# Codex Security

> OpenAI vulnerability finder and patcher

**Category:** AI Agents  
**Pricing:** open-source  
**URL:** https://developers.openai.com/codex/security  
**GitHub:** https://github.com/openai/codex-security  
**Added:** 2026-10-09

---

## The Hook

Codex Security is OpenAI’s scanner-as-an-agent: point `cs scan .` at a repo, it hunts for vulnerabilities, validates the candidates, and can draft patches — instead of handing you a wall of pattern matches.

## What's Good

Apache-2.0 (openai/codex-security), npm `@openai/codex-security` with `cs` / `codex-security` commands. Scans whole repos, selected paths, or Git changes; deep scans run parallel discovery workers. Validates findings, generates patches, verifies existing fixes, drafts SECURITY.md policies and threat models. Imports GitHub code-scanning alerts, exports SARIF/JSON/CSV, publishes to Linear, and runs in CI or containers. ★~11k.

## The Catch

The CLI is open source but the scanning is model calls: you sign in (`cs login`) or use an OpenAI API key in CI, so real scans cost usage — set the cost limits it documents. Needs Node 22.13+/24/26 plus Python 3.10+. Some scan tiers require separate Trusted Access for Cyber approval. Vs semgrep and trivy (deterministic rule/CVE scanners, free and fast): Codex Security is the slower LLM lane that reasons about and fixes findings — run it beside them, not instead.

## Verdict

Apache-2.0 agentic vuln scanner from OpenAI. Use when you want validated findings plus patches and accept paying for the model calls.