OpenAI, Open-Sourced

marsbitPubblicato 2026-07-30Pubblicato ultima volta 2026-07-30

Introduzione

OpenAI has open-sourced its code security tool, Codex Security CLI. The tool, which originated from the private beta project Aardvark in October 2025, is designed to automatically discover, verify, and fix vulnerabilities in codebases. It functions as an application security agent, first analyzing a repository to build a threat model, then identifying and ranking vulnerabilities based on real-world impact, and finally testing them in a sandbox for validation. According to OpenAI, in its first 30 days, the tool scanned over 1.2 million commits, uncovering 792 critical and 10,561 high-severity vulnerabilities, with a reported reduction of over 50% in false positives upon repeated scans of the same repositories. However, initial user experiences on platforms like Hacker News highlighted significant issues, particularly concerning cost and reliability. Developers reported failed scans that consumed substantial portions of API rate limits and incurred high expenses, with one user noting a cost of approximately $13 for an aborted run. The high cost is attributed to the tool's default configuration, which uses the premium GPT-5.6-sol model with inference intensity set to "extra-high." The release follows public statements by NVIDIA's Jensen Huang advocating for open-source AI. While OpenAI has open-sourced the application-layer CLI and SDK, the core AI models remain proprietary. The move opens the door for community development and potential adaptations of the tool.

OpenAI has finally become "Open" once again!

Recently, OpenAI officially announced: it has quietly released an open-source code security tool—Codex Security CLI.

Previously, someone on Hacker News discovered it first, sparking instant discussions, and GitHub stars surged to 1.2k.

Seeing that it could no longer be kept hidden, OpenAI had no choice but to come forward and claim it.

GitHub address: https://github.com/openai/codex-security

A few days ago, Jensen Huang personally stepped in, publicly expressing strong support for open-source AI, and soon after, OpenAI officially joined the camp.

Little did we expect that the surprise would come so quickly, as the heavyweight open-source masterpiece was unveiled almost instantly.

It has to be said, Huang's words still carry significant weight!

OpenAI's Code Security Tool is Now Open-Source

The "star" of this open-source release is codex-security, comprising a CLI and a TypeScript SDK.

Its core functionality is very straightforward, focusing on a "combo punch": automatically discovering vulnerabilities in a codebase, verifying them, and fixing them.

It's designed to be ready-to-use; the entire workflow can be run with just three lines of commands:

  • npm install @openai/codex-security
  • npx codex-security login
  • npx codex-security scan .

For CI runs, logging in isn't required; just configure an OPENAI_API_KEY.

The requirements are Node.js 22 or higher, Python 3.10 or higher, plus access to Codex Security.

1.2 Million Commits, 792 Critical Vulnerabilities

Strictly speaking, Codex Security isn't a completely "new species".

It evolved from the private beta project Aardvark in October 2025 and was renamed and launched as a research preview version on March 6th this year.

The most hardcore aspect of this tool lies in its positioning—an application security agent.

Codex Security truly dives deep into the underlying code to understand what your system is actually doing. Its workflow is divided into three steps:

First, it reads the entire repository to generate an editable threat model, figuring out what the project does and where it's most exposed;

Then, based on this context, it searches for vulnerabilities and ranks them by their real-world impact;

Finally, it throws suspicious issues into a sandbox for real stress testing, only reporting those that can be verified.

Looking at its track record, it's indeed quite formidable.

In its first 30 days online, it scanned over 1.2 million commits, uncovering 792 critical severity findings and 10,561 high severity findings.

OpenAI also mentioned that for the same batch of repositories scanned repeatedly, the false positive rate dropped by over 50%.

The First Batch of Early Adopters, Bills Exploded

No matter how grand the official promises are, they can't compare to the "real-world test disasters" that immediately surfaced among developers.

On HN, a developer named gregwebs tested it on a small repository and directly posted the utterly devastating terminal logs.

Preparation started at 0:03, scanning began at 1:20, ran all the way to 52:47, and finally, a line of red text popped up—the repository HEAD changed during scanning, please start over.

Not only did it waste an hour, but this single run also consumed half of his Pro plan's weekly quota.

Another user, Quai, had it worse. The scan hit account rate limits right after starting, and the tool retried for a minute before giving up.

The tool did hint that "partial results have been preserved," but he couldn't find an obvious way to use them in the next scan. This failed run cost about $13.

Why is it so expensive? Just look at the default configuration and the answer becomes clear.

Codex Security defaults to calling gpt-5.6-sol and brutally cranks the "reasoning effort" up to extra-high.

It's important to know that Sol is the most "premium" tier in the GPT-5.6 family, with API pricing as high as $5 per 1M input tokens and $30 per 1M output tokens.

Huang Kicked Things Off, OpenAI Took a Step

Just after Jensen Huang publicly voiced strong support for open-source AI, OpenAI brought out Codex Security.

However, don't interpret this "open-source" move as too generous just yet.

OpenAI's step is quite calculated: they've open-sourced the application-layer shell, while the model layer is still tightly held in their own hands.

Regardless, the Pandora's box of agents taking over code security has been opened.

Next, it's up to developers to see how they can hack and modify this open-source artifact, using the magic of the community to counter OpenAI's own magic.

References:

https://x.com/gdb/status/2082235089539526690?s=20

https://x.com/OpenAI/status/2082263717916586117?s=20

This article is from WeChat public account "AI Era", author: ASI Revelations

Domande pertinenti

QWhat did OpenAI recently open-source, and what is its primary function?

AOpenAI recently open-sourced Codex Security CLI, a tool designed to automatically detect, validate, and fix security vulnerabilities in codebases.

QWhat commands are needed to run the basic workflow of the open-sourced tool?

AThe basic workflow requires three commands: `npm install @openai/codex-security`, `npx codex-security login`, and `npx codex-security scan .`.

QWhat were some of the early user complaints regarding the Codex Security tool?

AEarly users complained about high costs, slow scans, account rate-limiting, and the tool's default use of the expensive `gpt-5.6-sol` model with the `extra-high` reasoning setting.

QAccording to the article, what significant results did Codex Security achieve in its first 30 days?

AIn its first 30 days, Codex Security scanned over 1.2 million commits and identified 792 critical and 10,561 high-severity findings.

QHow does the article characterize the nature of OpenAI's 'open-sourcing' of Codex Security?

AThe article characterizes it as a strategic move where OpenAI open-sourced the application layer (the CLI/SDK) but keeps the core model layer proprietary and under its control.

Letture associate

SemiAnalysis on the Epic Plunge: It's Not Over Yet

SemiAnalysis Weekly discusses the recent sharp correction in the semiconductor market after a historic first half. Analysts Doug O'Loughlin and Dylan note that despite healthy fundamentals, markets like South Korea's KOSPI have plunged 40%, wiping out leveraged retail investors. A core debate focuses on AI demand versus supply constraints. Dylan cites SemiAnalysis's internal use of AI coding agents, leading to a 100x increase in AI spending, as evidence of powerful demand. Doug agrees demand is strong but questions its exact magnitude, calling it a "trillion-dollar question." His primary concern is physical and financial bottlenecks: a shortage of 100,000 electricians in the US, massive $450B in corporate debt issuance by hyperscalers (funded by a shrinking pension pool), and labor/scale limits in regions like Taiwan, where TSMC constitutes 20% of GDP. The conversation covers market dynamics, including the typical semiconductor cycle where over-ordering leads to crashes, China's growing memory capacity, and the potential for older chips like the H100 to lose value as models scale. Politically, AI is seen as a likely scapegoat in upcoming elections, though not a top-tier voter priority. The analysts conclude that while the long-term potential is significant, the scaling path is narrowing. The challenge is matching exponential compute demands with real-world constraints on capital, labor, and permits, risking scenarios where massive investment outpaces near-term revenue generation.

marsbit30 min fa

SemiAnalysis on the Epic Plunge: It's Not Over Yet

marsbit30 min fa

After Robinhood's Aggressive Entry, Why is PUMP Defying the Trend and Rising?

Amid a prolonged crypto bear market that has strained many projects, Pump.fun stands out by maintaining strong profitability. Despite a major token unlock in mid-July that was expected to cause selling pressure, its native token PUMP has risen nearly 48% over the past month. Analysis shows only a small portion of unlocked tokens were sold, with 92% of investor allocations still held. A buyback-and-burn mechanism has also supported the price, though daily回购 funds have declined by 77.5% from their peak, partly due to a change in tokenomics and lower platform revenue. Pump.fun remains a top revenue generator in crypto, with annualized revenue of around $450 million, ranking just behind giants like Tether and Circle. However, its daily revenue is down about 69% from its all-time high, reflecting dependence on meme coin market cycles. The platform also faces a class-action lawsuit alleging market manipulation and securities violations. New competition has emerged with Robinhood Chain's launchpad, which recently saw higher weekly volume and active addresses than Pump.fun. While Pump.fun's metrics haven't declined yet, it has responded with a new token launch mechanism called BOOST to improve liquidity. This has increased platform activity but raised community concerns about potential exploitation for short-term pumps. Ultimately, Pump.fun's success remains tightly linked to meme coin speculation and broader market sentiment.

marsbit31 min fa

After Robinhood's Aggressive Entry, Why is PUMP Defying the Trend and Rising?

marsbit31 min fa

Aave Gradually Phasing Out 75 Low-Utilization Reserve Assets! Here Are the Details

The leading decentralized finance (DeFi) lending protocol, Aave, has announced a major restructuring to improve platform efficiency. Founder Stani Kulechov stated the protocol will gradually phase out underutilized assets and scale back operations on certain blockchains. Specifically, Aave plans to cease support for 50 underused reserve assets on its native network and an additional 25 reserve assets across the Sonic, Scroll, zkSync, Metis, Soneium, and Aptos networks, totaling 75 assets. Management explained this move aims to allocate resources more efficiently and focus on assets with higher user demand. The restructuring will affect approximately $98.1 million in reserve assets and $15.6 million in loan positions. Aave stated the phase-out will be gradual, with transition plans to minimize user disruption. Experts note that periodically removing low-liquidity or underused assets is common in DeFi to reduce maintenance costs and enhance security and operational efficiency. As one of the world's largest DeFi protocols by Total Value Locked (TVL), Aave's decision may cause short-term liquidity shifts in affected assets but is viewed as a step toward building a more efficient and sustainable ecosystem in the long term.

cryptonews.ru56 min fa

Aave Gradually Phasing Out 75 Low-Utilization Reserve Assets! Here Are the Details

cryptonews.ru56 min fa

Robinhood posts record quarter as crypto revenue slides 38%

Robinhood reported record second-quarter revenue of $1.31 billion, a 32% year-over-year increase, and net income of $573 million. However, cryptocurrency transaction revenue fell 38% to $100 million. Despite this decline, growth in other areas like event contracts, options, and equities more than offset the crypto slowdown. The company also expanded its crypto ecosystem, completing the WonderFi acquisition and launching its Robinhood Chain layer-2 network. Robinhood saw record net deposits of $21.7 billion and raised its full-year outlook for adjusted EBITDA.

cointelegraph1 h fa

Robinhood posts record quarter as crypto revenue slides 38%

cointelegraph1 h fa

China Business Journal Unveils Cryptocurrency Extortion Scheme

China Business Journal, a state-run Chinese newspaper, has issued a warning about scammers using its name to extort cryptocurrency from companies. According to the publication, fraudsters are sending emails impersonating its journalists. These emails threaten to publish damaging information about a company unless a Bitcoin payment is made. The scammers, using Proton Mail addresses, claim to possess compromising material from a secretive investigation. The newspaper's representatives have clarified that it has no involvement with these messages. They emphasized that the publication does not engage in such practices, never demands payment to suppress stories, and does not negotiate in this manner. The editorial team believes the criminals are exploiting the newspaper's authoritative reputation to pressure companies into making hasty decisions under threat of reputational harm. China Business Journal stated it is collecting evidence of this brand misuse, analyzing the fraudulent emails, and preparing materials for law enforcement. It reserves the right to pursue both civil and criminal liability against the scheme's organizers. Companies are urged to carefully verify any communication purportedly from the newspaper, avoid transferring cryptocurrency to unknown recipients, and report such incidents to the authorities. The newspaper confirmed it will continue its own investigation into the matter.

cryptonews.ru1 h fa

China Business Journal Unveils Cryptocurrency Extortion Scheme

cryptonews.ru1 h fa

Trading

Spot
活动图片