Codex Security CLI

The Codex Security CLI is an open-source command-line scanner from OpenAI that walks a Git repository, reports vulnerabilities, keeps state on those findings between runs, and checks whether a fix actually closed the issue it claimed to close. OpenAI open-sourced it and announced it from its own X account on July 29, 2026; it reached the Hacker News front page the same day. It is early access, and OpenAI has asked for feedback on it rather than presenting it as a settled product.

The design target is a pipeline, not a laptop. Most free scanners hand you a wall of findings on every run with no memory of the last one, which is how mute lists end up longer than finding lists. Tracking state across runs turns a scan into a diff — what is new since the last commit, what you already triaged, what a patch was supposed to resolve — and the fix-verification step is what makes it usable as a CI gate instead of a report you skim. The other half of the pitch is model-based analysis: a rule-based tool needs someone to hand-write a taint rule before it can follow a dataflow across four files, and OpenAI has more observation of the failure modes its own generations produce than any third-party vendor does.

My read: the client being open matters and the judgment being closed matters more. You can read this scanner, fork it, pin it, and run it without signing anything, which is more than Snyk or Veracode ever offered. But the model that decides whether a finding is critical or noise is not open, and neither is the eval set that defined "vulnerability" in the first place. There is also no published study measuring whether a same-family generator and auditor share blind spots, which is the load-bearing question when Codex writes the code and a Codex-branded tool grades it. Run it, and keep one scanner in the pipeline that OpenAI did not write.