OpenAI Open-Sourced a CLI That Finds and Fixes Security Bugs in Your Code
OpenAI just shipped Codex Security — a free, open-source CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in your codebase. It's available right now on GitHub, and you can be scanning a repo within a couple of minutes of installing it.
Here's what it actually does, and why it matters.
What Codex Security Does
The pitch is simple: point it at a repo, and it finds real security problems — not just pattern-matched lint warnings.
npm install @openai/codex-security
npx @openai/codex-security scan .
That one command scans your codebase, flags vulnerabilities, and — this is the part that matters — validates them before reporting. It's built to cut down on the noise that makes most static-analysis tools exhausting to use: fewer false positives, more findings you can actually act on.
It also runs in CI, tracks findings over time so you can see whether your security posture is improving, and reviews diffs so it can catch a new vulnerability the moment it's introduced in a pull request — not three months later during an audit.
Why "Validated" Is the Key Word
Traditional static analysis tools are notorious for crying wolf. They flag hundreds of "possible" issues, most of which are dead code paths, sanitized inputs, or just noise — and developers learn to ignore the tool entirely.
Codex Security is built around an agent that doesn't just pattern-match for risky code. It reasons about whether a flagged issue is actually exploitable, and can propose a fix rather than just a warning. That's a meaningfully different workflow: instead of a report you have to triage, you get findings you can trust and act on directly.
You can even tune how much reasoning effort it spends per scan:
npx @openai/codex-security scan . --model gpt-5.6-terra --effort high
Free to Run, But Built for the OpenAI Ecosystem
The CLI itself is open source under the @openai/codex-security package, and there's a TypeScript SDK if you want to wire scanning directly into your own tooling:
import { CodexSecurity } from "@openai/codex-security";
const security = new CodexSecurity();
const result = await security.run(".");
console.log(result.reportPath);
It works with either a ChatGPT sign-in or an OPENAI_API_KEY for CI environments — so a solo developer and a CI pipeline can both use it without friction.
Part of a Bigger Trend: Security as an Agent Task
This isn't happening in isolation. Security scanning, code review, dependency auditing — these used to be jobs for specialized, narrow tools that ran on fixed rules. Increasingly, they're becoming just another task an agent can pick up, because an agent can read the surrounding code, understand intent, and reason about exploitability in a way a rules engine never could.
That's the same shift that's playing out across the entire developer toolchain right now: agents aren't just autocomplete anymore. They're reviewing your diffs, running your tests, and now, auditing your security posture — continuously, not just once a quarter.
What This Means If You Use OpenClaw
OpenClaw is built on exactly this premise: an agent isn't useful because it can chat, it's useful because it can do things — run tools, complete multi-step tasks, and keep working on your behalf without you babysitting every step.
Codex Security is a great example of what that looks like applied to one specific job: instead of you manually running a linter and reading through a wall of warnings, an agent scans, validates, and hands you fixes. That's the same pattern OpenClaw applies more broadly — connect a tool, give your agent a task, and let it actually finish the work instead of just suggesting what you should do next.
If tools like this are becoming the new baseline for how software gets built and secured, the agents orchestrating them are worth understanding now, not later.