# Codex Security CLI Goes Open Source—Repo First, Marketing Second

Times of AI Desk · 2026-07-29 · Work

[https://timesof.ai/2026/07/openai-codex-security-cli-open-source](https://timesof.ai/2026/07/openai-codex-security-cli-open-source)

> OpenAI confirmed the open-source Codex Security CLI and TypeScript SDK after Hacker News surfaced the repo—scan, track findings, verify fixes, wire CI/CD. Early release; cloud features still partly gated. Defensive coding agents move onto the developer’s critical path.

Defensive coding agents are becoming a **standard lab product lane**, not a side demo. Open-sourcing the CLI is both a developer trust move and a distribution play: security teams can evaluate scanning and fix-verification loops without waiting for full SaaS procurement.

**OpenAI** confirmed the **open-source Codex Security CLI** after the project surfaced on **Hacker News**. The **CLI and TypeScript SDK** (`@openai/codex-security`, repo **github.com/openai/codex-security**) let teams **scan repositories**, **track findings across runs**, **verify fixes**, and add **security checks to CI/CD**. OpenAI calls it an **early release** and is collecting feedback. Codex Security as a product line existed earlier in **2026 research preview**; today’s news is the **open-source CLI packaging**.

## What developers can install

| Path | Detail |
|------|--------|
| **npm package** | `@openai/codex-security` |
| **Quick start** | `npx @openai/codex-security@latest --help` |
| **Source** | [github.com/openai/codex-security](https://github.com/openai/codex-security) |
| **Docs** | ChatGPT Learn / Codex Security CLI quickstart (scan, preflight, CI patterns) |
| **Status** | Early / beta; some cloud features still access-gated per docs |

OpenAI’s product account framed the release as **quietly shipped**, then amplified after community discovery—repo first, marketing second.

## Product-line context

Codex Security sits next to:

- **Codex** coding agent / CLI (general development)
- **Claude Security** plugin (Anthropic, July 22 beta for Claude Code)
- OpenAI **Daybreak** / **Patch the Planet** defensive security initiatives earlier in 2026

Cloud Codex Security had already been scanning large commit volumes in research preview; the open-source CLI moves **local and CI-native** workflows into the open, not only hosted AppSec.

## Limits

- Early/beta; false-positive rates and fix quality are not independently scored here.
- Some cloud features remain access-gated.
- Relation between OSS CLI and paid Codex Security cloud pricing is still settling.

## Sources

- [OpenAI on X: Codex Security CLI open-source announcement (July 29, 2026)](https://x.com/OpenAI/status/2082263717916586117)
- [GitHub: openai/codex-security](https://github.com/openai/codex-security)
- [OpenAI Developer Community: Introducing the Open-Source Codex Security CLI](https://community.openai.com/t/introducing-the-open-source-codex-security-cli/1388319)
- [Codex Security documentation (ChatGPT Learn)](https://learn.chatgpt.com/docs/security)
- [Hacker News discussion: Codex Security](https://news.ycombinator.com/item?id=49089755)