Codex is OpenAI's answer to Claude Code: a coding agent that lives in your terminal, reads your repository, proposes and applies changes, runs commands and iterates on the results. This repository is the agent itself, rewritten in Rust for speed and a small footprint, and open under Apache 2.0, which is unusual for a vendor agent and the reason it is on a list of GitHub tools rather than a list of products.
Its distinguishing feature is the approval and sandbox model. Commands run under OS-level sandboxing (Seatbelt on macOS, Landlock and seccomp on Linux) with network access off by default, and three approval modes decide how much the agent may do before asking. It works with a ChatGPT subscription or an API key, and the same core powers the Codex features in ChatGPT and the IDE extensions.
- Repository: github.com/openai/codex
- Licence: Apache-2.0 (Apache License 2.0)
- Language: Rust. Stars: 124.7K. Forks: 19.3K. Last push: Sep 16, 2026.
- Scan: clean, read the notes, Sep 16, 2026, commit 4701aa4
Who it is for
Developers already paying for ChatGPT who want an agent in the terminal at no extra cost, teams standardising on OpenAI models, and anyone who wants to read how a production coding agent handles sandboxing.
Getting started
1. Install with npm or Homebrew
npm install -g @openai/codex2. Or on macOS
brew install --cask codex3. Start it in a repository and choose Sign in with ChatGPT, or use an API key
cd your-project && codexSafety scan
We cloned openai/codex at commit 4701aa4 on Sep 16, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets: all 31 candidates are synthetic tokens and test RSA keys inside #[cfg(test)] blocks, most of them in the tests for the credential broker and the output sanitizer that redact real ones.
- The pattern hits are the sandbox policy recognising powershell -EncodedCommand as a command to treat with care, the Windows sandbox's own tests, and three generated TypeScript schema files with long lines.
- scripts/install/install.sh and install.ps1 download a release binary from GitHub or releases.openai.com and add it to your PATH by editing your shell profile. Seven Cargo build scripts compile native pieces; one CI helper uses sudo on the runner, not on your machine.
- Known advisories: none critical, across the Rust and npm lockfiles. The high ones cluster in gix (gitoxide), the Git implementation Codex uses, and concern submodule and symlink handling in repositories you do not control. Codex works in your own checkouts; cloning a hostile repository through it is the case they describe.
- 30 workflows, one pull_request_target for the CLA check, all 62 third-party actions pinned to a commit, Dependabot on, security policy present.
- It talks to chatgpt.com and api.openai.com. Sandboxed commands have network access off unless you enable it.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | 31 candidates found and read; see the notes above. |
| Suspicious code | 11 pattern hits found and read; every one is listed under the raw findings. |
| Install-time code | 1 npm lifecycle script. 7 Cargo build scripts. 14 installer scripts (one edits your shell profile; one can call sudo) |
| Committed binaries | None. |
| CI workflows | 30 workflows. 1 uses pull_request_target, none check out the pull request head. 0 of 62 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often github.com, chatgpt.com, example.test, api.openai.com. 2 URLs to a bare IP address, listed under the raw findings. |
| Known vulnerabilities | 114 advisories across 2,185 pinned packages: 0 critical, 50 high, 45 moderate, 6 low, 13 unrated. .github/actions/publish-dotslash/requirements.txt: 1 packages, 0 advisories; codex-rs/Cargo.lock: 1,491 packages, 38 advisories; pnpm-lock.yaml: 591 packages, 61 advisories; scripts/codex_package/smoke_tests/uv.lock: 13 packages, 0 advisories; scripts/uv.lock: 2 packages, 0 advisories; sdk/python-runtime/uv.lock: 1 packages, 0 advisories; sdk/python/uv.lock: 32 packages, 9 advisories; tools/argument-comment-lint/Cargo.lock: 175 packages, 7 advisories. |
| Project hygiene | Has security policy, automated dependency updates, licence file. Missing CodeQL, contributing guide. |
| OpenSSF Scorecard | 6.0 out of 10, as of Sep 14, 2026. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Secret candidates (31, redacted)
Pattern hits (11)
| Where | Rule | Match |
|---|---|---|
| codex-rs/app-server-protocol/schema/typescript/ClientRequest.ts:107 | very-long-line | 8796 chars |
| codex-rs/app-server-protocol/schema/typescript/ServerNotification.ts:90 | very-long-line | 7204 chars |
| codex-rs/app-server-protocol/schema/typescript/ServerNotificationEnvelope.ts:100 | very-long-line | 7199 chars |
| codex-rs/core/src/exec_policy.rs:107 | powershell-encoded | &["powershell", "-EncodedCommand"], |
| codex-rs/core/src/exec_policy.rs:112 | powershell-encoded | &["powershell.exe", "-EncodedCommand"], |
| codex-rs/core/tests/suite/apply_patch_cli.rs:1435 | powershell-encoded (test/example) | "powershell.exe -NoLogo -NoProfile -NonInteractive -EncodedCommand {encoded}" |
| codex-rs/linux-sandbox/tests/suite/managed_proxy.rs:624 | raw-socket-shell (test/example) | "proxy=\"${WSS_PROXY#*://}\"; host=\"${proxy%%:*}\"; port=\"${proxy##*:}\"; exec 3<>/dev/tcp/${host}/${port}; printf 'GET http://example.com/ HTTP/1.1\\r\\nHost… |
| codex-rs/linux-sandbox/tests/suite/managed_proxy.rs:656 | raw-socket-shell (test/example) | &["bash", "-c", "echo hi > /dev/tcp/192.0.2.1/80"], |
| codex-rs/linux-sandbox/tests/suite/managed_proxy.rs:930 | raw-socket-shell (test/example) | "exec 3<>/dev/tcp/${proxy%:*}/${proxy##*:}; ", |
| codex-rs/windows-sandbox-rs/src/winutil.rs:337 | powershell-encoded | "\"C:\\Program Files\\PowerShell\\7\\pwsh.exe\" -NoProfile -EncodedCommand abc==" |
| codex-rs/windows-sandbox-rs/src/winutil.rs:343 | powershell-encoded | "cmd.exe /c \"\\\"C:\\Program Files\\PowerShell\\7\\pwsh.exe\\\" -NoProfile -EncodedCommand abc==\"" |
URLs to bare IP addresses (2)
| Where | Rule | Match |
|---|---|---|
| codex-rs/core/tests/suite/network_approval.rs:2077 | ip-literal-url | let command = "python3 -c \"import urllib.request; opener = urllib.request.build_opener(urllib.request.ProxyHandler()); print('OK:' + opener.open('http://1.1.1.… |
| codex-rs/network-proxy/src/credential_broker/configured_tests.rs:252 | ip-literal-url | ("https://172.32.2.3/v1", false), |
npm lifecycle scripts (1)
sdk/typescript/package.jsonprepare:pnpm run build
Installer scripts (14)
- .github/actions/setup-msvc-env/setup-msvc-env.ps1, 258 lines
- .github/scripts/install-musl-build-tools.sh, 291 lines, uses sudo; talks to mirrors.edge.kernel.org
- .github/scripts/install-musl-openssl.sh, 52 lines; talks to github.com
- .github/scripts/run-argument-comment-lint-bazel.sh, 58 lines
- .github/scripts/run-bazel-ci.sh, 421 lines
- .github/scripts/run-bazel-query-ci.sh, 43 lines
- .github/scripts/setup-dev-drive.ps1, 64 lines
- .github/scripts/setup-voice-windows.ps1, 97 lines; talks to cygwin.com, github.com
- codex-cli/scripts/run_in_container.sh, 96 lines
- codex-rs/scripts/setup-windows.ps1, 247 lines
- scripts/install/install.ps1, 1,195 lines; talks to api.github.com, github.com, releases.openai.com
- scripts/install/install.sh, 1,306 lines, edits your shell profile; talks to api.github.com, github.com, releases.openai.com
- scripts/run_tui_with_exec_server.sh, 62 lines
- scripts/start-codex-exec.sh, 186 lines, uses sudo
Worst known vulnerabilities (24 of 114)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-f26g-jm89-4g65 | high | gix@0.81.0 | gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execu… |
| GHSA-fr8x-3vfx-f45h | high | gix@0.81.0 | gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another rep… |
| GHSA-p3hw-mv63-rf9w | high | gix@0.81.0 | gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure |
| GHSA-pg4w-g64p-qwhj | high | gix@0.81.0 | gix and gitoxide's symlinked .gitmodules are followed and parsed from outside of the repository |
| GHSA-f89h-2fjh-2r9q | high | gix-fs@0.19.2 | gix-fs: Symlink prefix-reuse allows worktree escape during checkout |
| GHSA-x494-mj8g-cj27 | high | gix-pack@0.68.0 | gix-pack has multiple DoS vectors: unchecked indexing panics and uncapped OOM allocations from crafted pack data |
| GHSA-p3hw-mv63-rf9w | high | gix-validate@0.11.0 | gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure |
| GHSA-3v94-mw7p-v465 | high | hickory-proto@0.25.2 | hickory-proto: NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses |
| GHSA-8c75-8mhr-p7r9 | high | openssl@0.10.75 | rust-openssl has incorrect bounds assertion in aes key wrap |
| GHSA-ghm9-cr32-g9qj | high | openssl@0.10.75 | rust-openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check |
| GHSA-hppc-g8h3-xhp3 | high | openssl@0.10.75 | rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer |
| GHSA-pqf5-4pqq-29f5 | high | openssl@0.10.75 | rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1 |
| GHSA-xp3w-r5p5-63rr | high | openssl@0.10.75 | rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs |
| RUSTSEC-2026-0194 | high | quick-xml@0.39.4 | Quadratic run time when checking a start tag for duplicate attribute names |
| RUSTSEC-2026-0195 | high | quick-xml@0.39.4 | Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service |
| GHSA-3jxr-9vmj-r5cp | high | brace-expansion@1.1.12 | brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups |
| GHSA-mh99-v99m-4gvg | high | brace-expansion@1.1.12 | brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash |
| GHSA-rgw5-rvv9-x895 | high | brace-expansion@1.1.12 | brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation |
| GHSA-3jxr-9vmj-r5cp | high | brace-expansion@5.0.5 | brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups |
| GHSA-mh99-v99m-4gvg | high | brace-expansion@5.0.5 | brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash |
| GHSA-rgw5-rvv9-x895 | high | brace-expansion@5.0.5 | brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation |
| GHSA-73wf-gq98-2v4g | high | browserslist@4.26.2 | Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats) |
| GHSA-c83g-rgw3-j3cx | high | browserslist@4.26.2 | Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM |
| GHSA-4c8g-83qw-93j6 | high | fast-uri@3.1.1 | fast-uri vulnerable to host confusion via failed IDN canonicalization |
Workflows worth a look
- .github/workflows/cla.yml: pull_request_target
By the numbers
| Stars | 124.7K |
|---|---|
| Forks | 19.3K |
| Contributors | 610 |
| Commits | 10.8K |
| Open issues | 17.2K |
| Open pull requests | 6 |
| Releases | 1,085 |
| Latest release | rust-v0.154.0 |
| Licence | Apache-2.0 |
| Main language | Rust |
| Project age | 1 year |
| Last push | Sep 16, 2026 |
| Tracked files | 8,142 |
| Lines of code | 2.1M |
| Checkout size | 80 MB |
Lines by language: Rust 1.8M, JSON 158.3K, Python 57.8K, Markdown 14.3K, TypeScript 12.1K, YAML 9,306.
Questions
Is Codex CLI free?
The software is Apache-2.0 and free. Using it needs either a ChatGPT plan (Plus, Pro, Team, Edu or Enterprise, with usage included in the plan) or an OpenAI API key billed per token. It only talks to OpenAI's models.
Codex CLI or Claude Code?
They do the same job with different models and different defaults. Codex is open source, sandboxes commands at the OS level by default, and is the natural choice on a ChatGPT plan. Claude Code is closed source, uses Anthropic's models, and is the natural choice on a Claude plan. Many developers keep both and use cost-xray to see what each actually costs.
Does Codex send my code to OpenAI?
Yes. Like any hosted-model agent, the files it reads and the commands' output are sent to the model as context. The sandbox limits what the agent can do on your machine, not what it sends. If that is not acceptable, OpenHands with a local model is the self-hosted alternative on this list.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.