Week 45, updated 2 Nov 2026

Coding agents Codex

Is Codex safe?

Short answer: Caution. StackGrade's weekly scan of openai/codex gives it a Caution label for 4 critical-severity known vulnerabilities in runtime dependencies (OSV). It does list 47 high-severity advisories in runtime dependencies, which don't change the label. Critical advisories are counted once per package; a known issue in a locked package version does not prove Codex is exploitable in your setup. Automated scan of commit a098129 on 2 Nov 2026, not a manual audit.

Updated : the last week its score, rank or safety result changed.

OpenAI's lightweight coding agent that runs in your terminal.

  • 132,785 stars
  • pushed 1 Nov
  • Apache-2.0
  • Rust

github.com/openai/codex

58score out of 100

#16of 52 overall#6in Coding agents▲ 2 vs Week 44

  • Maintenance 30%74
  • Adoption 30%74
  • Docs 20%10
  • Community 20%–
W42W43W44W45

Score over the last 4 weeks: 56, 60, 56, 58.

Caution

4 critical-severity known vulnerabilities in runtime dependencies (OSV).

How this score works

Each part is a percentile among all 52 tracked tools, so 50 is average for this list. Community is not measured yet; the score uses the other 80%.

  • Maintenance: Last push 1 Nov 2026. Last 10 GitHub releases within 5 days (about 50 per 30 days), latest release 1 Nov 2026. Issue close time: fewer than 5 closed issues, so not used.
  • Adoption: 132,785 stars (70%), 20,982 forks (30%).
  • Docs: README 3,334 characters, 6 headings, 6 code blocks, install section: yes.

Methodology

#6 of 14 in Coding agents

Ranked by score. The yellow row is this tool.

Coding agents, Week 45score 0–100, safety
  1. 1Gemini CLI#4 overall70Caution
  2. 2OpenCode#5 overall70No issues found
  3. 3OpenHands#10 overall68Caution
  4. 4Claude Code#11 overall65No dependencies scanned
  5. 5Cline#12 overall65Caution
  6. 6Codex#16 overall58Caution
Show the other 8
  1. 7deepseek-harness#17 overall57Caution
  2. 8KiroCrew#27 overall52Caution
  3. 9magpie#28 overall51No issues found
  4. 10Continue#43 overall37Caution
  5. 11goose#44 overall36Caution
  6. 12Aider#45 overall31Caution
  7. 13codex-plugin-cc#48 overall29No issues found
  8. 14Roo Code#51 overall23Caution

Safety scan, 2 Nov 2026

Automated scan of commit a098129, 7,538 files. Not a manual audit.

Caution

  • 4Critical dependency advisories47 high, 61 medium, 10 low. OSV, runtime dependencies only.
  • 0Install hooksNo npm install scripts found.
  • 0Remote-code patternsFor example eval(fetch(…)).
  • 163Agent files checked0 phrases flagged for review.
  • 4curl | sh installersIn docs or program code. Information only.
Why this label?

Why this label:

  • 4 critical-severity known vulnerabilities in runtime dependencies (OSV)

Known vulnerabilities in runtime dependencies (OSV): 4 critical, 47 high, 61 medium, 10 low, 31 unrated

  • zip@9.0.0 (GHSA-m665-v7pm-7grj) in codex-rs/Cargo.lock
  • handlebars@4.7.9 (GHSA-8r5x-fm3f-whwj) in pnpm-lock.yaml
  • handlebars@4.7.9 (GHSA-p8wg-vrv2-v86f) in pnpm-lock.yaml
  • proxy-addr@2.0.7 (GHSA-jqcg-44mw-7w3h) in pnpm-lock.yaml

Also found (informational, does not change the label):

  • 47 high-severity known vulnerabilities in runtime dependencies (OSV)
  • Program code runs a curl|sh style installer (1 occurrence, e.g. codex-rs/tui/src/update_action.rs)
  • Documents curl|sh style installer (3 occurrences, e.g. README.md)
  • Skill scripts contact: developers.openai.com, api.github.com, 127.0.0.1, example.invalid

Notes:

  • Telemetry/analytics references in code: telemetry, amplitude

Automated scan of commit a098129 on 2 Nov 2026, not a manual audit. 7,538 files checked. What we check

Repo activity

From the GitHub API, fetched 2 Nov 2026.

  • 10+Releases, 90 daysLatest rust-v0.167.0-alpha.3, 1 Nov
  • –Median issue closeFewer than 5 closed issues
  • 133kStars+1,859 since 26 Oct
  • 21kForks26,018 open issues
  • 2025Repo created13 Apr 2025
30 days ago2 Nov
10 releases in the last 30 days, one mark each (GitHub releases feed, last 10 entries).

10 releases in the last 30 days (GitHub releases feed, last 10 entries):

Questions about Codex

Answers use this week's StackGrade data.

Is Codex safe to use?

Caution. StackGrade's weekly scan of openai/codex gives it a Caution label for 4 critical-severity known vulnerabilities in runtime dependencies (OSV). It does list 47 high-severity advisories in runtime dependencies, which don't change the label. Critical advisories are counted once per package; a known issue in a locked package version does not prove Codex is exploitable in your setup. Automated scan of commit a098129 on 2 Nov 2026, not a manual audit.

How does StackGrade score Codex?

Codex scores 58 out of 100 in Week 45: #16 of 52 tracked tools overall and #6 in Coding agents. The score combines maintenance (74), adoption (74) and docs (10) as percentiles among all 52 tracked tools; community (20% weight) is not measured yet, so the score uses the other 80%. It is not a hands-on test and it is separate from the safety label.

What are the alternatives to Codex?

The highest-scored other tools in Coding agents this week: Gemini CLI (70, Caution), OpenCode (70, No issues found), OpenHands (68, Caution), Claude Code (65, No dependencies scanned). StackGrade has not tested them hands-on.

What licence does Codex use?

The licence listed for openai/codex is Apache-2.0. Read the licence text before commercial use.

Compare and use it

All facts and sources
Type
AI tool
License
Apache-2.0
Language
Rust
Created
13 Apr 2025
Owner
openai (Organization)
Forks
20,982

GitHub description: “Lightweight coding agent that runs in your terminal”

Sources: github.com/openai/codex, api.github.com/repos/openai/codex, raw.githubusercontent.com/openai/codex/main/README.md. Fetched 2 Nov 2026.

Know when Codex changes label

One email a week: the new top 10, the biggest score changes and every safety label that changed.

Free. Double opt-in: you confirm by email first, unsubscribe in one click.