Codex Security vs XBOW
Codex Security (OpenAI) and XBOW (XBOW) side by side on public data, as of Oct 10, 2026.
Codex Security shipped 30 stable releases in the past 90 days.
Side-by-side numbers
| Metric | Codex Security | XBOW |
|---|---|---|
| Gid Score | 73 | 11 |
| Overall rank | #10 | #293 |
| Downloads, last 7 days | — | — |
| Downloads, 7-day change | — | — |
| Downloads, 30-day change | — | — |
| VS Code installs | — | — |
| Marketplace rating | — | — |
| GitHub stars | 11K | — |
| Homebrew installs, 30 days | — | — |
| Hacker News mentions, 30 days | 204 | 1 |
| Latest stable release | 0.2.0 · 4d ago | — |
| Stable releases, 90 days | 30 | |
| Terminal-Bench (best run) | — | — |
| Price | Free (OSS) | Usage-based |
| License | Apache-2.0 | |
| First released | July 2026 | July 2024 |
| Interfaces | — | — |
| Models |
Trends
Codex Security
OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm: https://www.npmjs.com/package/@openai/codex-security
Pricing: Open source under the Apache-2.0 licence; check the website for any paid hosted plans.
Latest release 0.2.0:
- Threat models are now saved with Standard, Deep, and Diff scan results and generated security policies. Export a saved model without another model call using codex-security export --artifact…
- Scans now check for exposed credentials in source code, including unused code and tests, and distinguish suspected exposures from placeholders. This check runs offline, without trying discovered…
- Use --model and --effort when generating patches, validating findings, verifying fixes, or matching and comparing saved scans. Deep Scan workers and patches generated during a scan also respect…
- Patch, validation, and fix-verification commands now respect custom model providers and their authentication settings. Amazon Bedrock users get clearer authentication errors and cost estimates for…
XBOW
An autonomous offensive security platform that attacks web applications, chains findings into working exploits and reports vulnerabilities with reproducible proof, for continuous testing rather than periodic manual pentests.
Pricing: Usage-based pricing scoped to the environment; no public prices. Also sold through the AWS, Google, Oracle and Microsoft marketplaces.