OpenAI’s Codex Security AI agent scanned GitHub repositories commit-by-commit, built project-specific threat models, and delivered ready-to-merge fix pull requests — all without developer intervention — as the tool’s CLI and TypeScript SDK went open-source under Apache-2.0 on July 13, 2026, triggering a Hacker News thread that reached a score of 445 today.
Codex Security is an AI security agent that connects to a GitHub repository, analyzes each commit against a project-specific threat model, validates findings in an isolated sandbox to reduce false positives, and proposes patches as pull requests. OpenAI launched Codex Security as a research preview on March 6, 2026. The tool is available to ChatGPT Enterprise, Business, and Edu customers at $0.018 per 1,000 lines scanned, with the first month free.
What Codex Security Does
Codex Security supports 4 scan modes: full repository scans, targeted path scans, differential Git-diff scans, and CI pipeline integration. According to OpenAI’s launch documentation, the agent builds a project-specific threat model rather than applying generic vulnerability signatures, which allows it to surface findings relevant to the codebase’s actual architecture. Findings are validated in a sandboxed environment before Codex Security raises a pull request, reducing the false-positive rate that makes legacy scanners noisy.
Codex Security currently supports JavaScript, TypeScript, Python, Ruby, and PHP. GitLab integration entered beta on June 29, 2026, the same update that added Ruby and PHP language support. GitHub remains the primary supported platform.
How Codex Security Compares to Existing Tools
GitHub Advanced Security, Snyk, and Checkmarx are the 3 incumbents in application security scanning. All 3 identify vulnerabilities and report them to developers; none auto-generate fix pull requests as a core workflow. Codex Security’s patch-generation step is the primary differentiator: the agent proposes a fix, not just a finding.
Pricing also separates Codex Security from legacy tools. GitHub Advanced Security and Snyk sell per-seat enterprise contracts. Codex Security charges $0.018 per 1,000 lines scanned — a usage-based model that lowers the entry cost for teams without a dedicated AppSec budget.
For businesses already evaluating AI agents for business tasks, Codex Security extends the same autonomous-agent pattern — research, reasoning, and action — into the application-security domain, which has historically required point-in-time penetration tests or specialist headcount.
The Open-Source Move and HN Response
OpenAI published the Codex Security CLI and TypeScript SDK to GitHub under an Apache-2.0 license on July 13, 2026. In the security domain, open-sourcing the client layer signals transparency about how the tool reads and processes code — a trust signal that matters to teams evaluating whether to grant an AI agent repository access.
The GitHub repository link surfaced on Hacker News today and reached a score of 445, placing it in the top 5 stories at time of writing. Developer interest at that score level correlates with rapid adoption and secondary coverage across the security community.
Who Can Use It Now
Codex Security is available to ChatGPT Enterprise, Business, and Edu plan customers through the Codex web interface. OpenAI has not confirmed pricing for individual or Team plan users. The first month of scanning is free under the current offer.
Teams already paying for ChatGPT for Business can access Codex Security without an additional vendor contract — a procurement advantage over Snyk and GitHub Advanced Security, which require separate purchasing decisions.
Our Take
For teams already on ChatGPT Enterprise, Codex Security is one trial month away from eliminating the gap between code push and security review. The incumbents — Snyk, GitHub Advanced Security — flag vulnerabilities. Codex Security patches them. That distinction matters when the fix backlog is the real bottleneck.
For Context: AI Coding Agents on WithO2
Codex Security operates in the same category as AI coding agents that take autonomous action on code — a pattern that has moved from research to production tooling across 2025–2026. AI agent tools for developers have expanded from code generation into operations, testing, and now security remediation.
