install#
| Path | Detail |
|---|---|
| npm package | @openai/codex-security |
| Quick start | npx @openai/codex-security@latest --help |
| Source | github.com/openai/codex-security |
| Docs | ChatGPT Learn / Codex Security CLI quickstart (scan, preflight, CI patterns) |
| Status | Early / beta; some cloud features still access-gated per docs |
OpenAI’s product account framed the release as quietly shipped, then amplified after community discovery—repo first, marketing second.
Product-line context#
Codex Security sits next to:
- Codex coding agent / CLI (general development)
- Claude Security plugin (Anthropic, July 22 beta for Claude Code)
- OpenAI Daybreak / Patch the Planet defensive security initiatives earlier in 2026
Cloud Codex Security had already been scanning large commit volumes in research preview; the open-source CLI moves local and CI-native workflows into the open, not only hosted AppSec.
Limits#
- Early/beta; false-positive rates and fix quality are not independently scored here.
- Some cloud features remain access-gated.
- Relation between OSS CLI and paid Codex Security cloud pricing is still settling.