Codex Security Review: OpenAI's AI Vulnerability CLI

Key highlights:

• Repo: [openai/codex-security](https://github.com/openai/codex-security) — Apache-2.0, TypeScript, ~10,065 stars and 718 forks as of August 22, 2026. Created July 13, 2026; first npm publish July 28.

• Package: `@openai/codex-security`, currently v0.1.16 — 17 releases in under four weeks.

• Requirements: Node.js 22.13+ (22.x line), 24.x, or 26.x, plus Python 3.10+ for scans, exports, and saved findings.

• Not a linter. It's an agent harness: it reasons about code in context, validates its own findings, and can write and verify the patch.

• Not offline. Your source code goes to a hosted model. There is no local-inference path that OpenAI officially supports (yet).

Most static analysis works on pattern matching. Semgrep, CodeQL, and the SAST layer inside Snyk all encode "this shape of code is dangerous" as rules, then match those rules against an AST. That approach is fast, deterministic, and reproducible, which is exactly why it drowns teams in false positives: a rule can see that user input reaches a SQL string, but it can't see that three frames up the call stack a middleware already validated and escaped it.

Codex Security runs a model over your repository instead. It reads code the way a human security reviewer would — following data flow across files, reasoning about what the application is for, and asking whether a given path is actually reachable by an attacker. When it produces a finding, it has already tried to talk itself out of it.

The workflow has four stages that map onto four CLI verbs:

First, the release mechanics were bizarre in a way developers love. An Apache-2.0 repo from OpenAI appearing with no marketing is catnip for Hacker News.

Second, the person who eventually showed up has credibility. Michael D'Angelo — co-founder of [Promptfoo](https://www.promptfoo.dev/), the LLM eval framework — posted as dangelosaurus: "Michael here, co-founder of Promptfoo and one of the people working on the Codex Security CLI at OpenAI." Promptfoo was acquired, and its team's DNA is visible in the release: the repo ships the actual TypeScript skill definitions that tell the model how to hunt for vulnerabilities, and D'Angelo described spending "billions of tokens" of evals tuning those prompts.

Third, AI-written code created the demand. Teams are merging far more code than they can review. A scanner that reasons instead of pattern-matching is the obvious response — which is also why the most-upvoted cynical comment in the thread landed: "security tools from AI companies feel like fire departments run by arsonists. useful, sure, but you can't help noticing who benefits from all the fires."

For a tool from OpenAI, the provider story is unusually open. The CLI supports third-party inference:

npx @openai/codex-security scan . --provider openrouter --model anthropic/claude-sonnet-4.5

npx @openai/codex-security scan . --provider fireworks --model accounts/fireworks/models/qwen3-235b-a22b

This is a condensed version. The full article includes architecture diagrams, code examples, comparison tables, and practical use cases.

👉 Read the complete analysis on andrew.ooo

Topics: codex-security, openai, ai-security, vulnerability-scanning, devsecops