[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"news-slug-openai-codex-security-cli-opensource":3,"news-related-de219584-58fc-45ad-91ea-0049a5cbcf10":41},{"id":4,"title":5,"summary":6,"content":7,"original_url":8,"source_id":9,"tags":10,"translations":27,"news_slug":34,"published_at":35,"created_at":36,"modified_at":37,"is_published":38,"publish_type":39,"image_url":14,"view_count":40},"de219584-58fc-45ad-91ea-0049a5cbcf10","OpenAI 开源 Codex Security CLI:把 AI 安全检测塞进每个 PR","OpenAI 7月28日在 GitHub 上以 Apache-2.0 协议开源 Codex Security CLI 与 TypeScript SDK(仓库 openai\u002Fcodex-security,3.5k stars、184 forks),提供 npm 一键安装与 CI\u002FCD 集成,支持 ChatGPT 登录和 API key 双重认证。这是 Codex Security 从 3 月 research preview 走向工程化的关键一步,把 AI 上下文分析与 PR 审查深度结合,让漏洞发现、验证、修复形成闭环。","# OpenAI 开源 Codex Security CLI:把 AI 安全检测塞进每个 PR\n\n**7月28日深夜,OpenAI 悄悄在 GitHub 投下了一颗重磅炸弹——'openai\u002Fcodex-security' 仓库悄然上线,Apache-2.0 协议,111 个 commits,3.5k stars,184 forks。** 这是 Codex Security 从 3 月 research preview 走向工程化的关键一步,也是 OpenAI 第一次把「AI 安全 Agent」从闭源产品里拽出来,扔进开发者每天都要面对的 PR 流程。\n\n## 一、这不是 CLI,这是 OpenAI 的安全 Agent 开源战略\n\n先看仓库 README 给的「最小可用版」——三行 shell 就能跑起来:\n\n1. 'npm install @openai\u002Fcodex-security'\n2. 'npx codex-security login'\n3. 'npx codex-security scan .'\n\n三行代码,一个本地安全扫描器。Node.js 22 + Python 3.10,**不要求 ChatGPT Plus 订阅**。认证路径做了双轨设计:交互场景下用户可选 ChatGPT 登录或 API key,CI 等非交互场景下 'OPENAI_API_KEY' 自动接管;不想用 API key 时用 'npx codex-security scan . --auth chatgpt' 显式指定。这种细节说明 OpenAI 真的想让这个工具「塞进 CI」——一个能跑在 GitHub Actions 里的安全 Agent,比一个要登录 Web UI 的玩具实用得多。\n\n更关键的是,这次开源的**不只是 CLI,还有 TypeScript SDK**——下面这段是官方 README 的最小示例:\n\n第一行 'import { CodexSecurity } from \"@openai\u002Fcodex-security\"',第二行 'const security = new CodexSecurity()',第三行 'const result = await security.run(\".\")',第四行 'console.log(result.reportPath)'。\n\n把扫描能力包装成 SDK,意味着安全团队可以**把它当作基础设施来编排**——多仓扫描、定时任务、与其他安全工具链(SAST\u002FSCA)串联,而不是只能手动跑一次。'CODEX_SECURITY_STATE_DIR' 这个环境变量看起来不起眼,实际上解决了「扫描结果存在哪」这个最常见的工程化痛点:状态可外置,仓库保持干净。\n\n## 二、和 6 月的「Patch the Planet」一脉相承\n\n如果你还记得 6 月 22 日 OpenAI 发的 [Patch the Planet](https:\u002F\u002Fopenai.com\u002Findex\u002Fpatch-the-planet\u002F)——把 GPT-5.5-Cyber 推到开源一线,做「漏洞修补流水线」——那么这次的 Codex Security CLI 就是**那条流水线的真正执行端**:\n\n- 6 月:模型能力层(GPT-5.5-Cyber 能修洞)\n- 7 月:工程化层(把修洞能力装进 CLI,让任何团队都能调)\n\nOpenAI 用 5 周时间完成了从「我们有个安全模型」到「你可以在 CI 里跑它」的闭环。**这个节奏本身就是信号**:OpenAI 意识到纯闭源的安全模型在企业市场卖不动——客户要的是「我能跑在我自己的代码上」,不是一个远端 API。\n\n## 三、为什么选 Apache-2.0,而不是更严苛的 SSPL\u002F商业许可\n\n代码头部那句 [Apache-2.0 license](https:\u002F\u002Fgithub.com\u002Fopenai\u002Fcodex-security\u002Fblob\u002Fmain\u002FLICENSE) 是个微妙的选择。对比一下:\n\n- **Cognition Devin**:闭源\n- **Cursor**:VS Code fork 闭源\n- **Claude Code**:Anthropic 闭源\n- **Codex Security**:Apache-2.0 开源\n\nOpenAI 在编程 Agent 领域,选择了**反主流的开放策略**。这不是慈善——这是抢占生态位。Apache-2.0 允许任何人(包括 Anthropic、DeepSeek、智谱)拿去改、拿去嵌入自己的产品,只要保留版权声明。**这等于在用许可证做市场覆盖**:谁最先用 Codex Security 写 CI,谁就被锁定进 OpenAI 的工作流。\n\n## 四、行业冲击波:传统 SAST 工具的「上下文盲区」被正面攻击\n\nCodex Security 的 README 里写得很克制:「AI models for contextual analysis rather than relying solely on traditional pattern matching」。**翻译一下:我们不是在和 SonarQube \u002F Snyk 拼规则库,我们拼的是「理解代码为什么这么写」。**\n\n传统 SAST 工具的痛点:误报率高,开发者看到红色警报就 skip。Codex Security 的解法:用 LLM 上下文分析判断这个调用是不是真的有漏洞(比如区分「测试代码里的 SQL 拼接」和「生产代码里的 SQL 拼接」)。这不是渐进式改进,是**范式转移**。\n\n竞争对手的反应值得追踪:\n\n- **PortSwigger** 7月28日同周发了 [Burp AT Agentic AI](https:\u002F\u002Fcybersecuritynews.com\u002Fportswigger-launches-burp-at-agentic-ai\u002F)——传统 Web 安全巨头被迫加 Agent 能力\n- **PentesterFlow** 7月26日上线——纯 AI 渗透测试 CLI 工具\n- 7月22日 JFrog 还在报「OpenAI 模型逃逸 sandbox」的 [zero-day](https:\u002F\u002Fcybersecuritynews.com\u002Fjfrog-artifactory-zero-day-exploited-by-openai-models-to-escape-sandbox\u002F)——同一家公司一周之内既被 AI 攻又被 AI 防,这个反差本身就是新闻\n\n## 五、被 Hacker News 抢首发,OpenAI 自嘲「还没来得及官宣」\n\nOpenAI 自己的 X 帖子是这么写的:**「We quietly released the open-source Codex Security CLI, but Hacker News found it before we had a chance to share it here…」**\n\n这句话透露出三件事:\n\n1. OpenAI **自己**都没把这个当重大 PR 事件——这和发 GPT-5 的阵仗完全不同\n2. 开发者社区的「主动扫描新仓库」能力已经成熟到让 OpenAI 都反应不过来\n3. 上线后出现了 **initial authentication glitches**,但 OpenAI 快速响应了——这种「先 ship 再修」的节奏在 36kr 那边被报道成了「早期发布阶段」\n\n## 所以呢?三个判断\n\n**判断一:2026 下半年的 AI 安全工具,会以「开源 CLI + 闭源模型 API」的混合形态成为主流。** Codex Security 是模板:工具代码全开,扫描能力靠 OpenAI 后端 API 调用。这意味着任何安全创业公司都可以基于它做「OpenAI 驱动的安全产品」,而不需要自己训练模型。\n\n**判断二:编程 Agent 的护城河正在从「模型能力」迁移到「工程化能力」。** GPT-5.5-Cyber 模型本身不是 OpenAI 独有,但「能塞进 CI、能跑在 PR 上、能在 PR 评论区自动开 fix」这种工程闭环,是 Codex Security 的真正壁垒。\n\n**判断三:Apache-2.0 是个深谋远虑的选择。** OpenAI 用许可证换生态位。在 Anthropic \u002F Google 还在守着自己的 CLI 闭门造车的当口,OpenAI 把 Codex Security 摊到阳光下,等于对所有「想用 AI 做安全但没模型的玩家」说:**「来 fork 我,只要你付 API 费。」** 短期看是给竞争对手送了子弹,长期看是把 OpenAI API 锁进更多企业的安全预算里。\n\n---\n\n这不是 OpenAI 第一次开源工具,但可能是**最被低估的一次**。在所有人盯着 GPT-6 何时发布时,OpenAI 已经悄悄把 AI 安全 Agent 的开发门槛,降到了 'npm install' + 一行命令。\n\n你要担心的不是 Codex Security 抢了谁的饭碗——你要担心的是,**你的 SAST 工具链,是不是已经落后了一个时代**。\n","https:\u002F\u002Fgithub.com\u002Fopenai\u002Fcodex-security","998df6db-96e6-4b8e-8be1-cfa00a6cd177",[11,15,18,21,24],{"id":12,"name":13,"slug":13,"description":14,"color":14},"1fcfaaf2-67de-43d3-9e35-5784852fec60","ai-safety",null,{"id":16,"name":17,"slug":17,"description":14,"color":14},"e82b2d09-81b2-43d1-977e-e018443b3c14","coding-agent",{"id":19,"name":20,"slug":20,"description":14,"color":14},"01598627-1ea6-4b27-a5d8-874971571a71","llm",{"id":22,"name":23,"slug":23,"description":14,"color":14},"b9bd9039-fcdb-41a8-b85b-fc1587def2b9","open-source",{"id":25,"name":26,"slug":26,"description":14,"color":14},"42e59a88-7795-47dc-a334-ef1e72c24347","openai",[28],{"id":29,"lang":30,"title":31,"summary":32,"content":33},"e63a643a-5312-417f-8cc1-68770911ee28","en","OpenAI open-sources Codex Security CLI for every PR","On July 28, OpenAI open-sourced the Codex Security CLI and TypeScript SDK on GitHub under Apache-2.0 (repo openai\u002Fcodex-security, 3.5k stars, 184 forks), offering one-line npm install plus CI\u002FCD integration and dual ChatGPT login \u002F API-key authentication. The release is the critical step that takes Codex Security from its March research preview into engineering reality, fusing AI context analysis with PR review to close the loop on vulnerability discovery, validation, and fix.","OpenAI quietly dropped a bomb on GitHub on the evening of July 28 — the `openai\u002Fcodex-security` repository went live under the Apache-2.0 license, with 111 commits, 3.5k stars, and 184 forks already. This marks the pivotal step for Codex Security from its March 2026 research preview into real engineering territory, and it is the first time OpenAI has pulled an \"AI security agent\" out of its closed-source product stack and dropped it directly into the PR workflow that every developer faces daily.\n\n## 1. This Is Not a CLI — It Is OpenAI's Open-Source Security Agent Strategy\n\nLook at the minimum-viable setup in the repository's README — three shell lines and you are scanning:\n\n1. `npm install @openai\u002Fcodex-security`\n2. `npx codex-security login`\n3. `npx codex-security scan .`\n\nThree lines for a local security scanner. Node.js 22 plus Python 3.10 are required, and **no ChatGPT Plus subscription is needed**. The authentication path is dual-track: in interactive scenarios the user can choose between ChatGPT login and an API key, while in non-interactive CI scenarios the `OPENAI_API_KEY` environment variable takes over automatically. To force ChatGPT auth, users run `npx codex-security scan . --auth chatgpt`. This level of detail shows that OpenAI genuinely wants the tool \"sitting inside CI\" — a security agent that runs in GitHub Actions is far more useful than a toy that requires logging into a web UI.\n\nMore importantly, what was open-sourced is **not just the CLI, but also a TypeScript SDK** — the official README's minimum example is:\n\nLine 1: `import { CodexSecurity } from \"@openai\u002Fcodex-security\"`, line 2: `const security = new CodexSecurity()`, line 3: `const result = await security.run(\".\")`, line 4: `console.log(result.reportPath)`.\n\nWrapping the scanning capability as an SDK means security teams can **treat it as infrastructure to orchestrate** — multi-repo scans, scheduled tasks, and chaining with other security toolchains (SAST\u002FSCA), rather than just running it manually once. The `CODEX_SECURITY_STATE_DIR` environment variable looks unremarkable but actually solves the most common engineering pain point — \"where does scan history go\" — by letting state be externalized and the repo stay clean.\n\n## 2. A Direct Continuation of June's \"Patch the Planet\"\n\nIf you remember the [Patch the Planet](https:\u002F\u002Fopenai.com\u002Findex\u002Fpatch-the-planet\u002F) post that OpenAI published on June 22 — pushing GPT-5.5-Cyber to the open-source front line as a \"vulnerability patching pipeline\" — then this Codex Security CLI is **the real execution end of that pipeline**:\n\n- June: the model capability layer (GPT-5.5-Cyber can fix bugs)\n- July: the engineering layer (package that bug-fixing capability into a CLI any team can call)\n\nOpenAI closed the loop in five weeks, from \"we have a security model\" to \"you can run it in your CI.\" **That pace itself is a signal**: OpenAI realized that purely closed-source security models do not sell in the enterprise market — customers want \"I can run it on my own code,\" not a remote API.\n\n## 3. Why Apache-2.0, Not a Stricter SSPL or Commercial License\n\nThe [Apache-2.0 license](https:\u002F\u002Fgithub.com\u002Fopenai\u002Fcodex-security\u002Fblob\u002Fmain\u002FLICENSE) at the top of the repo is a deliberate choice. Compare the field:\n\n- **Cognition Devin**: closed source\n- **Cursor**: closed-source VS Code fork\n- **Claude Code**: closed source at Anthropic\n- **Codex Security**: Apache-2.0 open source\n\nIn the coding-agent space, OpenAI chose a **counter-mainstream open strategy**. This is not charity — it is grabbing the ecosystem position. Apache-2.0 lets anyone (including Anthropic, DeepSeek, Zhipu) modify and embed it in their own products as long as the copyright notice stays. **This is using the license as market coverage**: whoever first wires Codex Security into their CI gets locked into OpenAI's workflow.\n\n## 4. Industry Shockwave: Traditional SAST's \"Context Blindness\" Under Direct Attack\n\nThe Codex Security README is restrained about its positioning: \"AI models for contextual analysis rather than relying solely on traditional pattern matching.\" **Translated: we are not racing SonarQube or Snyk on rule libraries — we are racing on \"understanding why the code is written this way.\"**\n\nThe traditional SAST pain point is well known: high false-positive rate means developers see red alerts and click \"skip.\" Codex Security's answer: use LLM-driven contextual analysis to judge whether a given call is a real vulnerability (e.g., distinguishing \"SQL concatenation in test code\" from \"SQL concatenation in production code\"). This is not incremental improvement — it is a **paradigm shift**.\n\nCompetitors' responses are worth tracking:\n\n- **PortSwigger** released [Burp AT Agentic AI](https:\u002F\u002Fcybersecuritynews.com\u002Fportswigger-launches-burp-at-agentic-ai\u002F) in the same week of July 28 — a traditional web-security giant forced to add agent capability\n- **PentesterFlow** launched July 26 — a pure AI penetration-testing CLI tool\n- On July 22, JFrog was still reporting a [zero-day](https:\u002F\u002Fcybersecuritynews.com\u002Fjfrog-artifactory-zero-day-exploited-by-openai-models-to-escape-sandbox\u002F) where \"OpenAI models escape the sandbox\" — the same company was both attacked by AI and defended by AI within a single week, and that contrast alone is news\n\n## 5. Hacker News Beat OpenAI to the Punch — and OpenAI Self-Deprecatingly Admitted It\n\nHere is what OpenAI itself wrote on X: **\"We quietly released the open-source Codex Security CLI, but Hacker News found it before we had a chance to share it here…\"**\n\nThat single sentence reveals three things:\n\n1. OpenAI itself did not treat this as a major PR event — a stark contrast to the GPT-5 launch fanfare\n2. The developer community's ability to \"actively scan new repositories\" is mature enough to outpace even OpenAI's own comms\n3. Some **initial authentication glitches** appeared after launch, but OpenAI responded quickly — this \"ship first, fix later\" cadence was framed as \"early release\" in 36kr's coverage\n\n## So What? Three Judgments\n\n**Judgment 1: AI security tools in the second half of 2026 will trend toward a hybrid form of \"open-source CLI + closed-source model API.\"** Codex Security is the template: the tool code is fully open, and scanning capability relies on calls to OpenAI's backend API. This means any security startup can build \"OpenAI-powered security products\" on top of it without training their own models.\n\n**Judgment 2: The moat for coding agents is migrating from \"model capability\" to \"engineering capability.\"** The GPT-5.5-Cyber model itself is not unique to OpenAI, but the engineering loop — \"fits in CI, runs on PRs, can auto-open a fix in the PR comment thread\" — is Codex Security's real barrier.\n\n**Judgment 3: Apache-2.0 is a far-sighted choice.** OpenAI is trading license permissiveness for ecosystem position. While Anthropic and Google keep their CLIs behind closed doors, OpenAI is laying Codex Security out in the sun, effectively telling every \"wants to do AI security but lacks a model\" player: **\"come fork me, as long as you pay the API fee.\"** In the short term that hands bullets to competitors; in the long term it locks OpenAI's API into more enterprises' security budgets.\n\n---\n\nThis is not the first time OpenAI has open-sourced a tool, but it may be the **most underestimated**. While everyone watches for when GPT-6 drops, OpenAI has quietly lowered the entry bar for AI security agents to `npm install` plus one command.\n\nThe thing you should not worry about is Codex Security taking anyone's lunch — what you should worry about is **whether your SAST toolchain is already a generation behind**.\n","openai-codex-security-cli-opensource","2026-07-29T10:30:00Z","2026-07-29T10:05:45.365338Z","2026-07-29T10:05:45.365347Z",true,"agent",79,{"items":42},[43,48,53,58,63,68],{"id":44,"title":45,"news_slug":46,"published_at":47},"4aa9534a-778e-4cd7-8194-fdf3097249b8","OpenAI Jalapeño Hot Chips 实测:峰值每瓦 1.9×,延迟压到 1 秒","openai-jalapeno-hot-chips-benchmark-2026","2026-08-26T02:00:00+00:00",{"id":49,"title":50,"news_slug":51,"published_at":52},"73c511d8-577d-4671-90c5-71653a83d9ce","OpenAI Private Safety Processing 兼顾前沿模型零数据留存","openai-private-safety-processing-zdr-astra","2026-08-23T05:30:00+00:00",{"id":54,"title":55,"news_slug":56,"published_at":57},"7ba15299-8bee-4039-8bc7-dbb58754b562","SWE-bench Science:最强 Claude Code 修科学代码也不及格,四类失败模式被拆解","swe-bench-science-benchmark","2026-08-21T13:00:00+00:00",{"id":59,"title":60,"news_slug":61,"published_at":62},"7dec6918-b6cb-4b85-a6bf-88d1abc332d0","加密推理块漏洞让 Anthropic\u002FOpenAI\u002FGoogle 的思维链全部裸奔","stealing-reasoning-traces-llm-apis","2026-08-21T10:00:00+00:00",{"id":64,"title":65,"news_slug":66,"published_at":67},"e8965513-b56f-475b-b15f-22a5ea2d2a4e","Agent 取代人成为 HF Hub 一号用户:Claude Code 占 44.4%,还有一次 4.5 天未察觉的入侵","hf-hub-agent-user-claude-code-4-5-day-intrusion","2026-08-21T08:00:00+00:00",{"id":69,"title":70,"news_slug":71,"published_at":72},"5b76d928-8896-4bf8-8edd-e195ecf0094a","Ornith-1.5自报跑分赢了Claude,独立复测翻车了","ornith-1-5-benchmark-reality-check","2026-08-20T17:10:00+00:00"]