RepoJournal
OpenAI OpenAI
150 wires and counting

$ follow OpenAI

Keep up with OpenAI in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-05-01
stories 93
RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

CODEX CLOSES WINDOWS SANDBOX VULNERABILITY AS PLUGIN SYNC GOES LIVE

By RepoJournal · Filed · About OpenAI · Composed from the cited sources · methodology

A critical Windows named-pipe ACL bypass in the elevated sandbox is patched [ref:1], while remote plugin bundle synchronization ships to keep installations in sync across backends [ref:2].

The Windows sandbox fix [1] closes a privilege escalation window where elevated Codex processes could access named pipes created by build tools like Ninja without proper restrictions. The patch adds elevated-only token constructors that lock down the restricted SID list — a sharp security move that leaves the unelevated path untouched, minimizing blast radius. Meanwhile, remote plugin bundle syncing [2] now downloads and upgrades cached plugin bundles during app-server startup, keeping local installations aligned with backend versions without polluting config.toml. On the analytics front [4], remote plugin installs now emit proper telemetry that preserves marketplace identity while correctly tagging backend-sourced plugins, giving ops real visibility into plugin adoption patterns. Vim mode lands in the TUI composer [5], letting modal editors stop fighting Codex keybindings and stay in muscle memory during prompt drafting. One note: the thread/turns/list API [3] is deliberately marked experimental and pulled from public consumption — there are bugs to work out.

Action items

References

  1. [1] Windows sandbox named-pipe ACL fix
  2. [2] Remote plugin bundle sync
  3. [3] Thread/turns/list API marked experimental
  4. [4] Remote plugin install analytics
  5. [5] Vim mode in TUI composer

$ ls openai/reviews/ # the step-back reads

the week in review Codex hands model defaults to the server the month in review Agents API lands in both OpenAI SDKs
Full archive → Weekly reviews →

Quick answers

What shipped in OpenAI on May 1, 2026?
A critical Windows named-pipe ACL bypass in the elevated sandbox is patched [ref:1], while remote plugin bundle synchronization ships to keep installations in sync across backends [ref:2]. In total, 45 commits, 45 pull requests, and 3 releases landed.
♥

$ log OpenAI --recent

Safety identifiers reach images, plugin approvals bind to contents 93 shipped Credential masking lands in Codex, Live gains Decisions across both SDKs 100 shipped Codex stabilizes environment tools, python adds residency options 135 shipped openai-python restores streaming connection reuse, browser and computer toolsets land in both SDKs 123 shipped

$ log --all # elsewhere on the wire

Alignment & Post-training verl rejects conflicting vLLM engine_kwargs, open-instruct adds MILES OPD behind a Megatron learner Interpretability nnsight 0.8.0 cuts import time from 7.6s to 1.6s

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.