OpenAI Unveils Codex Security

OpenAI has released Codex Security, which performs everything from vulnerability detection to reproduction verification and fix suggestions, in the form of a CLI and TypeScript SDK. It is provided as the open-source npm package @openai/codex-security, and can be used in the Codex desktop app, terminal, SDK, and Codex Cloud.

Rather than matching only fixed signatures like traditional rule-based SAST, it finds vulnerability candidates based on each repository's threat model and code context. Findings with strong signals are verified in an isolated environment before being surfaced as results, reducing false positives, and each finding comes with supporting evidence, priority, and a suggested patch.

The key features are as follows.

• scan: Scans the entire repository, specific paths, commit diffs, or working tree changes
• validate: Verifies the reproducibility of found vulnerabilities
• patch: Generates vulnerability fixes
• scans compare: Classifies findings across scans as new, persistent, recurring, resolved, etc.
• SARIF, CSV, and JSON export, along with CI and pre-commit hook integration
• Adding architecture documentation, security policies, and threat models to the scan context via --knowledge-base

Codex Cloud, based on GitHub integration, is provided as a research preview and scans repositories on a per-commit basis. Running it requires Node.js 22.13.0 or later and Python 3.10 or later, and since it presupposes running Codex models, it is not suitable for fully air-gapped environments. A cost ceiling can be set with the --max-cost option.

At present, the public repository and documentation do not present independent benchmark figures demonstrating detection quality.