What's this about?
OpenAI released a free, open-source command-line tool that uses its Codex coding agent to scan your code for security holes, check whether each finding is a real bug or a false alarm, and even write the patch to fix it. It used to be a closed plugin inside Codex; now it's a standalone Apache-2.0 project with extras for security teams — scanning every repo in an organization at once, tracking findings over time, and plugging into CI pipelines. Funnily, Hacker News found it on GitHub before OpenAI got to announce it.
What exactly is a "CLI + SDK for security scanning"?
A CLI (command-line interface) is a tool you run by typing a command in a terminal, e.g. `npx codex-security scan .` to scan the current folder. An SDK (software development kit) is the library version so developers can build the same scanning into their own tools. The novel part isn't scanning — plenty of tools flag suspicious code — it's that an AI agent then tries to *verify* each hit (does this vulnerability actually trigger?) to cut down false alarms, and drafts a fix, work that used to need a human security engineer.
What's the community saying?
- The zinger of the thread: "AI security tools feel like fire departments run by arsonists — useful, but you notice who benefits from all the fires." Skepticism that the company shipping powerful agents is also selling the defense.
- Cost shock: one user ran it on a small repo, it churned for nearly an hour, got interrupted, and drained half their weekly Pro-plan usage — people want predictable, bounded scans.
- Corporate blocker: does it upload your code to OpenAI's servers to analyze? For many companies that alone rules it out, and the docs weren't clear.
- Auth friction: several early testers just hit authentication errors; a Codex Security co-founder showed up in-thread to take feedback and promised fast iteration.