OpenAI Launches Open-Source Codex Security CLI to Uncover Vulnerabilities in CI
On July 29, OpenAI introduced a specialized security scanning tool for code repositories. Named Codex Security CLI, this open-source command-line utility is designed to help developers scan codebases, detect and verify security vulnerabilities, and seamlessly integrate these checks into continuous integration and continuous delivery (CI/CD) pipelines.
Notably, the tool was identified prior to its official launch. OpenAI describes it as an early-stage release, with plans to enhance its capabilities based on user feedback. Featuring a command-line interface and a TypeScript SDK, the tool allows developers to scan repositories directly from the terminal, review code modifications, monitor security issues across execution cycles, and confirm whether vulnerabilities have been resolved.

When integrated into CI/CD workflows, actively developed software projects can automatically execute security checks with every build, mitigating potential risks before code merges. The setup is straightforward: developers can install the @openai/codex-security package via npm, use the npx command to access help documentation, log in, and scan the current directory step by step to reveal the repository's security status.
Before execution, the system requires Node.js 22 or higher, Python 3.10 or higher, and appropriate access permissions for Codex Security. In CI environments, manual login is unnecessary; simply setting the OPENAI_API_KEY environment variable enables automatic authentication. The tool supports both ChatGPT account login and API key authentication, with parameters specifying the preferred method. For TypeScript projects, the official SDK provides an interface to retrieve the report path after scanning.
Each scan's trace is stored in the Codex Security working directory. If the default path is unwritable, developers can use the CODEX_SECURITY_STATE_DIR variable to specify an alternative directory. The code is now available on GitHub at openai/codex-security, accessible to anyone seeking to perform a code health check. By shifting security checks from manual spot inspections to a single command-line instruction, the most vulnerable defense line in the software supply chain is being proactively strengthened.
Related article
Data Center Boom Fuels US Grid Innovation
The rapid expansion of artificial intelligence has triggered a massive spike in national energy consumption. While critics argue this surge is straining the nation’s aging electrical infrastructure, concerns persist that short-term power shortages co
Anthropic Hits $1.5B Copyright Deal to Compensate 500,000 Works
On Monday, a U.S. federal court granted final approval for a $1.5 billion class-action settlement between Anthropic and a coalition of authors and publishers, as reported by Reuters. The deal resolves ongoing litigation regarding Anthropic’s alleged
WeChat WeMM-Embedding Powers Moments Search and Video Highlights With 1 Billion Daily Calls
On September 4, WeChat AI announced the open-source release of its general multimodal embedding model, WeMM-Embedding. Available in 2B, 4B, and 9B versions, the model supports text, images, videos, visual documents, and any interleaved multimodal inp
Related Special Topic Recommendations
Comments (0)
0/500
On July 29, OpenAI introduced a specialized security scanning tool for code repositories. Named Codex Security CLI, this open-source command-line utility is designed to help developers scan codebases, detect and verify security vulnerabilities, and seamlessly integrate these checks into continuous integration and continuous delivery (CI/CD) pipelines.
Notably, the tool was identified prior to its official launch. OpenAI describes it as an early-stage release, with plans to enhance its capabilities based on user feedback. Featuring a command-line interface and a TypeScript SDK, the tool allows developers to scan repositories directly from the terminal, review code modifications, monitor security issues across execution cycles, and confirm whether vulnerabilities have been resolved.

When integrated into CI/CD workflows, actively developed software projects can automatically execute security checks with every build, mitigating potential risks before code merges. The setup is straightforward: developers can install the @openai/codex-security package via npm, use the npx command to access help documentation, log in, and scan the current directory step by step to reveal the repository's security status.
Before execution, the system requires Node.js 22 or higher, Python 3.10 or higher, and appropriate access permissions for Codex Security. In CI environments, manual login is unnecessary; simply setting the OPENAI_API_KEY environment variable enables automatic authentication. The tool supports both ChatGPT account login and API key authentication, with parameters specifying the preferred method. For TypeScript projects, the official SDK provides an interface to retrieve the report path after scanning.
Each scan's trace is stored in the Codex Security working directory. If the default path is unwritable, developers can use the CODEX_SECURITY_STATE_DIR variable to specify an alternative directory. The code is now available on GitHub at openai/codex-security, accessible to anyone seeking to perform a code health check. By shifting security checks from manual spot inspections to a single command-line instruction, the most vulnerable defense line in the software supply chain is being proactively strengthened.
Data Center Boom Fuels US Grid Innovation
The rapid expansion of artificial intelligence has triggered a massive spike in national energy consumption. While critics argue this surge is straining the nation’s aging electrical infrastructure, concerns persist that short-term power shortages co
Anthropic Hits $1.5B Copyright Deal to Compensate 500,000 Works
On Monday, a U.S. federal court granted final approval for a $1.5 billion class-action settlement between Anthropic and a coalition of authors and publishers, as reported by Reuters. The deal resolves ongoing litigation regarding Anthropic’s alleged
WeChat WeMM-Embedding Powers Moments Search and Video Highlights With 1 Billion Daily Calls
On September 4, WeChat AI announced the open-source release of its general multimodal embedding model, WeMM-Embedding. Available in 2B, 4B, and 9B versions, the model supports text, images, videos, visual documents, and any interleaved multimodal inp





Home






