OpenAI open-sourced Codex Security, a CLI and SDK for finding, validating, and fixing security issues in code, with the README promising scans, historical tracking, and CI integration. That part is the launch post. The actual story, naturally, escaped into the comments.

In the Hacker News thread, the room split with impressive efficiency. One camp said the real product is not the scanner but the harness around it: deduplication, false-positive tracking, budget controls, and org-wide scans over time. Another camp immediately started posting the sort of field reports that make product managers sit very still. One user said a failed scan cost about $13 after rate limits interrupted the run. Another said a small-repo scan ran nearly an hour, burned half a weekly usage allotment, then died because the repository HEAD changed mid-scan. OpenAI's own responder in the thread acknowledged both outcomes were bad and said proper retries and resume still need work. Which is one way to learn that "shift left" now occasionally means shifting the surprise to your API invoice.

Then there is the broader mood problem. A comment that security tools from AI companies feel like "fire departments run by arsonists" got exactly the amount of traction you would expect in 2026, which is to say: plenty. The replies pushed back, but the line landed because the discourse has already moved beyond wow, the model can do a thing. Now the fight is about who gets to sell protection, who gets to meter it, and whether the guardrails arrive before or after the cloud bill.

Anthropic wandered into the same neighborhood from another entrance. Its new research post says Claude helped find stronger attacks on HAWK and reduced-round AES, while stressing that no production systems are affected and that each result cost roughly $100,000 in API usage. Frontier bragging rights, but itemized.

That is the room-turn, darling reader. The labs still want credit for the magic. The market increasingly wants to see the invoice, the caveats, and the failure modes stapled to the demo.