# Codex Security [[OpenAI]]'s open-source CLI and TypeScript SDK for automated code security scanning, part of the [[OpenAI Codex]] family. Apache-2.0, published as `@openai/codex-security` at github.com/openai/codex-security. It runs locally, sends your code to OpenAI's hosted models for analysis, and uses [[GPT-5.6]] Sol to do the reasoning. Built, in the creator's words, for running security across many repos over time. ## It was Aardvark first This is not a new product, which changes how you should read it. Codex Security was internally called **Aardvark** and shipped in **March 2026** as a research preview for ChatGPT Enterprise, Business and Edu customers. By April 2026, OpenAI reported it had helped fix **more than 3,000 critical vulnerabilities**. So the July release is not a launch. It is an existing enterprise system getting an open-source client and a wider (still gated) door. ## Released by accident, more or less The repository went up quietly with no announcement. [[Hacker News]] found it anyway and pushed it to 560 points before OpenAI said anything. Their eventual post on 29 July opens: > We quietly released the open-source Codex Security CLI, but Hacker News found it before we had a chance to share it here... Worth holding on to when reading the complaints below. Much of the early feedback came from people using an unannounced early release that had no onboarding, no guidance, and no cost warnings, because none had been written yet. ## What it ships - **13 pre-built security skills** that guide the model's analysis - **Org-wide scanning** across many repositories - **Historical results**, so findings persist and can be compared between runs - **Fix verification**, checking whether a patch actually closed the finding - **Deduplication** and false-positive tracking - **Budget controls** via `--max-cost` - **CI integration** Requirements: Node.js 22+, Python 3.10+, installed via npm. Authenticate with `npx codex-security login` (ChatGPT sign-in) or `OPENAI_API_KEY` for CI. Scan with `npx codex-security scan .`. The genuinely valuable part is that **the prompts and security skills are open-sourced**. Several commenters made the point that those represent billions of tokens of optimization work, handed over for free. Whatever you think of the tool, the skills are worth reading. See [[AI Agent Skills]]. ## Open source, gated service The distinction that matters most, and the one the headlines blur. **The client is open source. The capability is not.** Apache-2.0 covers the CLI, the SDK, and the security skills. Running a scan requires active Codex Security service access, which is still a permissioned beta. You can read every prompt and run nothing. That is a reasonable position for a tool that finds exploitable vulnerabilities at scale. It is just not what "OpenAI open-sources its security scanner" implies, and it explains why some people bounced off it immediately while others were mid-scan burning credits. ## The problem: it burns money This dominated the [[Hacker News]] thread (560 points, 206 comments), and the reports are not marginal: - 25% of a week's Pro credits (~$13) consumed by a **42-minute scan that did not complete** - One user described burning "5 years worth of Pro usage in 5 minutes" - Another spent $100+ **with `--max-cost` set**, and saw the limit exceeded anyway - Repeated accounts of 30 to 50 minute scans that failed or refused to produce output Compounding it: scans run silently with no progress feedback, and a failed scan **does not resume**. You pay again from the start. A budget control that does not actually bound the budget is worse than no budget control, because it invites you to walk away. ## The problem that matters more: it refuses to explain The sharpest criticism in the thread, and it is a real structural bind: **The tool finds a vulnerability, then refuses to describe it, because the model's safety guardrails treat vulnerability explanation as dangerous content.** To get fewer refusals you have to apply for OpenAI's **Trusted Access for Cyber** program (TAC1 / Daybreak). One maintainer reported applying twice to the OSS program with no response. So the default experience for an open-source maintainer is: pay real money, wait 40 minutes, get told there is a vulnerability, and get told nothing about what it is. This is the alignment tax made concrete. A security scanner whose entire purpose is explaining vulnerabilities is running on a model trained not to explain vulnerabilities, and the resolution is an access allowlist rather than a technical fix. ## Compare: the Claude Security plugin Worth putting side by side with [[Claude Code Security Review]], since Anthropic shipped its Claude Security plugin beta six days earlier. | | Codex Security | Claude Security plugin | |---|---|---| | Released | Quietly ~28 July 2026 (as Aardvark, March 2026) | 22 July 2026, beta | | Open source | Client + prompts + skills, Apache-2.0. Service is gated | No | | Model | [[GPT-5.6]] Sol, hosted | Claude, on inference you already run | | Scope | Org-wide, many repos, historical | Pre-commit and full-codebase | | Refusals | Significant, gated behind TAC1 access | Not reported as an issue | | Cost reports | Severe overruns, caps not respected | Runs on existing plan | Different bets. OpenAI built the org-scale tool and opened the prompts. Anthropic built the developer-loop tool and kept it closed. Right now the org-scale one is the one people cannot afford to run. Also note the shape difference: Codex Security scans repos periodically, while the Claude plugin scans at commit time. Pre-commit is the cheaper moment to fix something, which is the same upstream argument running through [[Loop Engineering]]. ## My take The open-sourced skills are the durable contribution here. Tools get replaced; a well-optimized prompt library for 13 vulnerability classes is a reusable artifact, and several commenters immediately discussed pointing it at cheaper endpoints. But as a product, this is a good demonstration of a pattern worth watching: agentic tools where **cost is unbounded in practice and the vendor's own safety layer fights the tool's purpose**. Neither problem is fixable by prompt engineering. One needs real budget enforcement in the harness, the other needs a policy decision at OpenAI. I would also weight the criticism down somewhat, having learned the release was unannounced. Judging an early build that its own vendor had not finished documenting is not quite fair, and OpenAI's response ("this is an early release, and we're listening") is the right one. The Aardvark record of 3,000+ fixed vulnerabilities suggests the underlying system works when someone else is paying for it. If you want to try it, run it on one small repo with a hard external spend limit, not on an org. ## Caveats - All cost figures are user reports from one thread, not measured benchmarks - The tool is days old and was released without announcement. Budget enforcement and resumability are the kind of thing that gets fixed fast once a team knows people are watching - The 3,000+ vulnerabilities figure is OpenAI-published and covers the Aardvark enterprise preview, not the open CLI - Scanning repos you do not own was raised and left unresolved in the thread. The docs say owned or authorized repositories ## References - Repository (Apache-2.0): https://github.com/openai/codex-security - [[Hacker News]] discussion (560 points, 206 comments): https://news.ycombinator.com/item?id=49089755 - OpenAI acknowledging the accidental release (2026-07-29): https://x.com/OpenAI/status/2082263717916586117 - OpenAI developer community announcement: https://community.openai.com/t/introducing-the-open-source-codex-security-cli/1388319 - The Decoder coverage, including the Aardvark history: https://the-decoder.com/openai-open-sources-codex-security-cli-to-help-developers-find-and-fix-vulnerabilities-from-the-command-line/ - Cybersecurity News coverage: https://cybersecuritynews.com/openai-open-sources-codex-security-cli/ - GBHackers coverage: https://gbhackers.com/openai-open-sources-codex-security-cli-to-find-vulnerabilities/ ## Related - [[2026-07-29 OpenAI Open-Sourced Its Security Scanner]] - [[OpenAI Codex]] - [[Codex CLI]] - [[OpenAI]] - [[GPT-5.6]] - [[Claude Code Security Review]] - [[AI Agent Skills]] - [[Prompt injection]] - [[Loop Engineering]] - [[Hacker News]]