OpenAI's security plugin for Codex, its coding agent. It scans a whole repository, one folder or a single change for vulnerabilities, checks which findings are real, and gives you the evidence and fix guidance for each. It can also judge findings you already have, fix and re-check them, and file them as tickets.
Codex Security is a set of 15 skills that Codex follows when you ask for security work, plus a server Codex starts on your computer to run and track scans. Ask Codex to scan a repository and it maps how the code could be attacked, looks for vulnerabilities, checks which ones are real, and writes a report with the evidence and fix guidance for each.
Showing all 15 skills
A standard scan of a repository or one folder, a deep scan that repeats it, and a security review of a single change.
Codex Security's default scan: it reads a whole repository, or one folder or package, maps where the code could be attacked, looks into each security question it finds, and checks the findings. It finishes with report.md, which gives the evidence and fix guidance for each finding.
A longer, more thorough scan of a repository or one folder: it runs the standard scan several times independently and merges the confirmed findings into one report. By default it can run for up to 96 hours; you can close the chat and rejoin the same scan later.
Reviews one change for security holes: a pull request, a commit, a branch's changes or edits not yet committed. It reads every changed source file, deleted ones included, and follows the change into the code it relies on without turning into a whole-repository audit, then reports with review comments for each confirmed finding.
The stages a change review runs in order: describe how the code could be attacked, list suspected vulnerabilities, test them, and judge which an attacker could really reach. Each can also be asked for on its own.
Writes down how a repository could realistically be attacked: how it is built, what an attacker could do, where it trusts outside input, and what could go wrong. It saves the result as threatmodel.md and reuses a saved model as long as the code version has not changed.
The search step of a security review: it reads the code, or the files a change touched, and lists every plausible vulnerability with where it sits, how an attacker's input reaches it and why it looks wrong. Deciding which ones are real is left to the validation step.
Tests each suspected vulnerability to see whether it is real. Where it can, it builds the project or a small test and tries to trigger the bug; otherwise it traces the path through the code. Every suspect gets a verdict, the evidence behind it and any proof still missing.
Takes findings that look real and works out whether an attacker could actually reach them: where they would get in, what access they would need and what they would gain. It then rates how severe each one is and decides whether it is worth reporting.
Judge findings from other tools against your code, fix one, check that a fix worked, and file findings as tickets.
Checks security findings you already have against your code and gives each one a verdict: confirmed, not actionable or needs review. It takes scanner reports, CVEs and advisories, GitHub alerts, bug bounty reports and Jira or Linear tickets, reads your SECURITY.md first, and ranks the confirmed ones by how easily they could be exploited.
Fixes one security finding with the smallest change that fully closes it, then checks the fix: it reruns the attack, makes sure normal use still works and runs the project's own checks. If the code turns out to be safe already, it says so and changes nothing.
Checks whether a security fix really closed the reported vulnerability in your current code. It traces the original attack through the code as it is now, runs tests only when that changes nothing, and gives each finding a verdict, fixed, still vulnerable or inconclusive, with the evidence.
Files confirmed findings from one finished scan as issues in Linear, Jira or GitHub, or as a private draft GitHub security advisory. It checks for an existing ticket first, shows you exactly what it will write, and writes only after you approve.
Write a vulnerability report, propose design-level hardening, set the SECURITY.md that guides scans, and weigh a patch's risk before it merges.
Writes a vulnerability report another security researcher can check and, where safe, reproduce, from your notes, a disclosure, a proof of concept, source code or Codex Security findings. It treats each claim as unproven until the source supports it, works out which released versions are affected, and never invents a test result or version.
Proposes design-level changes that stop a whole class of vulnerability from coming back, rather than patching each finding. From scan results, disclosures or your own findings it writes a proposal with a few distinct options, before-and-after diagrams, the costs of each and a migration plan. It changes no code until you pick an option and ask.
Writes or reviews the SECURITY.md file that tells Codex Security what matters in a repository: what the system is, who could attack it, which security rules must hold, what counts as a finding and what is out of scope. It asks a few focused questions, shows the exact change, and writes only after you approve.
Judges what could go wrong if a patch merges: which parts of the program it reaches, how likely it is to break something, whether tests would catch that and how easily it could be undone. It returns one recommendation, merge, revise, no change needed, block or hold for more evidence, and never edits, applies or merges the patch.
The plugin's own server, which Codex starts on your computer from the installed plugin folder. Codex Security's scan skills call it to start, track and finish every scan.
starting a standard, deep or change scan, or rejoining one that is still running
saving progress as results arrive, so a stopped scan keeps what it found
notes you add while a scan runs, used from its next step
finishing a scan: checking its files, writing report.md and indexing the findings
It ships only inside the plugin and has no separate install: installing the plugin brings it.
It works in the Codex command line and in Codex inside the ChatGPT desktop app. The desktop app adds Security to the sidebar, where scans, findings and each repository's scan history stay in one place.
Each scan saves report.md, the readable summary, with folders for detailed findings and hardening advice, and JSON files for other tools. Keep the scan folder together when you share it, so the report's links keep working.
Running scans needs Codex Security access on your account, and OpenAI recommends one verified for Trusted Access for Cyber. Scan only code you own or have permission to assess. For the best results OpenAI suggests the gpt-5.6-sol model with xhigh reasoning effort.
As of 8 October 2026, Codex installs version 0.1.32 of the plugin, and its manifest gives the license as Proprietary. OpenAI's GitHub repository is at version 0.1.95 under the Apache-2.0 license, and the instructions of five skills there differ in places from the installed copy.
To scan GitHub repositories connected to Codex cloud, install the separate Codex Security Cloud plugin instead.
INSTALL
Codex
Start codex in your terminal from the repository you want to scan, then type /plugins. This installs the copy of Codex Security in OpenAI's official Codex marketplace, kept in OpenAI's own plugins repository.
/pluginsInstallation and loading
Good to know
Codex Security CLI
Run both lines in a terminal, not inside Codex. They run OpenAI's Codex Security command-line tool through npx, without a global install, and sign you in with your ChatGPT account.
Install checklist
npx @openai/codex-security --versionnpx @openai/codex-security loginInstallation and loading
Good to know