{"slug": "codex-security", "name": "Codex Security", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 4, "commenters": 7, "warners": 0, "score": 4.537, "rising": -1.31, "first": "2026-05-22", "latest": "2026-08-14", "why": "in less than a week it has now become essential to all of us. I was shocked how accurate it is", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 4, "neutral": 3, "compare": 0, "warn": 0}, "spark": [0, 0, 0, 0, 0, 0, 1, 2, 1, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "in less than a week it has now become essential to all of us. I was shocked how accurate it is", "icon": true, "domain": null, "github_repo": "github.com/openai/codex-security", "official_url": "https://github.com/openai/codex-security", "pricing": "", "aliases": ["Codex Security"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 785453648, "item_id": 49090853, "url": "https://news.ycombinator.com/item?id=49090853", "by": "vladoh", "date": "2026-07-28", "stance": "recommend", "quote": "This looks great, thanks for open-sourcing it!", "excerpt": "This looks great, thanks for open-sourcing it! How does it deal with the current guardrails 5.6 Sol has on finding vulnerabilities? When I use it in the Codex app it would sometimes say it found a vulnerability, but it cannot tell me what it is.", "context": "", "use_case": "vulnerability finding", "switched_from": "", "story": "OpenAI just open-sourced Codex Security"}, {"id": 778279984, "item_id": 48642499, "url": "https://news.ycombinator.com/item?id=48642499", "by": "Recursing", "date": "2026-06-23", "stance": "recommend", "quote": "It found a real security issue in a project of mine, with very few false-positives.", "excerpt": "I see a lot of knee-jerk comments to this, but I highly recommend running a scan ( https://openai.com/daybreak/codex-security-plugin/#codex-cli ) in your projects so you can evaluate it yourself. It found a real security issue in a project of mine, with very few false-positives. Its built-in resume mechanism didn't work after it crashed when running out of my 5 hour session limit, but Claude Code was easily able to r", "context": "", "use_case": "security scanning", "switched_from": "", "story": "OpenAI DayBreak \u2013 GPT-5.5-Cyber"}, {"id": 778276544, "item_id": 48642284, "url": "https://news.ycombinator.com/item?id=48642284", "by": "milkshakes", "date": "2026-06-23", "stance": "recommend", "quote": "Codex Security and 5.5/5.6 are still very good finding vulnerable code", "excerpt": "take a look at this bug and the chain required to exploit it: https://projectzero.google/2021/12/a-deep-dive-into-nso-zero-click.html https://projectzero.google/2022/03/forcedentry-sandbox-escape.html exploiting vulnerabilities on hardened targets isn't just in a different league from finding them, it is a different sport altogether. put simply, it's the difference between an integer overflow leading to a sandbox esc", "context": "", "use_case": "finding vulnerabilities", "switched_from": "", "story": "OpenAI DayBreak \u2013 GPT-5.5-Cyber"}, {"id": 771857920, "item_id": 48241120, "url": "https://news.ycombinator.com/item?id=48241120", "by": "mdeeks", "date": "2026-05-22", "stance": "recommend", "quote": "in less than a week it has now become essential to all of us. I was shocked how accurate it is", "excerpt": "You can get a taste of this today yourself with Codex Security. I turned it on just as an experiment and in less than a week it has now become essential to all of us. I was shocked how accurate it is, how many security issues it found in existing code, how it continually finds them as we commit, and how NO ONE is immune from making these mistakes. I'd say it is about 90% accurate for us. Often even the \"Low\" findings", "context": "Team using it on repos", "use_case": "finding security vulnerabilities in code", "switched_from": "", "story": "Project Glasswing: An Initial Update"}]}], "caveats": [], "who": [{"by": "mdeeks", "context": "Team using it on repos", "url": "https://news.ycombinator.com/item?id=48241120", "date": "2026-05-22"}], "tags": [], "use_cases": ["vulnerability detection", "vulnerability finding", "ci security scanning", "security scanning", "finding vulnerabilities", "finding security vulnerabilities in code"], "compared": [], "makers": [{"id": 785469008, "item_id": 49091813, "url": "https://news.ycombinator.com/item?id=49091813", "by": "dangelosaurus", "date": "2026-07-28", "stance": "recommend", "quote": "By default, you can sign in with your ChatGPT/Codex account or use an OPENAI_API_KEY.", "excerpt": "By default, you can sign in with your ChatGPT/Codex account or use an OPENAI_API_KEY. It also does not require cyber registration but it can help if you encounter refusals. If you give it a try, please feel free to message me, I would love your feedback.", "context": "", "use_case": "security vulnerability scanning", "switched_from": "", "story": "OpenAI just open-sourced Codex Security"}], "threads": [{"url": "https://news.ycombinator.com/item?id=49089755", "title": "OpenAI just open-sourced Codex Security", "mentions": 4}, {"url": "https://news.ycombinator.com/item?id=48639063", "title": "OpenAI DayBreak \u2013 GPT-5.5-Cyber", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49298705", "title": "Pi Security \u2013 Codex Security without all the bloat", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48240419", "title": "Project Glasswing: An Initial Update", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {}, "2026-02": {}, "2026-03": {}, "2026-04": {}, "2026-05": {"recommend": 1}, "2026-06": {"recommend": 2}, "2026-07": {"neutral": 2, "recommend": 1}, "2026-08": {"neutral": 1}, "2026-09": {}, "2026-10": {}}, "quotes": [{"id": 788779297, "item_id": 49298706, "url": "https://news.ycombinator.com/item?id=49298706", "by": "GustavHartz", "date": "2026-08-14", "stance": "neutral", "quote": "OpenAI recently released Codex-Security. We simplified it", "excerpt": "OpenAI recently released Codex-Security. We simplified it based on what we use in our own products and put it in the PI harness. We will release data on DeepSeek v4 and GLM-5.3 performance soon, but so far it's probably the best open-source vulnerability detection tool out there right now. The idea is the same as Codex Security. 1. Build a threat model 2. Launch a lot of probing agents looking into the security based", "context": "", "use_case": "vulnerability detection", "switched_from": "", "story": "Pi Security \u2013 Codex Security without all the bloat"}, {"id": 785459008, "item_id": 49091188, "url": "https://news.ycombinator.com/item?id=49091188", "by": "varenc", "date": "2026-07-28", "stance": "neutral", "quote": "It's interesting how much of the value here is providing the english Skill definitions that tell the LLM what to do", "excerpt": "It's interesting how much of the value here is providing the english Skill definitions that tell the LLM what to do: https://github.com/openai/codex-security/tree/main/sdk/typescript/_bundled_plugin/skills Some of approaches there could be useful in other contexts. OAI has the compute to experiment with different prompts and I'd expect these to be somewhat optimized.", "context": "", "use_case": "", "switched_from": "", "story": "OpenAI just open-sourced Codex Security"}, {"id": 785453648, "item_id": 49090853, "url": "https://news.ycombinator.com/item?id=49090853", "by": "vladoh", "date": "2026-07-28", "stance": "recommend", "quote": "This looks great, thanks for open-sourcing it!", "excerpt": "This looks great, thanks for open-sourcing it! How does it deal with the current guardrails 5.6 Sol has on finding vulnerabilities? When I use it in the Codex app it would sometimes say it found a vulnerability, but it cannot tell me what it is.", "context": "", "use_case": "vulnerability finding", "switched_from": "", "story": "OpenAI just open-sourced Codex Security"}, {"id": 785442112, "item_id": 49090132, "url": "https://news.ycombinator.com/item?id=49090132", "by": "petesergeant", "date": "2026-07-28", "stance": "neutral", "quote": "I don't think there's much to this other than it being a convenient CI wrapper around their existing models?", "excerpt": "I don't think there's much to this other than it being a convenient CI wrapper around their existing models? Edit: there's a little bit more meat here: https://github.com/openai/codex-security/tree/main/sdk/typescript/_bundled_plugin/skills", "context": "", "use_case": "CI security scanning", "switched_from": "", "story": "OpenAI just open-sourced Codex Security"}, {"id": 778279984, "item_id": 48642499, "url": "https://news.ycombinator.com/item?id=48642499", "by": "Recursing", "date": "2026-06-23", "stance": "recommend", "quote": "It found a real security issue in a project of mine, with very few false-positives.", "excerpt": "I see a lot of knee-jerk comments to this, but I highly recommend running a scan ( https://openai.com/daybreak/codex-security-plugin/#codex-cli ) in your projects so you can evaluate it yourself. It found a real security issue in a project of mine, with very few false-positives. Its built-in resume mechanism didn't work after it crashed when running out of my 5 hour session limit, but Claude Code was easily able to r", "context": "", "use_case": "security scanning", "switched_from": "", "story": "OpenAI DayBreak \u2013 GPT-5.5-Cyber"}, {"id": 778276544, "item_id": 48642284, "url": "https://news.ycombinator.com/item?id=48642284", "by": "milkshakes", "date": "2026-06-23", "stance": "recommend", "quote": "Codex Security and 5.5/5.6 are still very good finding vulnerable code", "excerpt": "take a look at this bug and the chain required to exploit it: https://projectzero.google/2021/12/a-deep-dive-into-nso-zero-click.html https://projectzero.google/2022/03/forcedentry-sandbox-escape.html exploiting vulnerabilities on hardened targets isn't just in a different league from finding them, it is a different sport altogether. put simply, it's the difference between an integer overflow leading to a sandbox esc", "context": "", "use_case": "finding vulnerabilities", "switched_from": "", "story": "OpenAI DayBreak \u2013 GPT-5.5-Cyber"}, {"id": 771857920, "item_id": 48241120, "url": "https://news.ycombinator.com/item?id=48241120", "by": "mdeeks", "date": "2026-05-22", "stance": "recommend", "quote": "in less than a week it has now become essential to all of us. I was shocked how accurate it is", "excerpt": "You can get a taste of this today yourself with Codex Security. I turned it on just as an experiment and in less than a week it has now become essential to all of us. I was shocked how accurate it is, how many security issues it found in existing code, how it continually finds them as we commit, and how NO ONE is immune from making these mistakes. I'd say it is about 90% accurate for us. Often even the \"Low\" findings", "context": "Team using it on repos", "use_case": "finding security vulnerabilities in code", "switched_from": "", "story": "Project Glasswing: An Initial Update"}]}