OpenAI's Codex Security CLI goes open source, claims 3,000 critical bugs already fixed

OpenAI just made Codex Security CLI open source under an Apache 2.0 license, putting a tool that’s already helped squash more than 3,000 critical vulnerabilities directly into developers’ hands. You install it via npm, point it at a repo, and it’ll find, confirm, and even fix security holes — all from the command line. It also supports bulk scans, CI/CD integration, and comparing results across runs.

The release marks a formal debut for a project previously known internally as “Aardvark.” It launched as a research preview for ChatGPT Enterprise, Business, and Edu customers back in March 2026, and by April, OpenAI says it had already hit that 3,000-fix milestone. The beta currently requires Node.js 22 and Python 3.10 or higher.

This puts OpenAI on a direct collision course with Anthropic, whose Claude Security product does essentially the same thing. Both companies recognize the same uncomfortable math: AI is arming attackers with more automated tooling, so defenders need automated assistance that’s equally fast and accessible. The open-source approach is a smart play here — it gets the tool into as many pipelines as possible and builds community trust around how the scans actually work.

I’m curious how thorough the fixes really are in edge cases. A CLI tool that patches code automatically sounds great until it introduces a logic error that passes tests but opens a subtler hole. The documentation covers commands and output formats, but the real test will be what happens when security researchers start stress-testing this against deliberately tricky codebases.