Codex Security vs NodeZero
Codex Security (OpenAI) and NodeZero (Horizon3.ai) side by side on public data, as of Oct 10, 2026.
Codex Security shipped 30 stable releases in the past 90 days.
Side-by-side numbers
| Metric | Codex Security | NodeZero |
|---|---|---|
| Gid Score | 73 | 18 |
| Overall rank | #10 | #266 |
| Downloads, last 7 days | — | — |
| Downloads, 7-day change | — | — |
| Downloads, 30-day change | — | — |
| VS Code installs | — | — |
| Marketplace rating | — | — |
| GitHub stars | 11K | — |
| Homebrew installs, 30 days | — | — |
| Hacker News mentions, 30 days | 204 | 0 |
| Latest stable release | 0.2.0 · 4d ago | — |
| Stable releases, 90 days | 30 | |
| Terminal-Bench (best run) | — | — |
| Price | Free (OSS) | Custom |
| License | Apache-2.0 | |
| First released | July 2026 | — |
| Interfaces | — | — |
| Models |
Trends
Codex SecurityNodeZero
Codex Security
OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm: https://www.npmjs.com/package/@openai/codex-security
Pricing: Open source under the Apache-2.0 licence; check the website for any paid hosted plans.
Latest release 0.2.0:
- Threat models are now saved with Standard, Deep, and Diff scan results and generated security policies. Export a saved model without another model call using codex-security export --artifact…
- Scans now check for exposed credentials in source code, including unused code and tests, and distinguish suspected exposures from placeholders. This check runs offline, without trying discovered…
- Use --model and --effort when generating patches, validating findings, verifying fixes, or matching and comparing saved scans. Deep Scan workers and patches generated during a scan also respect…
- Patch, validation, and fix-verification commands now respect custom model providers and their authentication settings. Amazon Bedrock users get clearer authentication errors and cost estimates for…
NodeZero
Horizon3.ai's autonomous pentesting platform that runs real attack techniques against internal, external, cloud, Kubernetes, Active Directory and web-app environments to show which weaknesses can be exploited.
Pricing: Four packages (Flex, Core, Pro, Elite) plus support tiers; no public prices.