Who contributed to OpenAI on August 22, 2026?

3 developers shipped this update, including felixxia-oai, copyberry, and Alex Chang.

What were the notable OpenAI updates?

refactor: move webhook signature checks into an SDK-owned helper (#2442), ci: check custom-code budgets against main's policy, and ci: catch accidental growth in Python SDK custom patches.

OpenAI

Codex, the SDKs, and the engine behind ChatGPT

Pick a date

Topics: AI / ML Full archive →

The Wire · Showcase

OpenAI SDKs Tighten Security and Polling Internals

By RepoJournal · Filed 06:58 UTC on August 22, 2026 · About OpenAI

3 people shipped this

Alex Chang @apcha-oai 5 cited

copyberry @copyberry 4 cited

felixxia-oai @felixxia-oai

OpenAI shipped a wave of SDK refactors overnight, moving webhook signature checks and file polling into SDK-owned helpers while Codex expands browser and computer-use policy controls.

The openai-node SDK moved its webhook signature verification into an SDK-owned helper [1], a breaking refactor that preserves the public API while centralizing timestamp and HMAC checks. Both openai-python and openai-node now gate custom-code growth against main's policy [2][3], catching accidental patch bloat before it becomes unmaintainable. Codex expanded its browser and computer-use requirements [4], exposing full policy controls through the app-server [5], and added Guardian internal session support [6] for host-owned review threads. A new `/copy` response target picker [7] lets users copy individual code blocks or the whole response without disturbing terminal scrollback. Documentation updates clarify image transparency support for `gpt-image-2` [8], and the Python SDK isolated vector-store polling into shared helpers [9].

Action items

→ Review webhook signature verification changes in openai-node before upgrading openai/openai-node [plan]
→ Monitor your custom-code budgets against new CI gates openai/openai-node [monitor]
→ Note Codex browser and computer-use policy expansion for app-server integrations openai/codex [plan]
→ Watch for breaking changes in file and vector-store polling after refactors openai/openai-python [monitor]

References

[1] refactor: move webhook signature checks into an SDK-owned helper (#2442) openai/openai-node
[2] ci: check custom-code budgets against main's policy ↗ openai/openai-node
[3] ci: catch accidental growth in Python SDK custom patches ↗ openai/openai-python
[4] Expand browser and computer use requirements ↗ openai/codex
[5] Expose browser and computer-use requirements through app-server ↗ openai/codex
[6] Add Guardian internal session support ↗ openai/codex
[7] Add a response target picker to `/copy` ↗ openai/codex
[8] chore(api): clarify image transparency and audio delta docs ↗ openai/openai-node
[9] refactor(api): isolate vector-store polling helpers ↗ openai/openai-python

Quick answers

What shipped in OpenAI on August 22, 2026?: OpenAI shipped a wave of SDK refactors overnight, moving webhook signature checks and file polling into SDK-owned helpers while Codex expands browser and computer-use policy controls. In total, 59 commits, 59 pull requests, and 3 releases landed.
Who contributed to OpenAI on August 22, 2026?: 3 developers shipped this update, including felixxia-oai, copyberry, and Alex Chang.
What were the notable OpenAI updates?: refactor: move webhook signature checks into an SDK-owned helper (#2442), ci: check custom-code budgets against main's policy, and ci: catch accidental growth in Python SDK custom patches.

OPENAI NODE SHIPS FOUR SECURITY FIXES, STREAMING SAFETY AND CREDENTIAL LEAKS PATCHED

If you run the official OpenAI Node SDK, today's security patch train is the one you can't skip.

ai 167 shipped

OpenAI Aug 20

OPENAI-NODE SECURITY BLITZ PATCHES STREAMING EXPOSURES

Five security fixes landed in openai-node overnight, closing unauthenticated proxies, unbounded buffers, and path leaks that could have billed your account or leaked patient data.

ai 155 shipped

OpenAI Aug 19

OPENAI SHIPS SECURITY BLITZ ACROSS SDKs

Overnight, OpenAI hardened its entire client stack, patching WebSocket origin bypasses and credential leaks in node, Python, and Codex sandboxes alike.

ai 162 shipped

OpenAI Aug 18

OpenAI SDKs ship Bedrock Runtime and credential injection fixes

OpenAI's Node and Python SDKs both land Bedrock Runtime support alongside critical security patches that block credential disclosure.

ai 142 shipped

Elsewhere on the wire

AI Agents Aug 22

Cline hubs get drain and replay as Langchain plumb gates

Cline just shipped rollover-grade hub commands while Langchain exposes gateway internals, and OpenHands quietly broke its own monitoring contract.

ai-agents 42 shipped

Local LLMs Aug 22

SGLang ships v0.5.18 with 710 PRs and DeepSeek V4 FP4 auto-routing

The biggest release of the week just landed: SGLang v0.5.18 adds new models, fixes a silent disagg bug, and defaults DeepSeek V4 FP4 checkpoints to the right MoE runner.