OpenAI Codex Security
The most recommended of 10 vulnerability scanners
People recommend it for finding real vulnerabilities with few false positives and suggesting small, targeted fixes. Critics say long scans show little progress and access requires cyber registration.
People recommend it for finding real vulnerabilities with few false positives and suggesting small, targeted fixes. Critics say long scans show little progress and access requires cyber registration.
51 people gave an opinion
- recommend it
- 21
- criticize it
- 30
- approval share
- 41%
Recommended in 4 of 13 months
- November 2025: not recommended
- December 2025: not recommended
- January 2026: not recommended
- February 2026: not recommended
- March 2026: recommended
- April 2026: not recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: recommended
- August 2026: not recommended
- September 2026: not recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 21 people recommend itNeeds 10 or more, met.
- 0.7 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 4 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Finds real issues with few false positives
“It found a real security issue in a project of mine, with very few false-positives.”
Comment from 23 Jun 2026 in “OpenAI DayBreak – GPT-5.5-Cyber” “Codex Security and 5.5/5.6 are still very good finding vulnerable code”
Comment from 23 Jun 2026 in “OpenAI DayBreak – GPT-5.5-Cyber” Built for repo-wide security workflows
“It seems like openai/codex-security could simplify a lot of that, or at least provide a version of Codex that's purpose-built for security workflows.”
Comment from 28 Jul 2026 in “OpenAI just open-sourced Codex Security” “They are genuinely impressive at the repository level, but they run asynchronously.”
Comment from 16 Mar 2026 in “Show HN: Arko – Real-time AI threat modelling inside Cursor and VS Code” “built for running security across many repos over time”
Comment from 28 Jul 2026 in “OpenAI just open-sourced Codex Security” Praised by early users
“I turned it on just as an experiment and in less than a week it has now become essential to all of us.”
Comment from 22 May 2026 in “Project Glasswing: An Initial Update” “This looks great, thanks for open-sourcing it!”
Comment from 28 Jul 2026 in “OpenAI just open-sourced Codex Security” “I've heard great reviews about this”
Comment from 29 Jul 2026 in “OpenAI just open-sourced Codex Security”
What people warn about
Each mark is one comment
Long scans with little visible progress
“the CLI output is not particularly interesting while the scan is running”
Comment from 28 Jul 2026 in “OpenAI just open-sourced Codex Security” “its running now for over an hour in my Python code base without any feedback”
Comment from 29 Jul 2026 in “OpenAI just open-sourced Codex Security” “its running now for over an hour in my Pythin code base without any feedback”
Comment from 29 Jul 2026 in “OpenAI just open-sourced Codex Security” - Comment from 28 Jul 2026 in “OpenAI just open-sourced Codex Security”
Guardrails and cyber registration limit access
“These ""guardrails"" make all of this borderline useless, and even pointless in a world with powerful open-weight models.”
Comment from 29 Jul 2026 in “OpenAI just open-sourced Codex Security” “They silently return an earlier model's results if they think you're redteaming/abusing with it.”
Comment from 10 Jun 2026 in “If Claude Fable stops helping you, you'll never know” “Allow only OpenAi key? Requires Cyber registration? Yes. Yes. Useless.”
Comment from 28 Jul 2026 in “OpenAI just open-sourced Codex Security” - Comment from 29 Jul 2026 in “OpenAI just open-sourced Codex Security”
Scans stop without final results
“The partial output did contain some useful signal but I was disappointed to see it didn’t finish.”
Comment from 29 Jul 2026 in “OpenAI just open-sourced Codex Security” “it bailed before finishing. Unknown if I would get full results for $105 or $500.”
Comment from 29 Jul 2026 in “OpenAI just open-sourced Codex Security” “Charging users for a session that produced no final output is ridiculous.”
Comment from 29 Jul 2026 in “OpenAI just open-sourced Codex Security” Unclear and high charges for scans
“it bailed before finishing. Unknown if I would get full results for $105 or $500.”
Comment from 29 Jul 2026 in “OpenAI just open-sourced Codex Security” “Charging users for a session that produced no final output is ridiculous.”
Comment from 29 Jul 2026 in “OpenAI just open-sourced Codex Security” “It’s like they want to squeeze more money from you with the cyber crap”
Comment from 29 Jul 2026 in “OpenAI just open-sourced Codex Security”
Other vulnerability scanners people recommend
The four most recommended other vulnerability scanners, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| OpenAI Codex SecurityThis page | 21 | 30 | 41% | 4 | — | — |
| govulncheck | 13 | 0 | 100% | 9 | — | Approved |
| AISLE | 11 | 2 | 85% | 5 | — | Approved |
| Trivy | 10 | 23 | 30% | 5 | — | — |
| cargo-vet | 8 | 0 | 100% | 5 | — | — |
What people said
40 of the 59 comments that mention it, newest first. Each links to the original comment.
“It seems to force Sol Extra-high by default and completely ignore your current model settings?”
“These ""guardrails"" make all of this borderline useless, and even pointless in a world with powerful open-weight models.”
“It’s like they want to squeeze more money from you with the cyber crap”
“it bailed before finishing. Unknown if I would get full results for $105 or $500.”
“the README leaves something to be desired for a billion dollar company”
“Very disappointing, this should be mentioned before the user even authenticates in the onboarding phase”
“I've heard great reviews about this”
“Really disappointed to discover it's just gonna be more of the same.”
“its running now for over an hour in my Pythin code base without any feedback”
“its running now for over an hour in my Python code base without any feedback”
“Applied twice already never heard anything back. This is a frustrating experience!”
“Really just a (not so) fancy CLI wrapper about a prompt and a skill”
“Charging users for a session that produced no final output is ridiculous.”
“The partial output did contain some useful signal but I was disappointed to see it didn’t finish.”
“This is going to be hell for OSS maintainers. Every llm-kiddie will be opening a security report”
“I think this is an under-appreciated part of the release.”
“Being able to keep building practical, open-source security tooling was important to us.”
“a 50-minute scan just to get a HEAD error at the end is not acceptable”
“Allow only OpenAi key? Requires Cyber registration? Yes. Yes. Useless.”
“This looks great, thanks for open-sourcing it!”
“the CLI output is not particularly interesting while the scan is running”
“built for running security across many repos over time”
“It seems like openai/codex-security could simplify a lot of that, or at least provide a version of Codex that's purpose-built for security workflows.”
“there's much to this other than it being a convenient CI wrapper around their existing models”
“We literally just saw an advanced model from openAI commit a cyber crime.”
“It found a real security issue in a project of mine, with very few false-positives.”
“Codex Security and 5.5/5.6 are still very good finding vulnerable code”
“You can use codex security there.”
“It catches a lot of stuff”
“They silently return an earlier model's results if they think you're redteaming/abusing with it.”
“they release a tool that doesn't find anything in hardened projects”
“Not from Anthropic, but OpenAI's Codex Security is.”
“I know a whole mess of people that have gotten it for much less. Should just give it a try.”
“the security model proposed fixes that are frequently <10 loc, targeting exactly the correct place.”
“I turned it on just as an experiment and in less than a week it has now become essential to all of us.”
“AI tools found over a dozen CVEs in curl last year, and hundreds of bugs.”
“They are genuinely impressive at the repository level, but they run asynchronously.”
“One such resource is Decentralized Codex Security, a firm that assists individuals in navigating these complex situations”
“OpenAI just released "codex security", worth trying (along with other suggestions) if your org has access”
“Huge development in cybersec.”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.