Who contributed to OpenAI on May 29, 2026?

3 developers shipped this update, including stainless-app[bot], anp-oai, and jif-oai.

What were the notable OpenAI updates?

fix(tui): prevent repository-configured code execution in /diff (#24954), fix: cancel Windows sandbox on network denial (#19880), and fix(config): use deny for Unix socket permissions (#24970).

OpenAI

Codex, the SDKs, and the engine behind ChatGPT

Pick a date

Topics: AI / ML Full archive →

The Wire · Showcase

CODEX CLOSES THREE SECURITY GAPS WHILE NODE SDK STEADIES SHIPPING

By RepoJournal · Filed 06:03 UTC on May 29, 2026 · About OpenAI

3 people shipped this

stainless-app[bot] @stainless-app[bot] 1 cited

anp-oai @anp-oai 1 cited

jif-oai @jif-oai 1 cited

Codex patched a repository code execution vulnerability in /diff while tightening sandbox network denial handling, and the Node SDK shipped 6.39.1 to fix undici dispatcher mismatches.

Three critical fixes landed in Codex overnight, all closing attack surface. The most urgent: /diff now blocks repository-configured code execution helpers [1], closing a path where untrusted repos could run arbitrary scripts when users ran diagnostics. Separately, Windows sandbox execution now properly terminates when network denial hits [2] instead of lingering until timeout, eliminating a window where sandboxed code could persist after security policy rejection. Configuration vocabulary also standardized across the platform [3], replacing inconsistent "none" with "deny" for Unix socket permissions to match filesystem policy language. On the Node SDK side, openai-node 6.39.1 shipped with improved guidance for undici dispatcher mismatches [4] and fixed binary upload handling [4], addressing friction points for production integrations. The Codex team also reverted a benchmark crate that broke musl builders [5], keeping the build clean. Thread idle lifecycle wiring landed [6], moving idle state management out of goal-runtime-specific code into generic lifecycle hooks for better composition.

Action items

→ Update openai-node to 6.39.1 immediately if using undici or binary uploads openai/openai-node [immediate]
→ Review any local /diff usage with untrusted repositories and re-run diagnostics openai/codex [immediate]
→ Verify Windows sandbox network policy enforcement in staging before next deploy openai/codex [plan]

References

[1] fix(tui): prevent repository-configured code execution in /diff (#24954) openai/codex
[2] fix: cancel Windows sandbox on network denial (#19880) openai/codex
[3] fix(config): use deny for Unix socket permissions (#24970) openai/codex
[4] release: 6.39.1 ↗ openai/openai-node
[5] Revert "Add app-server startup benchmark crate" ↗ openai/codex
[6] Wire task completion into thread-idle lifecycle ↗ openai/codex

Quick answers

What shipped in OpenAI on May 29, 2026?: Codex patched a repository code execution vulnerability in /diff while tightening sandbox network denial handling, and the Node SDK shipped 6.39.1 to fix undici dispatcher mismatches. In total, 53 commits, 51 pull requests, and 3 releases landed.
Who contributed to OpenAI on May 29, 2026?: 3 developers shipped this update, including stainless-app[bot], anp-oai, and jif-oai.
What were the notable OpenAI updates?: fix(tui): prevent repository-configured code execution in /diff (#24954), fix: cancel Windows sandbox on network denial (#19880), and fix(config): use deny for Unix socket permissions (#24970).

CODEX HARDENS MCP RUNTIME STABILITY ACROSS FIVE CRITICAL FIXES

OpenAI shipped a coordinated hardening of the Model Context Protocol layer across Codex, patching race conditions in thread startup, resource access, and authority management that could leave stale configurations in production.

ai 66 shipped 1-min read

OpenAI 1 day ago

SDK RELEASES LOCK IN PROMPT CACHING AND SPEND CONTROLS

Both Node and Python clients shipped v6.49.0 and v2.48.0 overnight with admin spend limit APIs and relaxed prompt cache validation.

ai 103 shipped 1-min read

OpenAI 2 days ago

CODEX CONSOLIDATES THREAD STARTUP, NODE SDK ADDS REALTIME AND STANDARD SCHEMA SUPPORT

Codex refactored its threading and database layer for consistency while the Node SDK ships four new schema helpers and fixes audio streaming in a single release push.

ai 120 shipped 1-min read

OpenAI 3 days ago

CODEX FIXES WINDOWS EXECUTION BUGS WHILE TIGHTENING SECURITY REVIEW GATES

Codex shipped critical fixes for Windows process management and terminal navigation that were silently breaking execution sessions on Windows machines.

ai 104 shipped 1-min read

Elsewhere on the wire

AI Agents about 10 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 10 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.