36氪|OpenAI has gone open source

OpenAI's Code Security Artifact Is Now Open-Sourced

　　The "protagonist" of this open-source release is codex-security, consisting of a CLI and a TypeScript SDK.

　　Its core functionality is very straightforward, featuring a full set of combined capabilities: automatically detecting, verifying and fixing vulnerabilities in code repositories.

　　It is designed to be out-of-the-box, and the entire process can be completed with only three lines of commands:

1. npm install @openai/codex-security
2. npx codex-security login
3. npx codex-security scan .

　　For CI runs, no login is required, you only need to configure an OPENAI_API_KEY.

　　The requirements are Node.js 22 or above, Python 3.10 or above, plus access permission to Codex Security.

1.2 Million Commits, 792 Critical Vulnerabilities

　　Strictly speaking, Codex Security is not a "brand new species".

　　It was derived from Project Aardvark that was in private beta in October 2025, and was renamed and launched as a research preview on March 6 this year.

　　The most hardcore part of this tool is its positioning: an application security agent.

　　Codex Security will truly go deep into the underlying layer, read your code, and understand exactly what your system is doing. Its workflow is divided into three steps:

　　First, it reads the entire repository, generates an editable threat model, and clarifies what the project does and where it is most exposed;

　　Then it searches for vulnerabilities based on this context, and classifies them according to their real-world impact;

　　Finally, it puts the suspicious issues into a sandbox to conduct real stress tests, and will not report any issues that cannot be verified.

　　Judging from its track record, it is indeed very capable.

　　In the first 30 days after launch, it scanned more than 1.2 million commits, identifying 792 critical-level vulnerabilities and 10561 high-risk findings.

　　OpenAI also mentioned that when scanning the same batch of repositories repeatedly, the false positive rate dropped by more than 50%.

First Batch of Early Adopters Got Their Bills Blown Up

　　No matter how grand the official promises are, they cannot beat the "real-world testing tragedies" that emerged from developers immediately.

On HN, a developer named gregwebs tested it with a small repository, and directly posted a crash-inducing terminal log.

Preparation started at 0 minutes and 3 seconds, scanning began at 1 minute and 20 seconds, then the process ran all the way to 52 minutes and 47 seconds, finally popping up a line of red text — the repository HEAD changed during the scan, please restart the process.

Not only did the one-hour run go to waste, this single session also consumed half of his Pro plan's weekly quota.

　　Another user named Quai had it even worse: the scan hit account rate limits as soon as it started, and the tool retried for one minute before giving up.

　　The tool did prompt that "partial results have been retained", but he found no obvious way to resume using them in the next scan. This failed run cost him approximately 13 US dollars.

　　Why on earth is it so expensive? A look at the default configuration gives the answer immediately.

　　Codex Security calls gpt-5.6-sol by default, and cranks the "reasoning intensity" all the way up to extra-high.

　　It is worth noting that Sol is the most "premium" tier in the GPT-5.6 family, with its API price as high as $5 per 1M input tokens and $30 per 1M output tokens.

Jensen Huang Made the First Move, OpenAI Took the Next Step

　　Right after Jensen Huang publicly voiced his support for open-source AI, OpenAI launched Codex Security immediately after.

　　However, don't overestimate the extent of this "open source" move.

　　OpenAI's step is very shrewd: what is open-sourced is the shell of the application layer, while the model layer is still firmly held in its own hands.

　　In any case, the magic box where agents take over code security has been opened.

　　Next, it remains to be seen how developers will heavily modify this open-source artifact, using the power of the community to beat the magic of OpenAI.