OpenAI released an open tool that finds and fixes security bugs in your code

OpenAI released an open framework that automatically finds, validates, and fixes security vulnerabilities in your code.

OpenAI released @openai/codex-security, a CLI and TypeScript SDK built to scan repositories and track vulnerabilities over time. It reviews code changes, runs checks in your CI pipeline, and goes beyond simple reporting to help validate and patch security flaws directly.

Why it matters: Most scanner tools dump a list of warnings on your lap and walk away. Codex Security targets the full workflow: detection, verification, and automated patching. That means less time triaging false positives and more time shipping fixes.

Try it / know this: The tool requires Node.js 22+, Python 3.10+, and access to Codex Security. To run a local scan:

npm install @openai/codex-security
npx codex-security login
npx codex-security scan .

For CI builds, pass an OPENAI_API_KEY environment variable to run non-interactive scans automatically.

Your security backlog might finally start shrinking instead of growing.