OpenAI's public openai/codex-security repository is a useful marker for where application security automation is heading. The repo describes a CLI and TypeScript SDK for Codex Security that can scan repositories, review code changes, track findings over time, and run security checks in CI. It requires Node.js 22 or later, Python 3.10 or later, and access to Codex Security.
The product source adds the more important detail: Codex Security is designed to build project context, generate an editable threat model, validate issues in sandboxed environments when available, and propose fixes with surrounding system intent in mind. OpenAI says the beta reduced noise by 84 percent in one repository, cut over-reported severity by more than 90 percent, and reduced false positives by more than 50 percent across repositories.
Grey Haven's read: this is not just a better scanner. It is the beginning of security agents acting as evidence-producing reviewers. That changes the control surface. Teams need to know what context the agent used, what it assumed about trust boundaries, whether a finding was reproduced, what tests were rerun, and why the proposed patch does not break adjacent behavior.
The operator implication is blunt: do not buy or deploy agentic AppSec on the promise of fewer alerts alone. Require threat-model editability, validation artifacts, false-positive feedback, CI behavior, state storage rules, and PR-level review evidence. If the agent cannot show its work, it is still a noisy scanner wearing an agent badge.
Watch whether these tools become integrated into existing security review queues or create a second queue that nobody owns. Source: OpenAI public Codex Security repository and OpenAI Codex Security preview.
