The security agent OpenAI used to keep behind ChatGPT Pro and Enterprise is now Apache-2.0. Codex Security is a command-line tool plus a TypeScript SDK that reads your repo, finds vulnerabilities, checks whether they’re real, and writes the patch. Point it at code, get back fixes.
What it actually does
It’s an AI coding agent aimed at one job: security. Scan a repo, verify each finding to cut false positives, then auto-generate a patch. Output comes in SARIF, CSV, or JSON, so it drops straight into whatever vuln pipeline you already run. It can batch across many repos at once, and inside Docker it runs sandboxed with dropped privileges — a security tool that doesn’t become the next hole.
Why the SDK matters
The TypeScript SDK is the real unlock. Wire scanning into CI, gate merges on a clean report, or fan it across hundreds of internal services programmatically. This ships alongside OpenAI’s Daybreak and Patch the Planet push, where Trail of Bits already ran it on 19 open-source projects and surfaced hundreds of real bugs.
Big lab, internal security agent, open-sourced as CLI plus SDK. That’s why it hit the HackerNews front page.
You Might Also Like
- Capital one Open Sources Vulnhunter a Security Agent That Hacks Your Code Before it Flags it
- Openai Desktop Superapp Chatgpt Codex and Atlas are Becoming one app
- 7 7k Stars and Climbing oh my Codex omx Turns Openais Codex cli Into a Multi Agent Powerhouse
- Addy Osmani Open Sources Agent Skills 19 Workflows That Make ai Agents Code Like Google Engineers
- Mentra Live Mentraos Open Source hit Github one Typescript sdk Four Pairs of Glasses
Top AI Product 
Leave a comment