OpenAI Ships Codex Security: Your Repo's New Paranoid Intern
What happened
OpenAI quietly dropped `codex-security`, a CLI and TypeScript SDK built on Codex that scans repos, reviews changes, and tracks vulnerability findings — with the ability to actually fix what it finds, not just flag it. It plugs into CI via `OPENAI_API_KEY` or ChatGPT login, requiring Node 22+ and Python 3.10+.
Why this matters
Security scanning has long been the domain of specialized tools like Snyk, Semgrep, and GitHub's own Advanced Security suite. OpenAI entering that lane signals it wants Codex to be the connective tissue across the entire dev lifecycle — not just writing code, but auditing and patching it too.
The slightly cynical read
An AI company shipping a tool to catch vulnerabilities in AI-generated code is either delightfully self-aware or a tacit admission that Codex-written code needs its own immune system. Either way, it's a smart wedge to keep developers inside OpenAI's tooling stack instead of wandering off to competitors.
What to watch next
Watch whether GitHub (Microsoft-owned, and already selling Advanced Security) treats this as competition or quietly integrates it, and whether independent benchmarks show Codex Security actually catching what specialized scanners miss.