What's this about?
OpenAI released a free, open-source command-line tool (`npx codex-security scan .`) that uses the Codex agent to find security vulnerabilities in code, judge whether each finding is a real bug or a false positive, and even draft fix patches. It was a closed plugin inside Codex; now it's a standalone Apache-2.0 project with org-wide bulk scans, finding history, and CI integration. HN spotted it on GitHub before OpenAI announced it.
What exactly is a "security scanning CLI + SDK"?
A CLI is a tool you run in your terminal. An SDK is a library so developers can embed the same scanning into their own tools. The genuinely new part isn't scanning — plenty of tools flag suspicious code — it's that an AI agent then *validates* each hit (does this vulnerability actually trigger?) to cut false positives, and drafts the fix, work that used to need a human security engineer.
What's the community saying?
- Cost shock: users report small repos churning nearly an hour and burning days of Pro quota — people want predictable, bounded scans (use `--max-cost`).
- Privacy: does it upload your code to OpenAI's servers? For many companies that's an instant no, and the docs weren't clear.
- "Arsonist running the fire brigade" — skepticism that the company building ever-stronger agents is now also selling the defense.
- Auth friction: several early testers were blocked by authentication errors; a Codex Security co-founder was in the thread taking feedback.