openai/codex-security

Everything Fervor AI has published that touches openai/codex-security — 3 pieces, newest first.

• Broccoli2Shell Is the Node.js Bug Your Dependency Scanner Can't See

  Broccoli2Shell lives in a decoder bundled inside the runtime, so the fix is a Node or Python wheel version rather than a package bump, and a patched Node still reports…

• Briefing · October 25, 2026 · afternoon

  AI now turns up bugs and claims faster than anyone checks them or ships the fix, so the useful work this weekend sits in the second step.

• OpenAI's codex-security Refuses to Write Its Findings Inside Your Repo

  Codex-security's most instructive design choices are about its output rather than its detection, because a validated AI scan produces a ranked and reproducible attack…