OpenAI Open-Sourced Codex Security: What HN Thinks

OpenAI open-sourced the Codex Security CLI and TypeScript SDK this week, publishing the repository at github.com/openai/codex-security. The release hit the Hacker News front page with 392 points and 122 comments. Here is what the repo actually contains, what the HN discussion revealed, and why the harness matters more than the scanner.

What the Release Actually Is#

The @openai/codex-security package gives you a CLI and SDK for finding, validating, and fixing security vulnerabilities in code. You install it with npm, authenticate with your OpenAI account or API key, and run npx codex-security scan . against a repository. It requires Node.js 22 or later and Python 3.10 or later.

The core scanning logic is not new -- it was already available as a plugin inside the Codex app. What is new is the standalone tooling: org-wide scanning across many repos, historical result tracking, deduplication across runs, false-positive tracking, budget controls via --max-cost, and CI integration. The repo has already collected 2.1k GitHub stars and 114 forks.

Michael, co-founder of Promptfoo (the open-source LLM evaluation framework), introduced himself in the thread as one of the people building Codex Security at OpenAI. His team brought the Promptfoo approach -- structured evals, prompt optimization, practical CI tooling -- into the OpenAI security product. The release includes the TypeScript skill definitions that tell the model how to search for vulnerabilities. Michael noted they spent "billions of tokens" of evals fine-tuning those prompts, and called them "an under-appreciated part of the release."

Alibaba also published an open-source CLI code review tool the same day, but as the submitter bakigul noted, they are entirely different products.

What HN Is Saying#

The HN discussion at news.ycombinator.com/item?id=49089755 surfaced several sharp takes.

The cost and reliability issues drew the strongest reaction. User gregwebs reported running a scan on a small repo that took almost an hour, drained half their weekly Pro plan usage, and then failed with a "Repository HEAD changed while the scan was running" error at the end with no resume capability. Michael responded directly: "Oof, that's a bad outcome. Half your weekly usage and a 50-minute scan just to get a HEAD error at the end is not acceptable. We need to handle a changing checkout and partial results much better."

User Quai hit rate limits after a minute of retrying, with a $13 bill for the failed scan. Michael acknowledged the problem: "A per-minute rate limit shouldn't kill a scan after a minute, and 'partial output was kept' makes it sound like you can pick up where you left off. You can't yet."

The auth issues at launch got flagged fast. Multiple users hit authentication errors immediately. OpenAI merged and deployed a fix in version 0.1.1 within hours, addressing an OPENAI_API_KEY / CODEX_API_KEY conflict with existing ChatGPT logins.

The guardrail problem is real and acknowledged. User vladoh described a scenario where the tool says it found a vulnerability but refuses to explain what it is. Michael explained the CLI does not bypass the model's cybersecurity guardrails. For authorized defensive work, the Trusted Access for Cyber (TAC1/Daybreak) program can reduce refusals depending on the model and account. Open-source maintainers can apply for conditional access through a dedicated form.

Local and third-party model support is coming. User strictnein asked whether the tool can work with local OpenAI-compatible endpoints. Michael confirmed they are actively working on official support, noting "because it's open source it is pretty easy to point a coding agent at it now and switch out the model." User teaearlgraycold plans to hack it to use OpenRouter with Kimi K3 or GLM 5.2 to keep costs reasonable.

The broader language shift drew attention. User schrodinger observed a trend of new projects moving from Python and Node to Go and Rust for agent tooling, reasoning that "an agent is a long-running, concurrent, I/O-bound process that spends most of its time waiting on a model, a tool, or a human" -- not Python's strength. Several commenters noted that statically typed languages give agents better guardrails.

The "harness is the product" take landed well. User knighthacker pointed out: "The scanner is the least interesting part of this. The harness around it is the product: dedup across runs, false-positive tracking, budget controls, CI gating." This mirrors the argument we made in Software Factories Fail Without Harness Engineering -- the tooling around the model, not the model itself, determines whether something works in production.

Dev-to-Dev Take#

Three things stand out from this release.

First, the Promptfoo acquisition is paying off in open-source credibility. OpenAI bought Promptfoo in early 2026 primarily for its evaluation infrastructure. Seeing Michael (dangelosaurus) in the thread engaging directly with every complaint -- the auth bug, the rate limit failure, the HEAD error, the guardrail frustration -- is the Promptfoo playbook in action. That level of maintainer responsiveness is rare at a company OpenAI's size and it will matter more than any feature for community trust.

Second, the "open source but OpenAI-only" tension is real. The code is Apache 2.0 licensed and the prompt definitions are public, but the actual scanning requires OpenAI model access. Michael acknowledges local endpoint support is coming. For teams that cannot send source code to OpenAI, the recommendation in the thread is honest: "If your company doesn't allow source code to leave its environment, you shouldn't run this against that codebase." The AI Coding Agent Security Models Compared post covers the data-boundary tradeoffs across providers in more depth.

Third, the Promptfoo skills and the eval-driven approach are worth paying attention to. The bundled TypeScript skill definitions -- optimized over billions of eval tokens -- are a glimpse of where agent security tooling is heading. Instead of hand-writing prompt templates, teams will share battle-tested skill files that encode real security expertise. This is the same pattern behind Claude Code skills and the Skills Over MCP architecture.

The open-source release of Codex Security is not a finished product. It is a foundation that will evolve fast based on exactly the kind of feedback flooding the HN thread. That is the right way to build security tooling.

Sources#

• Codex Security GitHub repository, accessed July 29, 2026: https://github.com/openai/codex-security
• HN discussion, accessed July 29, 2026: https://news.ycombinator.com/item?id=49089755
• Codex Security CLI documentation: https://learn.chatgpt.com/docs/security/cli
• OSS maintainer access form: https://openai.com/form/codex-for-oss/
• Enterprise Daybreak onboarding: https://help.openai.com/en/articles/20001261-enterprise-daybreak-onboarding-guide

Continue Reading#

• Codex Security Preview: AppSec Agent for Real Repos -- our hands-on review of Codex Security's agent capabilities
• OpenAI Codex: Cloud AI Coding With GPT-5.3 -- the full Codex CLI and cloud tasks guide
• OpenAI Codex Cloud Security Playbook -- data boundaries, approvals, and sandbox patterns
• Agent Security Checklist Before Connecting Tools -- the broader threat model for AI agents
• AI Coding Agent Security Models Compared 2026 -- how different providers handle code boundaries