Codex Security CLI Quickstart: OpenAI's Open-Source AI White Hat in Three Commands

OpenAI opened up again — this time shipping Codex Security CLI, an application-security agent that crawls your codebase to find vulnerabilities → verify them → fix them. It is not a traditional static scanner: it reads the whole project the way a security engineer would, then goes to work. Best of all, three commands get it running.

The tool grew out of the Aardvark project that entered private beta in October 2025 (renamed and launched as a research preview on March 6, 2026). It lived as a closed-source security plugin inside Codex until now; this release stands it up as an open-source CLI plus TypeScript SDK, aimed squarely at teams and enterprise security automation.

Why It Deserves Attention

Start with the record: in its first 30 days it scanned over 1.2 million commits and surfaced 792 critical-severity and 10,561 high-severity findings; on rescans of the same repositories, the false-positive rate fell by more than 50%. The core selling point is verification — traditional tools bury you in noise, while Codex Security asks one more question: does this attack path actually exist? If it cannot verify the finding, it does not report it.

That emphasis on verification is what separates it from the scanner shelf. Every security team knows the ritual: a static analyzer returns four hundred findings, two are real, and triage burns a week before anyone trusts the tool again. An agent that refuses to report what it cannot exploit flips the economics — fewer findings, each one carrying evidence — and the falling false-positive rate across rescans suggests the model is learning each codebase’s actual attack surface rather than pattern-matching its way down a checklist.

How It Works: A Three-Step Workflow

Codex Security departs from static analysis (SAST) in three steps:

2. Threat modeling. It reads the entire repository and produces an editable threat model — what the project does, where it is most exposed (which surfaces accept user input, what cross-file risks hide between modules).

3. Finding and ranking vulnerabilities. Guided by the threat model’s context, it hunts for issues, ranks them by real-world impact, and explains what the problem is and why it matters.

4. Sandboxed verification and fixes. Suspect findings go into a sandbox for live exploitation testing. Confirmed paths get a generated fix patch — developers review and merge.

Why ship a standalone CLI instead of open-sourcing the Codex plugin? Because “code generation wants speed” and “security scanning wants depth” make opposite demands on resources and latency; jamming both into one tool would leave Codex slow and bloated. Splitting them keeps each clean — and gives security teams a tool they can schedule, gate, and audit independently of anyone’s coding session.

Ten-Minute Quickstart: The Key Commands

1. Requirements:

# Node.js 22+ and Python 3.10+
node -v   # v22.x or higher
python3 --version  # 3.10 or higher

2. Install (a few dozen MB):

npm install @openai/codex-security

3. Authenticate — login locally, API key in CI:

# Personal local use: ChatGPT login flow
npx codex-security login

# CI/CD: set the environment variable, no interactive login
export OPENAI_API_KEY="sk-..."

4. Run a scan:

# Run at the repo root; scan records persist automatically
npx codex-security scan .

5. Common configuration:

# If the current directory cannot hold state files, relocate them
export CODEX_SECURITY_STATE_DIR=/path/to/state
npx codex-security scan ./src

For CI, wire it into a workflow:

# .github/workflows/security.yml snippet
- run: npx codex-security scan . --ci
  env:
    OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

Practical Advice, Pitfalls Included

The tool is young and hungry, and early adopters have already mapped its edges. Four lessons from the first weeks:

• Know the cost profile. It defaults to gpt-5.6-sol — the most expensive GPT-5.6 tier, listed at $5/1M input and $30/1M output — with reasoning effort pinned at extra-high. One HN user reported an hour-long scan of a small repository eating half a Pro plan’s weekly quota; another spent about $13 on a rate-limited failed run. Start with a single directory or a small repo, review the bill, then scale up.

• Freeze the repo while scanning. A 52-minute scan failed and had to restart because “the repository HEAD changed.” Freeze the branch first, or scan a clean CI checkout.

• It is a team tool. Individual developers can keep using the Codex plugin; the CLI targets teams managing large repo estates and automated security pipelines. Don’t treat it as a personal toy.

• Human review still applies. The output is a “suggested patch” — run code review before merging. An AI white hat can still misread your business logic.

Resources

• GitHub: github.com/openai/codex-security (already past 1.2k stars)

• Official announcement: x.com/OpenAI/status/2082263717916586117

• Getting-started guide on the OpenAI site

It is also worth reading the release as a product-strategy signal. Security tooling has been one of the stickiest categories in developer infrastructure because the buyer — a security team with budget and a compliance mandate — differs from the user. An agent that reads the whole repository, reasons about real exploitability, and hands back reviewed patches attacks that category from the developer side, the same way AI code review did. If the verification-first approach holds up at scale, the checklist-style scanner market inherits the same commoditization pressure that hit every other static layer of the stack.

The one-line summary: install → login → scan . — three commands to put an AI security engineer inside your CI pipeline. The box on agents taking over code security is open; what developers do with it comes next.