Overview
Codex Security is an open-source security tool launched by OpenAI, providing a CLI and TypeScript SDK to help developers efficiently discover, verify, and fix security vulnerabilities in code. It can scan entire repositories, review code changes, track security findings over time, and integrate into CI pipelines for security checks. The tool aims to seamlessly embed security practices into development workflows, enhancing code security.
Key Features
- Repository Scanning and Vulnerability Discovery: Supports comprehensive scanning of code repositories to automatically identify potential security vulnerabilities, including common types such as injection and cross-site scripting.
- Change Review and Verification: Can review code changes and verify whether newly introduced code poses security risks, helping developers fix issues before merging.
- Tracking and Historical Analysis: Tracks changes in security findings over time, providing historical records and trend analysis to help teams continuously monitor security status.
- CI Integration for Security Checks: Can be integrated into continuous integration (CI) pipelines to automatically perform security checks, ensuring every commit meets security standards.
Use Cases
- Development teams automatically scan code security vulnerabilities in CI/CD pipelines
- Security auditors conduct regular security reviews of repositories
- Open-source project maintainers verify the security of contributed code
Pros
- Open-source and free, lowering the barrier to using security tools
- Provides both CLI and SDK, flexibly adapting to different development environments
- Maintained by OpenAI, with continuous updates and community support
- Supports tracking historical findings, facilitating long-term security management
Pricing
Open-source and free, all features are available without payment.
Summary
Codex Security is an open-source security tool launched by OpenAI, offering repository scanning, change review, finding tracking, and CI security checks via CLI and TypeScript SDK. It helps development teams integrate security practices into daily workflows, effectively improving code security, and is completely free to use.
Version History
- ModelBest's OpenBMB releases MathForm, an open-source framework, dataset and model for Lean 4 math autoformalization (2026-08-21): OpenBMB introduces MathForm, an open-source framework, dataset, and model for automated formalization of mathematics in Lean 4. Its FormalVerse dataset contains 367K+ verified examples; under a matching 100K budget, the model trained on it achieves a Consistency Check of 60.32%, outperforming FineLeanCorpus (46.53%) and NuminaMath-LEAN (41.49%).
- FastMetal generates video locally on a Mac in 30 seconds (2026-08-19): A 5-second 480P video, fully generated on a Mac, taking 30 seconds. No CUDA, no cloud, only 3.9 GiB of memory. FastMetal brings the FastWan-QAD series to Apple Silicon. DiT, DMD sampler, and decoder all run on Metal via MLX, with INT8 by default. Three models: 1.3B supports 480P, 5B supports 720P, and 14B for higher quality. 📷 Blog: h
- Qwen3.8-2.4T-A95B goes open source, launching on SiliconFlow the same day (2026-08-13): Alibaba open-sourced Qwen3.8-2.4T-A95B, and SiliconFlow has provided Day-0 support. The model has 2.4T parameters and 95B activated parameters, focusing on autonomous coding, deep research, and end-to-end agent execution. API pricing is $2.00 per million tokens for input, $6.00 per million tokens for output, and $0.25 per million tokens for cached input.
- Microsoft debuts MAI-Thinking-1, its first in-house reasoning model (2026-08-12): Our first reasoning model, MAI-Thinking-1, was built from scratch and is now available on Microsoft Foundry. Kudos to the team! More details below.
- Meta releases open-source model Muse Glimmer (2026-08-10): Introducing Muse Glimmer, an open-weight, 30-billion-parameter model optimized for local, always-on agentic workflows. Compared to leading models of similar size, Muse Glimmer excels in key agentic use cases and benchmarks, and is designed to run entirely on consumer hardware such as a Mac or a PC with a high-performance GPU. Continuing our tradition of sharing foundational AI research, we release the model weights under the permissive Apache 2.0 license.
- SenseTime releases the open-source SenseNova U1.5-Lite-Preview model (2026-08-03): SenseTime launches SenseNova U1.5-Lite-Preview, a lightweight natively unified multimodal model built on the NEO-Unify architecture that reaches the generation and editing quality of commercial closed-source models with just 8B-MoT parameters.
- Microsoft open-sources the Orchard agent training framework (2026-08-03): Orchard is an open-source framework for the research community to train and evaluate AI agents across task types. It reduces complexity while letting researchers reuse the same infrastructure, enabling smaller models to achieve strong performance. https://msft.it/6019a8fqP
- OpenAI releases a Codex security CLI and SDK (2026-07-28): More open-source benefits. We just released a CLI and TypeScript SDK for finding, verifying, and fixing security vulnerabilities in code. Scan repositories, review changes, track findings over time, and run security checks in CI. https://github.com/openai/codex-security
- Tencent Hunyuan open-sources the AngelSpec speculative decoding framework (2026-07-29): Tencent Hunyuan open-sourced the end-to-end speculative decoding framework AngelSpec, supporting both training and deployment. On the Hy3-A21B model, its DFly scheme achieves a 1.98-2.40x end-to-end speedup compared to autoregressive decoding, with throughput 10.5-11.8% higher than DFlash. The training code and Hy3-A21B MTP/DFly draft model weights have been open-sourced.