OpenAI open-sources Codex Security CLI to scan and fix your code
Apache-2.0 and one npm install. It lands the same week NVIDIA's Open Secure AI Alliance open-sourced NOOA and a stack of agent-security tools.
Copy markdown
One npm install, then scan
`npm install @openai/codex-security`, then `npx codex-security scan /path/to/repo`. It finds, validates, and suggests patches for vulnerabilities in code you own, and exports to SARIF, CSV, and JSON. Needs Node 22+ and Python 3.10+.
Built to gate your CI, not just the terminal
Severity-based exit codes and diff-only scans let you block pull requests on new findings today, plus you can bulk-scan repos with Docker and compare results across reruns. It's pre-1.0, so expect the API to shift before 1.0.0.
OpenAI shipped it quietly — HN found it first
OpenAI says it “quietly released” the CLI and Hacker News surfaced it before the company could post. Translation: an early, no-hype tool you can adopt now while your feedback still shapes it.
Same week, NVIDIA open-sourced NOOA
NVIDIA's new Open Secure AI Alliance — Microsoft, Cisco, Cloudflare, CrowdStrike, Hugging Face, IBM, Red Hat — dropped NOOA, an Apache-2.0 framework to test, trace, and audit agent behavior, on GitHub. Open AI-security tooling is consolidating fast.
More free tools — and one big caveat
The alliance also points at Hugging Face's Safetensors (RCE-safe weights), Microsoft's MDASH multi-model scan harness, and IBM/Red Hat's Lightwell signed patches. But NOOA warns its controls are “not a containment boundary” — still sandbox any LLM-generated code.