OpenAI Open-Sources Codex Security: How to Scan, Validate, and Fix Vulnerabilities

Introduction

OpenAI has quietly released the source code for Codex Security’s command-line interface and TypeScript SDK.

The public package, @openai/codex-security, is designed to help security and engineering teams:

• Scan repositories for vulnerabilities.
• Validate plausible findings.
• Review code changes before they are merged.
• Track findings across repeated scans.
• Mark and remember false positives.
• Verify whether a fix resolved the original issue.
• Export structured results for automation.
• Integrate security reviews into CI/CD workflows.
• Build custom security tooling through a TypeScript SDK.

The repository is published under the Apache License 2.0.

That makes the CLI and SDK code open source. It does not mean that the entire Codex Security service, its underlying models, every protected finding, or unlimited cyber access is now freely available for offline use.

Running scans still requires Codex Security access. OpenAI also says some full-repository scans, protected findings, and advanced cybersecurity requests may require approval through Trusted Access for Cyber.

The distinction is important:

Open-source CLI and SDK
≠
open-weight security model
≠
unrestricted cloud scanning access

Codex Security began as an internal project called Aardvark. It later moved into Codex as a research-preview application-security agent, and the new public package now lets developers bring the scanner into local terminals, internal tools, bulk repository campaigns, pre-commit checks, and CI pipelines.

From Aardvark to Codex Security

OpenAI first introduced Aardvark in October 2025 as an agentic security researcher powered by GPT-5.

The original system was designed to work more like a human application-security researcher than a conventional signature scanner.

Instead of only matching code against known patterns, Aardvark could:

• Read a repository.
• Build a model of how the system worked.
• Examine new commits.
• Reason about exploitability.
• Write and run tests.
• Use security tools.
• Explain a vulnerability.
• Propose a targeted patch.

In March 2026, OpenAI renamed Aardvark to Codex Security and integrated it into Codex.

The product entered research preview through Codex web for selected ChatGPT plans and connected GitHub repositories.

The later open-source release adds a different deployment layer.

Developers can now install the CLI or import the TypeScript SDK, while the hosted Codex Security cloud experience continues to exist separately.

What Was Actually Open-Sourced

The public GitHub repository contains:

• The Codex Security CLI.
• A TypeScript SDK.
• Docker and Docker Compose resources.
• CI-oriented commands and structured output support.
• Scan-history and finding-management functionality.
• Documentation and contribution files.

The package is published through npm as:

@openai/codex-security

The repository’s Apache-2.0 license generally permits use, modification, and redistribution under the license terms.

What Is Not Included as an Open Model

The release does not provide model weights for GPT-5.6 Sol, Terra, or a dedicated Codex Security model.

The default scan currently uses:

gpt-5.6-sol
reasoning effort: xhigh

The CLI calls an inference service through authenticated access.

The repository also documents provider options such as OpenRouter and Fireworks for selected models, but the Codex Security scanning workflow and protected cyber capabilities may still require OpenAI-side authorization.

Open Source Does Not Remove Access Controls

Installing the npm package is not the same as receiving permission to run every scan.

OpenAI’s documentation states that:

• Codex Security access is required.
• Some repositories or requests may require Trusted Access for Cyber.
• Signing in or setting an API key does not automatically grant Trusted Access.
• Security findings can contain sensitive source excerpts and exploit details.
• Users should scan only code they own or are authorized to assess.

The public code makes the workflow inspectable and extensible. It does not remove the safety and authorization layer around advanced cyber use.

Why This Release Matters

AI coding agents can generate and modify software faster than many organizations can review it.

That creates a security bottleneck.

A product can move from idea to deployed application in days or hours, while traditional application-security reviews may still depend on:

• Manual threat modeling.
• Static-analysis configuration.
• Penetration testing.
• Dependency review.
• Human triage.
• Release scheduling.
• Security-team availability.

The problem is not simply that developers lack vulnerability reports.

Many maintainers already receive too many reports, including:

• Duplicate findings.
• Low-impact warnings.
• Incorrect severity ratings.
• Unreachable code paths.
• Findings without proof.
• Generic remediation advice.
• Reports that ignore the project’s architecture.

Codex Security is designed around the opposite goal: fewer, more contextual findings with evidence that helps a reviewer decide what to fix.

How Codex Security Works

OpenAI describes the system as a multi-stage application-security workflow.

1. Build Repository Context and a Threat Model

Codex Security first studies the repository to understand the security-relevant structure of the project.

It attempts to identify:

• What the system does.
• Which components trust one another.
• Where user-controlled input enters.
• Which boundaries separate users, tenants, roles, or services.
• Which operations are privileged.
• Which assets are sensitive.
• Where the system is exposed to attackers.

The result is a project-specific threat model rather than a generic checklist.

Teams can add architecture documents, security policies, focus areas, and known attack vectors to improve this context.

2. Search for Vulnerabilities in Context

The agent reviews the relevant code while using the threat model to judge realistic impact.

This allows it to reason about issues that may be difficult for a rule-based scanner to understand in isolation.

Examples can include:

• Authorization gaps across tenant boundaries.
• Indirect prompt injection reaching privileged tools.
• Sensitive data exposed through agent traces.
• Authentication bypasses.
• Server-side request forgery.
• Dangerous interactions between otherwise ordinary components.

The scanner can review:

• A full repository.
• One or more selected paths.
• A commit range.
• Pull-request changes.
• Staged and unstaged working-tree changes.
• Multiple repositories in a bulk campaign.

3. Validate Plausible Findings

Where possible, Codex Security attempts to validate high-signal issues in an isolated environment.

Validation can help answer whether:

• The vulnerable path is reachable.
• The proposed exploit conditions are realistic.
• A proof of concept works.
• The issue has been incorrectly classified.
• The finding is likely to affect the running system.

This step is intended to reduce false positives.

It does not guarantee that every finding has been reproduced or that a completed scan proves the repository is secure.

The scan’s coverage.json file records whether coverage is:

complete
partial
unknown

Reviewers should read exclusions, deferred areas, and open questions before treating a scan as evidence of comprehensive review.

4. Propose a Targeted Fix

For accepted findings, Codex Security can suggest a patch designed to fit the surrounding system.

The objective is not merely to silence a scanner.

A good fix should:

• Remove or mitigate the root cause.
• Preserve intended application behavior.
• Avoid broad unrelated refactoring.
• Minimize regressions.
• Include evidence or tests where appropriate.
• Remain reviewable by a human engineer.

Codex Security scans are report-only by default. Suggested patches should still go through normal code review, testing, and deployment controls.

5. Learn From Review Feedback

The CLI stores scan history and supports finding feedback.

A reviewer can mark a finding as a false positive and record the reason.

Later scans can consider that explanation while checking the current code again.

This helps the scanner adapt to repository-specific facts without permanently suppressing a code path that might become vulnerable later.

OpenAI’s Reported Results

OpenAI has published several adoption and quality figures from its preview deployments.

These are company-reported metrics, not independent benchmark results.

March 2026 Research Preview

OpenAI said that during one 30-day period Codex Security:

OpenAI also reported that beta improvements:

• Reduced unnecessary alerts by 84% in one continuously scanned repository.
• Reduced findings with overstated severity by more than 90%.
• Reduced false positives by more than 50% across repositories.

June 2026 Daybreak Update

OpenAI later said Codex Security cloud had:

The scale is notable, but these figures should not be read as a controlled comparison with CodeQL, Semgrep, Snyk, or human penetration testing.

The tools operate differently and may measure findings, fixes, and coverage in different ways.

Codex Security Interfaces

Codex Security is now available through several related surfaces.

The public CLI and SDK use the same general scanner workflow as the plugin, but availability and feature maturity can differ between the plugin catalog, CLI package, and cloud research preview.

Quickstart: Install and Run Codex Security

The commands below follow OpenAI’s current official CLI documentation.

Step 1: Check the Prerequisites

The CLI requires:

Node.js 22 or later
Python 3.10 or later
Codex Security access

The GitHub repository currently gives more specific supported Node.js ranges, including recent 22.x, 24.x, and 26.x versions.

Check your environment:

node --version
python3 --version

Step 2: Install the Package

Install Codex Security from npm:

npm install @openai/codex-security

Check the installed version:

npx @openai/codex-security --version

List commands:

npx @openai/codex-security --help

Step 3: Authenticate

For local interactive use, sign in with a ChatGPT account:

npx @openai/codex-security login

For a remote or headless machine:

npx @openai/codex-security login --device-auth

For CI or another unattended workflow, provide an API key through the environment:

export OPENAI_API_KEY=""

Do not place API keys in source control.

Use a secret manager or the CI platform’s protected-secret system.

When both a stored ChatGPT login and an API key are available, select the desired method explicitly:

npx @openai/codex-security scan . --auth chatgpt

or:

npx @openai/codex-security scan . --auth api-key

Authentication does not automatically grant Trusted Access for Cyber.

Step 4: Choose a Private Output Directory

OpenAI recommends storing results outside the scanned repository.

Reports may contain:

• Source excerpts.
• Vulnerability evidence.
• Proof-of-concept material.
• Architecture details.
• Sensitive paths.
• Remediation guidance.

Prepare the target and results directory:

REPOSITORY=/path/to/repository
SCAN_DIR=/path/outside/repository/codex-security-results

If the default persistent state directory is not writable, choose another private directory:

export CODEX_SECURITY_STATE_DIR=/path/outside/repository/codex-security-state

Step 5: Run a Dry Check

Verify local paths and scan configuration before starting model work:

npx @openai/codex-security scan "$REPOSITORY" \
  --output-dir "$SCAN_DIR" \
  --dry-run

The dry run does not start Codex or load scan credentials.

Step 6: Run the First Scan

Start a standard repository scan:

npx @openai/codex-security scan "$REPOSITORY" \
  --output-dir "$SCAN_DIR"

Request machine-readable JSON on standard output:

npx @openai/codex-security scan "$REPOSITORY" \
  --output-dir "$SCAN_DIR" \
  --json

By default, Codex Security currently uses:

model: gpt-5.6-sol
reasoning effort: xhigh

A lower-cost configuration can use another supported model and effort level:

npx @openai/codex-security scan "$REPOSITORY" \
  --model gpt-5.6-terra \
  --effort high

Supported effort settings are:

minimal
low
medium
high
xhigh

Lower effort may reduce time and cost but can also reduce the depth of the review.

What a Completed Scan Produces

A standard result directory can contain:

codex-security-results/
├── scan-manifest.json
├── findings.json
├── coverage.json
├── report.md
├── artifacts/
└── exports/
    └── results.sarif

report.md

The primary human-readable report.

findings.json

Structured findings, including severity, confidence, affected locations, evidence, and remediation.

coverage.json

The reviewed surfaces, exclusions, deferred work, open questions, and completeness assessment.

scan-manifest.json

The target, scope, producer information, and sealed artifact references.

artifacts/

Supporting vulnerability reports, proof-of-concept files, or related evidence when available.

SARIF Export

SARIF can be consumed by GitHub Code Scanning and other compatible security tools.

Scan Only the Areas That Matter

A large monorepo may not need a full scan every time.

Select specific paths:

npx @openai/codex-security scan "$REPOSITORY" \
  --path services/billing \
  --path packages/auth

This can be useful when one release affects a defined service or security boundary.

Review a Pull Request or Commit Range

Scan committed changes between a base revision and HEAD:

npx @openai/codex-security scan "$REPOSITORY" \
  --diff origin/main \
  --head HEAD

The repository argument must point to the Git worktree root, and the required revisions must exist locally.

Review Uncommitted Changes

Scan staged and unstaged changes against HEAD:

npx @openai/codex-security scan "$REPOSITORY" \
  --working-tree \
  --base HEAD

This is useful before creating a pull request or committing a security-sensitive change.

Use Deep Scan Mode

Run a broader review when the normal scan is not sufficient:

npx @openai/codex-security scan "$REPOSITORY" \
  --mode deep

Deep mode takes longer and can consume more model resources.

OpenAI’s current documentation says it supports repository and path targets, not diff or working-tree targets.

Add Architecture and Security Context

Provide internal documentation that helps the agent interpret the system correctly:

npx @openai/codex-security scan "$REPOSITORY" \
  --knowledge-base /path/to/architecture.md \
  --knowledge-base /path/to/security-policies

Useful context can include:

• Trust boundaries.
• Authentication architecture.
• Tenant-isolation rules.
• Sensitive data classifications.
• Expected network paths.
• Security invariants.
• Threat models.
• Known exceptions.
• Compensating controls.

Do not include secrets unnecessarily.

The files become part of a security-sensitive scan workflow and should follow appropriate retention and access controls.

Control Scan Cost

Set an estimated model-cost limit in U.S. dollars:

npx @openai/codex-security scan "$REPOSITORY" \
  --max-cost 5

Requests already in progress may complete after the limit is reached, so the final amount can exceed the threshold.

Codex Security keeps available results when a cost-limited scan stops.

A partial result should not be treated as complete repository coverage.

Add a Pre-Commit Security Check

Install the supplied Git hook:

npx @openai/codex-security install-hook

The hook scans staged and unstaged changes before a commit.

OpenAI says it blocks:

• High-severity findings.
• Scan errors.

It does not replace an existing pre-commit script.

Teams should review how the hook interacts with local performance, developer access, model cost, and existing lint or test hooks before enabling it across an organization.

Scan Multiple Repositories

Authenticate GitHub CLI first:

gh auth login

Start the interactive repository-discovery flow:

npx @openai/codex-security bulk-scan

The current interactive flow excludes archived repositories and forks and asks for confirmation before scanning.

Use a prepared CSV inventory for a repeatable campaign:

npx @openai/codex-security bulk-scan repositories.csv \
  --output-dir /path/outside/repositories/security-scans \
  --workers 4

Running the same command again can resume the campaign without rescanning repositories that already have intact result artifacts.

Run Bulk Scans in Docker

The public repository includes Docker and Compose resources.

Where account access includes the required image and environment, an example bulk command is:

docker compose run --rm codex-security \
  bulk-scan /input/repositories.csv \
  --output-dir /output \
  --workers 4

OpenAI recommends:

• A Linux Docker host.
• Unprivileged user-namespace support.
• Private persistent directories for results and sign-in state.
• Secrets supplied through the environment or a secret manager.
• Optional AppArmor hardening where supported.

Containerization limits some host exposure. It does not make an authorized security scan risk-free.

Track Findings Across Runs

List previous scans for a repository:

npx @openai/codex-security scans list "$REPOSITORY"

Inspect a saved scan:

npx @openai/codex-security scans show SCAN_ID

Mark a reviewed occurrence as a false positive:

npx @openai/codex-security findings false-positive FINDING_OCCURRENCE_ID \
  --reason "The route already checks permissions"

Rerun a saved scan with its original configuration:

npx @openai/codex-security scans rerun SCAN_ID

Match findings by root cause:

npx @openai/codex-security scans match PREVIOUS_SCAN_ID CURRENT_SCAN_ID

Compare the scans:

npx @openai/codex-security scans compare PREVIOUS_SCAN_ID CURRENT_SCAN_ID

The comparison can classify findings as:

• New.
• Persisting.
• Reopened.
• Resolved.
• Unknown.

A missing finding remains unknown when the later scan did not cover the relevant area.

Use the TypeScript SDK

The same npm package includes an ECMAScript-module TypeScript SDK.

It requires server-side Node.js 22 or later, and scanning also requires Python 3.10 or later.

A basic integration looks like this:

import { CodexSecurity } from "@openai/codex-security";

const security = new CodexSecurity();

try {
  const result = await security.run("/path/to/repository", {
    outputDir: "/path/outside/repository/results",
  });

  console.log(result.reportPath);
  console.log(result.coverage.completeness);
  console.log(result.findings.findings.length);
} finally {
  await security.close();
}

The SDK supports longer-running workflows through features such as:

• Preflight checks.
• Typed findings.
• Coverage details.
• Progress callbacks.
• Estimated cost limits.
• Cancellation.
• Scan lifecycle management.
• Access to artifact paths.

A reusable application should create a client, run the required scans, and close the client to release the isolated runtime.

Add Codex Security to CI

OpenAI’s official CI guide demonstrates pull-request scanning with GitHub Actions.

The recommended pattern is:

1. Store an API key as a protected repository or organization secret.
2. Install Codex Security outside the repository checkout.
3. Pin the package version.
4. Check out full Git history without persisting checkout credentials.
5. Calculate the merge base.
6. Scan only the pull-request diff.
7. Export SARIF.
8. Upload SARIF to GitHub Code Scanning.
9. Preserve scan artifacts.
10. Add a severity policy only after reviewing scan quality and runtime.

The official example pins a specific package version available at publication time. Teams should update that version deliberately after reviewing release notes rather than automatically running unreviewed security tooling with repository secrets.

A compact representation of the core scan step is:

- name: Scan pull-request changes
  env:
    OPENAI_API_KEY: ${{ secrets.CODEX_SECURITY_API_KEY }}
    BASE_SHA: ${{ github.event.pull_request.base.sha }}
    HEAD_SHA: ${{ github.event.pull_request.head.sha }}
    SCAN_DIR: ${{ runner.temp }}/codex-security-results
  run: |
    set -euo pipefail
    BASE_REVISION="$(git merge-base "$BASE_SHA" "$HEAD_SHA")"

    "$CODEX_SECURITY_BIN" scan . \
      --diff "$BASE_REVISION" \
      --head "$HEAD_SHA" \
      --auth api-key \
      --output-dir "$SCAN_DIR" \
      --json > "$RUNNER_TEMP/codex-security.json"

This excerpt assumes the runner has already installed and verified the CLI, checked out the pull-request head with full history, and defined CODEX_SECURITY_BIN.

Use the complete official CI guide for a production workflow, including pinned actions, SARIF export, permissions, artifact retention, and fork-safety checks.

Where Codex Security Fits in a Security Program

Codex Security is not a replacement for every existing security control.

It can complement:

• Static application security testing.
• Software composition analysis.
• Secret scanning.
• Infrastructure-as-code scanning.
• Container scanning.
• Dependency updates.
• Fuzzing.
• Dynamic application testing.
• Manual code review.
• Penetration testing.
• Bug bounty programs.
• Production monitoring.

Its distinctive strength is contextual reasoning across repository structure and system intent.

A mature program can use deterministic scanners for high-volume known patterns and an agentic scanner for cross-file logic, exploitability analysis, evidence, and remediation.

What Codex Security Does Not Guarantee

It Cannot Prove That a Repository Is Secure

No scanner can establish the absence of all vulnerabilities in an arbitrary real-world codebase.

Partial or unknown coverage makes that limitation even more important.

Validation Is Not Universal

Some findings can be tested in an isolated environment.

Others depend on:

• Production data.
• External services.
• Infrastructure configuration.
• Hardware.
• Credentials.
• Business logic.
• User behavior.

A finding without an automated proof is not automatically false, and a validated proof does not reveal every variant of the bug.

AI Findings Still Need Human Review

A model can misunderstand architecture, overestimate impact, propose an incomplete patch, or introduce a regression.

Security owners should review evidence and fixes.

The Open-Source Package Still Calls Models

The package source is public, but the default scan is not a fully local static binary operating without inference access.

Model usage can create cost, data-handling, and authorization considerations.

Sensitive Output Needs Protection

The results directory may be more sensitive than ordinary build output.

Do not upload detailed findings, proof-of-concept files, or vulnerable source excerpts to public artifacts.

Cyber Access Is Purpose-Limited

Use the tool only on repositories and systems you own or have explicit permission to assess.

OpenAI’s access controls do not replace legal authorization.

The Security Scanner Also Needs a Threat Model

Codex Security’s biggest conceptual advantage is also a practical requirement.

The agent needs accurate context.

A repository alone may not explain:

• Which service is publicly reachable.
• Which identity provider is trusted.
• Whether a network boundary exists.
• Which data is sensitive.
• Which authorization check is performed upstream.
• Which deployment feature is disabled.
• Which risk the organization has accepted.

Poor context can create poor findings.

Teams should treat the editable threat model and knowledge base as first-class security assets, not optional prompt decoration.

常见问题

What is Codex Security?

Codex Security is OpenAI’s application-security agent for finding, validating, prioritizing, and helping fix vulnerabilities. It evolved from the internal project Aardvark and is available through a plugin, CLI, TypeScript SDK, and connected-repository cloud workflow.

Is Codex Security fully open source?

The CLI and TypeScript SDK are public on GitHub under Apache 2.0. The underlying OpenAI models, hosted cloud service, protected findings, and unrestricted cybersecurity access are not released as open-source or open-weight components.

Can anyone install and run Codex Security?

Anyone can access the public package, but running scans requires Codex Security access. Some full-repository scans or advanced cyber capabilities may also require Trusted Access for Cyber.

Which model does Codex Security use?

The current CLI documentation says scans default to GPT-5.6 Sol with xhigh reasoning effort. Users can select another supported model and effort level, and the public repository also documents selected third-party provider configurations.

Can Codex Security scan a pull request?

Yes. The CLI can scan committed changes between a base revision and a head revision, making it suitable for pull-request workflows. OpenAI also provides an official GitHub Actions guide with SARIF export and artifact preservation.

Does Codex Security automatically fix vulnerabilities?

It can propose bounded fixes and help verify whether a change resolves a finding. Scans are report-only by default, and humans should review, test, and approve patches before merging or deployment.

Can Codex Security run in Docker?

The repository includes Docker and Docker Compose resources for noninteractive bulk scans. OpenAI recommends private persistent storage, secret management, supported Linux isolation features, and optional AppArmor hardening.

Does a clean Codex Security report prove my application is safe?

No. Coverage may be complete, partial, or unknown, and no automated scanner can guarantee that a complex application contains no vulnerabilities. Use Codex Security as one layer in a broader secure-development program.

相关工具

• Codex Security: Official overview of the plugin, CLI, SDK, cloud scanner, and supported workflows.
• Codex Security GitHub Repository: Apache-2.0 source code for the CLI, TypeScript SDK, Docker resources, and contribution workflow.
• Codex Security on npm: The published package used to install the CLI and SDK.
• Codex CLI: OpenAI’s open-source local coding agent and plugin host.
• GitHub Code Scanning: GitHub’s SARIF-compatible vulnerability-results interface.
• CodeQL: GitHub’s semantic code-analysis engine for query-based vulnerability detection.
• Semgrep: A rule-based static-analysis platform that can complement agentic security reviews.
• OWASP Juice Shop: A deliberately vulnerable application for authorized security training and scanner evaluation.

Related Links

• Codex Security Documentation: The official starting point for the product’s interfaces and workflows.
• Codex Security CLI Quickstart: Official installation, authentication, scan, history, budget, bulk, and Docker instructions.
• Codex Security TypeScript SDK: Official SDK setup, scan lifecycle, typed-result, progress, and cancellation documentation.
• Run Codex Security in CI: OpenAI’s complete GitHub Actions and SARIF workflow.
• Codex Security Research Preview: OpenAI’s March 2026 launch article and preview metrics.
• Introducing Aardvark: The original description of the agentic security researcher that became Codex Security.
• Daybreak Security Initiative: OpenAI’s June 2026 update on Codex Security scale, open-source security work, and defensive cyber tools.

Summary

OpenAI has open-sourced the Codex Security CLI and TypeScript SDK, giving developers a public, Apache-2.0 foundation for repository scans, change reviews, scan history, fix verification, bulk campaigns, SARIF export, CI checks, and custom security integrations.

The agent differs from a basic pattern scanner by building repository context and a threat model, searching for vulnerabilities in that context, validating plausible issues where possible, and proposing bounded fixes for human review.

The release is not an unrestricted local security model. Running scans still requires authorized inference access, and some advanced cybersecurity workflows may require Trusted Access for Cyber. Sensitive findings and source excerpts also need careful storage and retention controls.

Codex Security is most useful as part of a layered application-security program—not as proof that a repository is vulnerability-free.

The practical change is that security review can now move closer to the speed of AI-assisted development, provided teams keep authorization, threat modeling, validation, and human approval firmly inside the workflow.