The security review AI 'Codex Security CLI' has been open-sourced and is now available for download from GitHub.

OpenAI has released Codex Security CLI , a command-line tool for security analysis, as open source.

GitHub - openai/codex-security: SDKs and CLI for Codex Security · GitHub
https://github.com/openai/codex-security

OpenAI announced 'Codex Security' in March 2026 as an AI agent that automates code security reviews.

OpenAI announces 'Codex Security,' an AI agent that automates vulnerability discovery, verification, and remediation - GIGAZINE

The 'Codex Security CLI,' which makes Codex Security available as a command-line interface (CLI), has been released as open source. The Codex Security CLI is publicly available on GitHub and can be downloaded by anyone.

GitHub - openai/codex-security: SDKs and CLI for Codex Security · GitHub
https://github.com/openai/codex-security

OpenAI posted, 'We quietly released the open-source Codex Security CLI, but Hacker News found it before we could share it. Now you can scan repositories, track discoveries per run, check for fixes, and add security checks to your CI/CD.'

We quietly released the open-source Codex Security CLI, but Hacker News found it before we had a chance to share it here...

You can now use it to scan repositories, track findings across runs, verify fixes, and add security checks to CI/CD.

This is an early release, and we're… pic.twitter.com/4AbAn1ZRym

— OpenAI (@OpenAI) July 29, 2026

On the social forum Hacker News , there were comments such as, 'This is great! Thank you for open-sourcing it!', but there were also comments like, 'I tried it, and although the scan started, it stopped because I reached my account's rate limit.'

In response, Michael, who was involved in the development of the Codex Security CLI, said, 'A rate limit of one minute should not cause the scan to stop after one minute, and the message 'Partial output retained' gives the impression that it can be resumed from where it left off. Unfortunately, however, it is not possible to resume the scan at present.'

In response to the question , 'When should I use this instead of the Codex plugin?', Michael explained, 'This plugin is ideal for scanning the repository you are currently working on, including when launched via the Codex CLI. The standalone Security CLI/SDK also uses the same scanner, but it is designed to run security over the long term across multiple repositories, including organization-wide scans , historical results, deduplication, false positive tracking, budget management, and CI integration.'