What shipped in OpenAI on August 26, 2026?

Part 3 of 5 is live, and OpenAIs Node SDK just got its most significant auth upgrade in years. In total, 62 commits, 71 pull requests, and 3 releases landed.

Who contributed to OpenAI on August 26, 2026?

5 developers shipped this update, including copyberry, george, Hayden, Justin Beckwith, and apcha-oai.

What were the notable OpenAI updates?

feat(auth): add pinned X.509 workload token exchange (#2470), feat(auth): attest cross-module X.509 transport capabilities (#2471), and feat(auth): integrate attested X.509 workload identity into clients (#2472).

OpenAI

Codex, the SDKs, and the engine behind ChatGPT

Pick a date

Topics: AI / ML Full archive →

The Wire · Showcase

X.509 Workload Identity Lands in openai-node

By RepoJournal · Filed 06:57 UTC on August 26, 2026 · About OpenAI

5 people shipped this

copyberry @copyberry 5 cited

Justin Beckwith @jbeckwith-oai 3 cited

apcha-oai @apcha-oai 2 cited

george @huanglianggit 1 cited

Hayden @HAYDEN-OAI 1 cited

Part 3 of 5 is live, and OpenAIs Node SDK just got its most significant auth upgrade in years.

The openai-node SDK is rolling out pinned X.509 workload identity, with three parts of a five-part stack merged overnight [1][2][3]. Part 1 adds certificate-authenticated OAuth exchange against the single approved mtls.auth.openai.com issuer [1], while Part 2 introduces a frozen transport capability registry shared across CJS and ESM [2]. Part 3 wires it all into the client, pinning the global mTLS API origin and excluding Azure, Bedrock, and custom dispatchers [3]. Expect breaking changes as this matures. Across the stack, Codex hardened managed worktrees with thread ownership metadata and atomic no-clobber writes [4], and sanitized Git remote credentials before they enter thread and turn metadata [5]. "Git remote URLs can embed usernames, passwords, or tokens," notes the Codex PR [5]. openai-python also gained generated request encoding for Realtime WebRTC setup [6] and project residency config with deprecated geography [7]. The Node SDK broke ecosystem CLI checks to run on Windows [8] and fixed Castiron checks for external-fork PRs [9]. Codex added an explicit remote executor connection refresh for planned replacement [10] and tracks image generation request IDs in analytics [11], while moving relay test helpers into shared support [12].

Action items

→ Review the X.509 workload-identity PRs and plan for migration; parts 4 and 5 are coming openai/openai-node [plan]
→ Patch Codex to sanitize Git remote credentials before storing metadata openai/codex [immediate]
→ Test your Realtime WebRTC flow with openai-python 3736 to ensure SDP offers encode correctly openai/openai-python [plan]
→ Monitor the Windows ecosystem CLI test fix; run on a Windows CI to confirm portability openai/openai-node [monitor]

References

[1] feat(auth): add pinned X.509 workload token exchange (#2470) openai/openai-node
[2] feat(auth): attest cross-module X.509 transport capabilities (#2471) openai/openai-node
[3] feat(auth): integrate attested X.509 workload identity into clients (#2472) openai/openai-node
[4] Add thread ownership metadata for managed worktrees ↗ openai/codex
[5] Sanitize credentials from Git remote metadata ↗ openai/codex
[6] fix(api): encode Realtime call offers and session configuration ↗ openai/openai-python
[7] feat(api): add project residency configuration and cost quantity units ↗ openai/openai-python
[8] test: make ecosystem CLI checks portable on Windows (#2431) openai/openai-node
[9] fix: publish Castiron checks for external-fork pull requests (#2464) openai/openai-node
[10] Add explicit remote executor connection refresh ↗ openai/codex
[11] Track image generation request IDs in analytics ↗ openai/codex
[12] Move relay helpers into exec-server test support ↗ openai/codex

Quick answers

What shipped in OpenAI on August 26, 2026?: Part 3 of 5 is live, and OpenAIs Node SDK just got its most significant auth upgrade in years. In total, 62 commits, 71 pull requests, and 3 releases landed.
Who contributed to OpenAI on August 26, 2026?: 5 developers shipped this update, including copyberry, george, Hayden, Justin Beckwith, and apcha-oai.
What were the notable OpenAI updates?: feat(auth): add pinned X.509 workload token exchange (#2470), feat(auth): attest cross-module X.509 transport capabilities (#2471), and feat(auth): integrate attested X.509 workload identity into clients (#2472).

Two security patches land across OpenAI SDKs

OpenAI's SDKs shipped two security-critical patches overnight, and neither can wait.

ai 109 shipped

OpenAI Aug 24

Codex Drops the 'Plan' Nudge

OpenAI rolled back the Plan mode prompt in Codex, quietly removing the 'Create a plan?' nudge from the composer and the friction it brought to drafting.

ai 46 shipped

OpenAI Aug 23

CODEX TIGHTENS THREAD CLASSIFICATION, NODE SDK ADDS X.509 TRANSPORT

Codex now requires content classification for all thread sources and extension fragments, while the Node SDK introduces caller-attested X.509 transport for hardened auth flows.

ai 26 shipped

OpenAI Aug 22

OpenAI SDKs Tighten Security and Polling Internals

OpenAI shipped a wave of SDK refactors overnight, moving webhook signature checks and file polling into SDK-owned helpers while Codex expands browser and computer-use policy controls.

ai 121 shipped

Elsewhere on the wire

AI Agents Aug 26

CLINE OVERHAULS DESKTOP UX

Cline's desktop app got a massive consolidation pass that merges its customization pages into one hub and reworks the sidebar.

ai-agents 31 shipped

Local LLMs Aug 26

OLLAMA'S MLX RUNNER NOW SPEAKS STRUCTURED OUTPUT

Ollama closed a silent correctness gap on Apple Silicon, and the LLM inference stack shipped a wave of fixes that touch everything from tool calls to native ARM support.

+14

llms 239 shipped

@CachyOS Aug 26

HANDHELD GAMING OVERHAUL: STEAMOS SESSION CONTROL LANDS

CachyOS is rewiring its handheld gaming stack so Steam's session management is treated as a first-class citizen, with a new steamosctl-powered switch to game mode.