July 28, 2026
Security scan or security scam?
OpenAI just open-sourced Codex Security
OpenAI dropped a free code safety tool, and users instantly hit errors and side-eye
TLDR: OpenAI released Codex Security, a free tool that scans code you own for security problems and can plug into automated checks. The comments quickly split between hype and frustration, with users reporting login blocks, permission confusion, and spicy predictions that rivals like Snyk should be nervous.
OpenAI has tossed Codex Security into the open-source arena: a free command-line tool and software kit meant to scan code for security problems, double-check suspicious findings, and even suggest fixes. On paper, it sounds like a dream for developers who want an extra set of eyes on their code before it ships. It works on Mac, Linux, and Windows, plugs into automated workflows, and can block risky code before a commit. Very slick. Very serious. Very “the robots are reviewing your homework now.”
But the real show was in the comments, where the launch immediately turned into a mini drama festival. One early reaction was the digital equivalent of showing up to a party and finding the door locked: “Just getting auth issues so far...” Others were even more irritated, complaining they got repeated “you are trying to do stuff we don’t allow” messages and asking the obvious question: what exactly is this allowed to scan, and how does it decide what you own? That uncertainty became the thread’s biggest tension point.
Then came the market-war angle. One commenter wondered whether tools like this could put Snyk out of business, while another shrugged and basically called the whole thing a fancy wrapper around OpenAI’s existing models, albeit with some extra substance hidden in the repo. And because no launch is complete without a cage match fantasy, someone demanded a head-to-head with Strix. In other words: part excitement, part skepticism, part “fight! fight! fight!”
Key Points
- •Codex Security is presented as an open-source CLI and TypeScript SDK for finding, validating, and reviewing security issues in code the user owns or is authorized to assess.
- •The tool supports macOS, Linux, and Windows, requires Node.js 22 or later, and needs Python 3.10 or later for scanning and exporting findings.
- •Users must authenticate with an OpenAI account or API key, with support for device auth, stored sign-in, environment variables, and CI workflows.
- •The scan command supports options including model selection, path filtering, knowledge-base inputs, diff scanning, dry runs, severity thresholds, JSON output, and external output directories.
- •Codex Security also provides commands for Git hook installation, bulk scanning, scan history management, result comparison, exporting findings to SARIF/CSV/JSON, validating findings, and generating patches.