OpenAI Open-Sources Aardvark, Renamed Codex Security

OpenAI open-sourced its vulnerability scanner on July 28, renaming Aardvark to Codex Security and releasing the CLI and TypeScript SDK under Apache-2.0.

That matters for teams paying for static analysis. As Aardvark, it helped fix more than 3,000 critical vulnerabilities by April, per the repo. Deciding whether a flagged pattern is actually reachable and dangerous is the step most scanners skip. Codex Security does it with project-level context, then validates the finding and proposes a fix.

It launched in March as a research preview and ran for about four months before this open-source release. The repo doesn't say what counts as critical or which codebases the April fixes came from.

It also evaluates diffs directly and plugs into GitHub Actions. That means a pull request with a real vulnerability can get blocked before it merges, not just flagged after the fact. Running it needs Node 22.13+ and Python 3.10+, and OpenAI still labels it beta.

The reception was fast. The Hacker News thread hit 590 points, and the repo picked up 5,700 stars and 377 forks within days of going public.

Free, Apache-licensed exploitability triage is a bigger threat to paid static-analysis vendors than any single fix-generation feature. They've spent years pricing around exactly the noise-reduction step OpenAI gave away for free. Watch whether any of them cut prices or open their own triage logic in response.