OpenAI Open-Sources Codex Security CLI and SDK

OpenAI introduced Codex Security in research preview on March 6, 2026, positioning it as an application-security agent that builds a project-specific threat model, investigates attack paths, validates suspected flaws and proposes fixes for human review. The product matters because AI-assisted coding is increasing the volume and speed of software changes, while security review remains a bottleneck. Bringing that analysis closer to commits and deployment pipelines could help engineering and security teams catch higher-impact problems earlier and spend less time triaging routine scanner alerts.

On July 29, 2026, OpenAI released the source code for the Codex Security command-line interface and TypeScript SDK in the openai/codex-security repository under the Apache 2.0 license. The beta package, @openai/codex-security, can scan full repositories, code diffs and working-tree changes, accept architecture or security documents as context, and export structured findings for CI/CD. It requires Node.js 22 or later and Python 3.10 or later, while automated runs use an OpenAI API key. Access to the Codex Security cloud service is still required.