OpenAI ships Codex Security, a CLI and SDK for AI-assisted vuln scanning

OpenAI has released @openai/codex-security, a command-line tool and TypeScript SDK that uses its Codex models to find, validate, and fix security vulnerabilities in source code. The tool scans whole repositories or individual changes, tracks findings across scans by persisting history to a local workbench state directory, and slots into CI pipelines for automated security gating. It requires Node.js 22+, Python 3.10+, and access to the Codex Security backend, and installs through npm with a simple login-then-scan workflow.

Authentication is the notable wrinkle: interactive scans can run under either a ChatGPT sign-in or an OPENAI_API_KEY, and when both are present the CLI prompts the user to choose. Non-interactive and CI runs default to API-key precedence, with an —auth flag to force either credential. Beyond the CLI, the SDK exposes a small programmatic surface — instantiate CodexSecurity, call run() against a path, and read back a report file — making it easy to embed scans in custom tooling.

The release is another step in the industry’s push to fold LLM-based code analysis directly into developer workflows, positioning OpenAI against established SAST vendors and against similar AI-native scanners. The reliance on model-generated findings raises the usual questions about false-positive rates and validation rigor, but the built-in tracking and CI hooks signal an intent to be used as a recurring pipeline check rather than a one-off audit tool.