OpenAI Open-Sources Codex Security, the Tool Formerly Known Internally as Aardvark, Under Apache-2.0

openai/codex-security (surfaced via Hacker News, 590 points / 225 comments; corroborated by The Decoder, Cybersecurity News)·high signalXBlueskyLinkedInCopy link

OpenAI released a CLI and TypeScript SDK on July 28 for finding, validating, and fixing security vulnerabilities, reaching 590 points and 225 comments on Hacker News and 5.7k stars with 377 forks. It uses project-level context to judge whether a flagged pattern is actually exploitable — the noise-reduction step most scanners skip — and tracks findings across runs, evaluates diffs, and drops into GitHub Actions to block risky changes. It shipped as Aardvark in March 2026 as a research preview and had reportedly helped fix over 3,000 critical vulnerabilities by April; it requires Node 22.13+ and Python 3.10+ and remains in beta.