OpenAI has open-sourced the Codex Security tool, but vulnerability scanning still requires account permissions.

According to the Beating Motion Detection, OpenAI has open-sourced the Codex Security command-line tool and TypeScript SDK. Developers can install it on their machines to scan code repositories, check incoming code changes, log each finding, and integrate security checks into their company's automated development workflow.

Codex Security reads through the entire project to identify potential attack vectors. Upon discovering issues, it also attempts to replicate them in an isolated environment to confirm the existence of the vulnerabilities. It then provides fix suggestions for developers to review.

The open-source release includes the tooling code for running and managing scanning tasks. Anyone can view, modify, and redistribute it. The actual Codex Security service responsible for code analysis, vulnerability validation, and fix generation is still operated by OpenAI.

Therefore, downloading the source code does not equate to having access to the full functionality. Users still need to log in with their OpenAI accounts and obtain Codex Security permissions. Currently in a research preview stage, it is available to ChatGPT Pro, Business, Edu, and Enterprise users, with the possibility of requiring admin approval for Enterprise accounts.