OpenAI open-sources its security agent

What OpenAI released

OpenAI has released Codex Security CLI, a command-line tool that scans code repositories for vulnerabilities, suggests patches and verifies the fixes. The tool was released today under the Apache 2.0 licence — a permissive open-source licence that lets anyone use, modify and redistribute the code, including in commercial products.

The CLI — a command-line tool, meaning a small program a developer runs from a terminal — was previously known inside OpenAI by the codename Aardvark. It entered a research preview in March 2026 for OpenAI’s commercial customers. By April 2026 the system had helped fix more than 3,000 critical vulnerabilities, according to OpenAI, though the company has not published how it counted those.

3,000+critical vulnerabilities fixed by Codex Security between March and April 2026, according to OpenAI.

A small but deliberate open move

This is one of OpenAI’s first genuinely open releases in over a year. The company has shipped no open-weight model since early GPT-OSS, and the silence was becoming a story of its own. Putting a security tool under Apache 2.0 — not a custom licence, not a research-only gate — lets anyone read the agent’s code, run it on their own infrastructure, and fork it.

The release is a tooling release, not a model release. What is open is the wrapper; the underlying model analysis is not. OpenAI still gates the analysis behind a sign-in; the agent does the reasoning, but the reasoning lives behind an API. The licence choice is also permissive for commercial use, which lets companies adopt the tool without first paying for a tier.

The AI vs AI security arms race

Codex Security lands in a market that has changed quickly. OpenAI’s most direct competitor, Anthropic, launched a comparable product called Claude Security earlier this year. Both tools now use AI agents to read code in context, rather than matching known patterns. The rise of AI-assisted code generation has put pressure on defenders: as The Decoder notes, as models give attackers more automated capabilities, defenders need to keep up.

The two products are being marketed to the same buyer — the developer who owns secure code review at a small team. Anthropic’s tool appears inside Claude Code; OpenAI’s arrives through the Codex CLI surface. The shape of the competition is the same race, with different keys. The pattern mirrors the broader frontier, where OpenAI and Anthropic are pulling further apart from the rest of the field on tooling more than on raw intelligence (see our duopoly coverage).

The threat model is also shifting. As AI-driven code generation accelerates, the surface area for AI-driven attacks grows with it. Recent incidents have already shown what that looks like in practice — autonomous exploits, sandbox escapes and AI agents that take instructions from tampered prompts. Neither vendor has published a head-to-head benchmark, so the comparison is left to developer impressions and the early GitHub stars. Both tools, however, are now part of the same defensive story.

What to watch

Two things are worth watching, neither of which is a call to install this on Monday.

Whether OpenAI opens more. The CLI is the rust on a tool their model already runs; the real product is the agent layer. If OpenAI continues down the open-source route with the next layer of the stack, the open-weight silence story would finally crack. The Apache 2.0 choice suggests it has not ruled out, and the team should be watched for further releases in the same vein. The pricing model is also in flux: basic interactive scans are free, full scans cost API credits, and OpenAI has not published what production pricing will look like once the beta ends.

Whether the AI-security duopoly closes. Two of the three frontier labs now ship AI agents that find and fix code vulnerabilities to the same developers. The third, Google, has not yet matched either product. The shape of that race — and what it means for the price of security tooling — is the real story over the next two quarters. The first credible third-party benchmark will probably come from a developer who funnels the same repository through both tools and compares the findings; that result, more than the marketing, will determine which one becomes the default.

For most UK small firms this does not change what to buy or run. You still need a developer who can run a command-line tool, or a security partner who can stand one up for you. The story is where the field is heading, not what to install on Monday.