OpenAI followed up quietly, but with intent: an early, open-source version of the Codex Security CLI is here. The command-line tool scans repositories you own or have permission to assess, looking for vulnerabilities — finding them, confirming them, and helping you fix them. OpenAI itself calls it an early release and is asking for feedback as it keeps improving.
What the CLI does
The feature set reads like a wishlist for everyday work. The CLI discovers GitHub repositories, can resume bulk scans, and tracks findings across multiple runs — including feedback on false positives. You can add your own architecture and security policies, set a cost limit, and hook checks straight into your CI pipeline or run them before every commit. In other words, right where they do the most good: before code reaches the main branch.
The numbers from the beta
The interesting part is what OpenAI says about the quality of the findings. Over the course of the beta, precision was sharpened significantly: noise dropped by 84 percent, over-reported severity by more than 90 percent, and false-positive rates by more than 50 percent — across all repositories tested.
Anyone who’s used a security scanner that screams «critical» at every other finding knows why this matters. A tool that constantly cries wolf gets ignored eventually. That’s really the headline here.
Codex Security itself is running in parallel as a research preview for ChatGPT customers on the Pro, Enterprise, Business and Edu plans — via Codex web, free to use for the first month.
My take
For us at clauding.de this is exciting for two reasons. First: security scanning keeps moving deeper into the normal developer workflow — no longer a separate audit at the end, but a check on every commit. Second: the trend of open-sourcing tools like this is notable — especially in a week when the industry is fighting hard over open weights.
I’ll stay realistic: «open source» doesn’t automatically mean «better» or «safer». But a tool you can inspect, adapt and wire into your own pipeline yourself beats a black box a thousand times over. Worth a try.
Sources: