OpenAI Open-Sources Codex Security CLI and TypeScript SDK

OpenAI said the quiet part out loud — after HN already had the link. On July 29, 2026, @OpenAI posted that they “quietly released the open-source Codex Security CLI, but Hacker News found it before we had a chance to share it here…” The pitch: scan repositories, track findings across runs, verify fixes, and add security checks to CI/CD — early release, feedback welcome.

Package: @openai/codex-security (0.1.1, Apache 2.0). Source: openai/codex-security (~2.6k stars within a day of going public). Same agent stack family as Daybreak / Codex Security.

TL;DR

Official install lines from the announcement thread:

npm install @openai/codex-security
# or
npx @openai/codex-security@latest --help

Quick start

npm install @openai/codex-security
npx codex-security login          # ChatGPT; or set OPENAI_API_KEY / CODEX_API_KEY
npx codex-security scan .

Headless / remote machine: npx codex-security login --device-auth. Check npx codex-security --version, info --json, and scan --help after install.

TypeScript:

import { CodexSecurity } from "@openai/codex-security";

const security = new CodexSecurity();
try {
  const result = await security.run("/path/to/repository", {
    outputDir: "/path/outside/repository/results",
  });
  console.log(result.reportPath, result.findings.findings.length);
} finally {
  await security.close();
}

Keep --output-dir outside the scanned repo (and worktree). On macOS/Linux, existing output dirs must be mode 700. If the default workbench state directory is not writable, set CODEX_SECURITY_STATE_DIR to a writable path outside the repo.

Surfaces in the Codex Security family

Don’t confuse three related products:

Plugin quickstart guidance recommends gpt-5.6-sol with xhigh reasoning for best scan quality on interactive runs. First-run settings often start with Scan type Codebase, Deep scan off, Entire codebase — then escalate depth once you trust cost and noise.

Artifacts a completed scan typically writes:

• report.md — human-readable entry point
• scan-manifest.json, findings.json, coverage.* — automation
• Findings workspace UI in the plugin path

What you can actually do

Useful CI shape from the README:

SCAN_ROOT="$(mktemp -d)"
npx codex-security scan . \
  --diff origin/main \
  --output-dir "$SCAN_ROOT/results" \
  --json \
  --fail-on-severity high > "$SCAN_ROOT/findings.json"

Exit codes: 0 clean/report-ok · 1 severity policy fail · 2 incomplete/error — so flaky coverage can’t look like “all green.”

CI design patterns that won’t lie to you

1. Freeze the commit — HN users hit failures when HEAD moved mid-scan; pin SHA.
2. Diff-scoped PRs — --diff origin/main keeps cost and noise down vs whole-monorepo every push.
3. SARIF to the code-scanning UI — export so humans review in GitHub/GitLab, not only in report.md.
4. Severity gates — fail on high/critical; don’t fail the build on informational noise until you tune.
5. Separate output volume — never write results into the scanned tree (contamination + permission modes).
6. Cost caps — --max-cost USD before a Friday night full-repo deep scan.
7. Auth clarity — env API key overrides ChatGPT login unless you force --auth chatgpt; document which identity CI uses. Interactive scans ask when both exist; CI never prompts.

Auth: ChatGPT vs API key (Jul 29 README)

Recent README work also makes auth and state failures actionable (clearer retry hints when an env key overrides a stored sign-in) and adds false-positive feedback paths in the workbench — useful once you start marking noise so later scans improve.

bulk-scan: org-wide discovery

OpenAI’s docs (and the product UI copy) show the intended loop:

gh auth login
npx codex-security bulk-scan

What happens:

1. Repository discovery — finds active GitHub repos (pushed in the last 90 days; archived + forks excluded).
2. Select — type-to-filter, confirm the set (demos show thousands of repos in a large org).
3. Results — written under an output root such as /tmp/security-scans (use --output-dir).
4. Resume — selection saved to repositories.csv; rerun the same command to continue.

For CI / noninteractive inventories, pass a CSV with required id, repository, and revision (full commit SHA) columns; optional scope / mode. Use --workers for concurrency and --max-attempts for retries.

bulk-scan is the difference between “we scanned the service we remember” and “we inventoried the org.” Track findings across runs with scans compare so regressions are visible when someone “fixes” a vuln by deleting the scanner config.

How it differs from Semgrep / CodeQL / classic SAST

Codex Security is agentic contextual analysis, not only pattern matching. That means:

• Better at multi-file attack paths and “is this actually reachable?” narratives
• Worse at being a deterministic, offline, air-gapped gate
• Findings can include proposed patches — still require human review
• Cost scales with model reasoning effort and workers, not just LOC

Use classic SAST for cheap, repeatable lint-shaped rules; use Codex Security for deeper review passes on high-risk services, auth changes, and crypto/payment paths. Pair with Cisco Antares research if you care about vuln localization SLMs as a complementary approach.

Caveats (read before you scan . on prod)

1. Not offline — default models are hosted; code leaves your laptop under API terms.
2. Cost — long scans with high reasoning + workers add up; use --max-cost USD.
3. Early API — pre-1.0; semver may break minor versions.
4. Auth footguns — env API key overrides ChatGPT login unless --auth chatgpt.
5. HEAD drift — freeze the commit you meant to assess.
6. Permission — only scan repos you own or are authorized to assess.
7. False confidence — empty findings ≠ secure; coverage artifacts and exit code 2 exist for a reason.

For the product thesis (agentic cyber defense, gated models), see explainx.ai’s Daybreak / Codex Security guide.

Why this matters the same week as “Pacing the Frontier”

OpenAI staff signed a letter about pacing automated AI R&D while shipping open tooling that uses frontier models to find exploits. That is not a contradiction if you read both as: capabilities are racing; defenses and governance need to ship in public too. Cross-link: Pacing the Frontier letter. Same week Anthropic showed Mythos doing mathematical cryptanalysis — offensive research and defensive scanners are both shipping.

Suggested rollout for a mid-size eng org

Week 1: Security + one platform team run CLI on a non-critical service; calibrate false positives.
Week 2: Add diff-scoped CI on that service with SARIF; severity gate on high only.
Week 3: Plugin workflow for humans triaging report.md; document patch review SLA.
Week 4: bulk-scan inventory of public GitHub; decide cloud vs CLI for private monorepos.
Ongoing: Re-check npx codex-security info --json before pinning versions — 0.1.x moves.

Threat-model prompts that improve scans

Agentic scanners behave better when you state what “bad” means for this repo:

• Auth boundaries (who can call which route)
• Trust boundaries (user HTML vs admin SSR)
• Secrets locations (Vault vs env vs client bundles)
• Compliance constraints (PII retention, tenancy)

Pass that as threat-model guidance in the plugin setup or as repo docs the agent can read. Blank scans on a monorepo produce generic findings; scoped threat models produce actionable ones.

Compare to Daybreak / cloud

Daybreak / Codex Security is the product thesis; this CLI is the open early cut for local/CI. If your org needs GitHub-connected scanning without engineers running npx on laptops, evaluate Codex Security cloud. If you need air-gapped, this package is the wrong tool — use offline SAST and accept the coverage trade.

Responsible use

Only scan repositories you own or are authorized to assess. Publishing scan findings from a random public repo without a disclosure process is still reckless even when the CLI is open source. Pair offensive capability week with Mythos cryptanalysis and the Pacing letter: the industry is shipping both accelerants and brakes in public.

Findings triage playbook

1. Sort by severity; ignore info until high/critical are empty.
2. Require a human accept / reject / false-positive mark in the findings workspace.
3. Prefer validate before patch so “fixed” means re-checked.
4. Export SARIF to the PR; keep report.md for auditors.
5. Re-scan the same SHA after patch; use scans compare for regressions.
6. File internal tickets with evidence paths, not only model prose.

Agentic scanners fail when teams treat green CI as a trophy. Treat Codex Security like a senior reviewer that sometimes hallucinates — powerful, not omniscient.

Sample GitHub Actions sketch

Use Node 22, install @openai/codex-security, create a temp output dir outside the worktree, then run npx codex-security scan . --diff origin/main --output-dir "$OUT" --json --fail-on-severity high with OPENAI_API_KEY from secrets. Freeze to the PR SHA; store SARIF as an artifact; never write results into the repo worktree. Tune severity after a week of noise data. Early 0.1.x will move — pin intentionally.

Closing note for explainx.ai readers

This launch moves fast; verify primary docs before you standardize tooling or brief a client. Re-check availability, pricing, and model IDs on the official pages linked above, then tell us what broke in production so we can update the guide. Follow @explainx_ai for follow-ups when the vendors ship the next patch — and prefer measured evals on your own traffic over screenshot economics. If you only needed a headline, you already have it; if you are implementing, the checklists above are the part that saves a weekend.

Related on explainx.ai

• Copilot for Word document AI worm (XPIA)
• VulnCheck — AI-found bugs aren’t more exploited
• OpenAI Daybreak — Codex Security cyber defense
• Pacing the Frontier employee letter
• Cisco Antares vulnerability localization
• Claude / Codex / Cursor usage limits
• What is an agent harness?
• Top open & closed agent harnesses

Official

• OpenAI on X — Codex Security CLI announcement
• npm — @openai/codex-security (0.1.1)
• GitHub — openai/codex-security
• Docs — Codex Security CLI
• Docs — TypeScript SDK
• HN discussion

Package 0.1.1, star counts, and default models reflect public sources as of July 29, 2026 — re-check npx codex-security info --json before you standardize CI.