OpenAI has released Codex Security CLI, an open-source command-line tool built to help security and development teams work directly inside code repositories. The tool is licensed under Apache 2.0 and is currently in beta.
The release puts vulnerability discovery and remediation into a familiar developer workflow: the command line. Rather than positioning security review as a separate process, Codex Security CLI is designed to scan repositories, confirm issues, help fix them, and verify that fixes worked.
What Codex Security CLI Does
Codex Security CLI focuses on a practical security problem: teams need to identify vulnerabilities in code, understand whether they are real, and move from detection to repair. According to the source, the tool helps teams automatically find, confirm, and fix vulnerabilities in code repositories.
Its capabilities cover several stages of a security workflow. Codex Security CLI can scan repositories, compare results across multiple runs, verify fixes, and plug security checks into CI/CD pipelines. It also supports bulk scans across multiple repositories.
That matters because security work is rarely a one-time event. A repository can change from one run to the next, and a fix is only useful if the team can confirm that the issue no longer appears. Comparing results across runs and verifying fixes gives teams a clearer way to track progress without leaving the command-line environment.
- Repository scanning: Codex Security CLI can examine code repositories for vulnerabilities.
- Run comparison: Teams can compare results across multiple scans.
- Fix verification: The tool can check whether repairs address the detected issue.
- CI/CD integration: Security checks can be added to pipeline workflows.
- Bulk scanning: Multiple repositories can be scanned at scale.
Requirements and Availability
Codex Security CLI installs via npm. The tool requires Node.js 22 and Python 3.10 or higher, which gives teams a clear baseline before they try to add it to local development environments or automated workflows.
The project is open source under Apache 2.0. That license choice is important for adoption because it gives developers and organizations a defined legal framework for using and modifying the tool. The source also notes that documentation covers all commands and output formats, which is especially relevant for teams that want predictable results in scripts, reports, or CI/CD jobs.
Because the tool is currently in beta, teams evaluating it should treat it as an emerging part of the security workflow rather than a settled replacement for every existing process. The source does not describe final release timing, so the clearest takeaway is that OpenAI has made the command-line tool available now while it is still in beta.
From Aardvark to Codex Security
Codex Security was previously known internally as "Aardvark." It launched in March 2026 as a research preview for ChatGPT Enterprise, Business, and Edu customers.
By April 2026, according to OpenAI, the system had helped fix more than 3,000 critical vulnerabilities. That figure gives useful context for why the command-line release is notable: OpenAI is not presenting Codex Security only as a scanner, but as a tool connected to the process of confirming and repairing security issues.
The shift from an internal name and research preview to an open-source CLI also changes where developers may encounter the tool. Instead of being only a preview for specified ChatGPT customer groups, Codex Security CLI is now positioned as a repository-level utility that can be installed through npm and used from the command line.
Why the Command Line Matters
Security tools compete for attention in busy engineering environments. A command-line interface can lower friction because developers already use terminals for building, testing, reviewing, and deploying software. Codex Security CLI fits into that pattern by bringing vulnerability scanning and fix verification closer to the daily workflow.
CI/CD support is another key part of the release. When security checks can run inside a pipeline, teams can make vulnerability detection part of the same flow that already handles code integration and delivery. The source does not specify exactly how teams should configure those pipelines, but it does state that the tool can plug security checks into CI/CD pipelines.
Bulk repository scanning expands the tool's usefulness for organizations that manage more than one codebase. A single-repository scan can help one project, but scanning across multiple repositories helps teams apply the same security process more broadly.
The Competitive Context
Codex Security CLI also arrives in a competitive market. The source states that Codex Security competes directly with Anthropic's Claude Security, which also scans codebases for vulnerabilities and suggests patches.
That competition reflects a larger shift in software security. The same source points to a growing reality: as AI models give attackers more automated capabilities, defenders need to keep up. In that context, tools like Codex Security CLI are part of a defensive response, giving security and development teams more automation for finding and fixing vulnerabilities.
The practical question for teams is not only whether a tool can detect problems, but whether it can fit into the way software is actually built. Codex Security CLI's focus on repositories, repeat scans, fix verification, CI/CD pipelines, and bulk scans makes the release relevant to both developers and security teams trying to close the gap between discovery and remediation.