OpenAI open-sources Codex Security CLI for vulnerability scanning

OpenAI's decision to open-source Codex Security CLI marks a shift from its previous model of limiting the tool to ChatGPT Enterprise, Business, and Edu customers. The tool was originally launched internally as "Aardvark" and released as a research preview in March 2026, where it demonstrated measurable impact by fixing more than 3,000 critical vulnerabilities within the first month. By making it freely available under Apache 2.0, OpenAI is broadening access to automated security scanning at a moment when the broader security landscape has shifted.

The timing reflects a practical reality: as large language models become more capable, they are increasingly used by threat actors to automate attacks and discover vulnerabilities. This creates pressure on the defensive side—development and security teams need equivalent automation to keep pace. Codex Security's feature set (repository scanning, fix verification, CI/CD integration, bulk scanning) positions it as a scalable defense mechanism that can be woven into existing development workflows. The direct competition with Anthropic's Claude Security suggests the space is maturing and that both major AI labs view automated code security as a core product category.