OpenAI Codex Security explained: how it scans code for vulnerabilities, and what changed in version 0.10.0

Codex Security is a tool from OpenAI that looks for security vulnerabilities in your code, checks whether each one is real, and helps you fix it. You can use it three ways: inside Codex, where you ask for a security scan in plain English; in a terminal, with the cs command from the @openai/codex-security npm package; or in automation, through the TypeScript SDK or a GitHub Action.

The source is on GitHub under the Apache 2.0 licence. The first npm release, 0.1.0, came out on 31 July 2026, and the latest, 0.10.0, on 12 November 2026, the morning the repository was on GitHub's trending list.

It is built on Codex, OpenAI's coding agent, so a scan is an agent doing the work a security reviewer does: reading the code, forming a theory of what an attacker could reach, and checking it, rather than matching a fixed list of patterns.

OpenAI's README and guides do not list a separate price for the tool. A scan is model work, so what you pay depends on the model, the size of the repository and the scan mode, and the CLI is built around limits for that reason.

--max-cost sets an estimated limit for one scan, and the new --max-total-cost sets one for a batch. --max-time sets an investigation allowance in minutes, which OpenAI describes as advisory: the scan stops starting new investigations at the deadline, but reporting can run longer. The example GitHub Action workflow uses an estimated $5 limit per scan and reports findings without failing the job.

If you would rather not use an OpenAI key, scans also run on Amazon Bedrock with your AWS credentials, or on OpenRouter, Fireworks AI or Cheaper Inference with their keys and a supported model.

Read next: Token cost engineering: putting a budget on model work

Trust it as a strong lead, not as proof. OpenAI's own quickstart says a source-based finding does not necessarily include a successful runtime reproduction, and asks reviewers to check the affected code, what an attacker would need first, the validation evidence and what is still uncertain. That is the right habit with any scanner, and more so with one that writes persuasive explanations.

Three practical points. The CLI runs with your operating-system permissions and does not pause for approval, so run it where that is acceptable, such as a container or a CI runner. Some cybersecurity requests and protected findings need OpenAI's Trusted Access for Cyber programme. And it does not replace the checks you already have: it can import findings from scanners such as Semgrep, Snyk and ArmorCode, which suggests where it fits, as a reviewer on top of them rather than instead of them.

For a team, the sensible first step is a Diff scan on pull requests with a severity threshold, plus a weekly full scan, and a person who owns reading the reports. A tool that finds real bugs and is never read finds nothing.

Think of the layers you already know. Dependency scanning catches known-vulnerable packages. Static analysis catches patterns, such as a query built from user input. A human code review catches logic: a missing permission check, a tenant ID read from the request instead of the session. An agent-based scanner like Codex Security aims at that third kind of bug, at machine speed, and then argues its case with evidence.

That makes threat modelling more useful, not less. A scan reads SECURITY.md and saves its own threat model, so a team that has written down what must never happen gives the scanner something to check against. And it makes the old rule sharper: every finding is a claim about your system that someone has to confirm before it changes the code.

Read next: The AI Engineering course: how AI agents work, and how to evaluate and control them