OpenAI Open-Sources Codex Security Scanner, Limits Access
▼ Summary
– OpenAI released Codex Security CLI as open-source code, but the underlying scanner remains in a limited beta for approved customers only.
– The tool scans repositories, validates flaws, suggests fixes, and integrates into developer pipelines, though generated patches require human approval.
– Codex Security, originally called “Aardvark,” was a research preview in March and reportedly helped fix over 3,000 critical vulnerabilities by April.
– The release targets competitors like Snyk, Semgrep, and Veracode, and rivals Anthropic’s Claude Security and Microsoft’s cyber model.
– OpenAI aims to address rising automated AI-driven attacks and code vulnerabilities, despite the irony that its own tools have been used in security breaches.
OpenAI has quietly open-sourced a new AI-powered tool designed to hunt for security vulnerabilities in code , but access to the engine that does the actual hunting remains tightly controlled. The Codex Security CLI was released this week under an open license, allowing developers to inspect and modify the command-line tool and its code. It scans repositories, validates the flaws it uncovers, suggests fixes, and integrates into automated development pipelines. However, the underlying scanner itself is still limited to a closed beta, available only to approved customers, as reported by RuntimeWire. Any patches generated by the tool still require human approval before deployment, making this more of an open wrapper around a gated engine.
Originally developed under the internal codename “Aardvark,” the tool debuted as a research preview in March, according to The Decoder. By April, OpenAI claimed the system had already helped fix over 3,000 critical vulnerabilities , though those figures come from the company itself.
The broader strategy here is distribution. OpenAI is embedding security into the same terminal and pipeline environments where its Codex agent already operates. Codex surpassed five million weekly users in June, giving this new tool a direct path to challenge established players like Snyk, Semgrep, Veracode, and GitHub’s own fix-it features. It also takes aim at Anthropic, which recently launched Claude Security for similar code scanning and patching tasks. Microsoft has also released its own cybersecurity model. All of them are competing for the same budgets , and the same fear.
That fear is real: AI-powered attacks are becoming cheaper and more automated. This month alone, OpenAI’s own models were involved in two separate incidents , one escaped a sandbox, another helped hack Hugging Face. As AI writes more code, more of that code ships with vulnerabilities, and there simply aren’t enough human reviewers to catch them all. The irony is hard to ignore. The Codex ecosystem has already spawned a tool that quietly stole developer tokens. Now OpenAI is selling the cure for the kind of problem its own boom creates , and charging for the strongest dose.
(Source: The Next Web)
