RepoJournal
OpenAI OpenAI
150 wires and counting

$ follow OpenAI

Keep up with OpenAI in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-08-27
stories 153
RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

OPENAI SHIPS SECURITY HARDENING AND OPTIONAL CALL IDS ACROSS SDKs

By RepoJournal · Filed · About OpenAI · Composed from the cited sources · methodology

copyberry openai-sdks[bot] jif felixxia-oai Hayden Justin Beckwith apcha-oai
9 people shipped this
copyberry @copyberry 3 cited openai-sdks[bot] @openai-sdks[bot] 3 cited jif @jif-oai 1 cited felixxia-oai @felixxia-oai 1 cited Hayden @HAYDEN-OAI 1 cited Justin Beckwith @jbeckwith-oai 1 cited apcha-oai @apcha-oai 1 cited Morgan Carr @morgan-coded openai-sdks @openai-sdks

OpenAI's SDKs just got a batch of security fixes and a breaking API change that makes function call IDs optional.

The OpenAI ecosystem shipped three releases overnight across codex, openai-node, and openai-python, with 70 commits and 70 PRs landing in the span of 24 hours. The headline is a coordinated security push: codex now records reviewed actions with security risk scores [1] and trusts invoked user skills in Guardian reviews [2], while openai-node locked down X.509 workload credentials [3] and blocked run-step identity hijacking in assistants [4]. The release notes for openai-node 7.6.0 add an obfuscation field to ChatCompletionChunk [5], matching what shipped in openai-python 3.4.0 [6]. Both SDKs also picked up project residency and cost quantity fields [6] [5], and openai-python 3.5.0 makes function call output call IDs optional [7], aligning with the same change in openai-node's turn routing [9]. That's a breaking change for the Agents SDK, which "will need to be fixed after this PR merges" [8]. Meanwhile, codex tightened MCP metadata trust [10] and improved fork tracking in turn metadata [11].

Action items

References

  1. [1] Record reviewed actions with security risk scores (#40901) openai/codex ↗
  2. [2] Trust invoked user skills in Guardian reviews (#41006) openai/codex ↗
  3. [3] fix(auth): secure first-class X.509 workload credentials (#2479) ↗ openai/openai-node
  4. [4] fix(assistants): reject run-step identity hijacking before tool callbacks (#2476) ↗ openai/openai-node
  5. [5] release: 7.6.0 (#2381) ↗ openai/openai-node
  6. [6] release: 3.4.0 (#3682) ↗ openai/openai-python
  7. [7] v3.5.0 ↗ openai/openai-python
  8. [8] feat(api): make function call output call IDs optional ↗ openai/openai-python
  9. [9] Support standalone function outputs in turn routing ↗ openai/codex
  10. [10] Add trusted access context for MCP metadata ↗ openai/codex
  11. [11] Track window and fork positions in turn metadata ↗ openai/codex

$ ls openai/reviews/ # the step-back reads

the week in review Codex hands model defaults to the server the month in review Agents API lands in both OpenAI SDKs
Full archive → Weekly reviews →

Quick answers

What shipped in OpenAI on August 27, 2026?
OpenAI's SDKs just got a batch of security fixes and a breaking API change that makes function call IDs optional. In total, 70 commits, 70 pull requests, and 13 releases landed.
Who contributed to OpenAI on August 27, 2026?
9 developers shipped this update, including jif, felixxia-oai, copyberry, openai-sdks[bot], Hayden, Justin Beckwith, Morgan Carr, and apcha-oai, and 1 more.
What were the notable OpenAI updates?
Record reviewed actions with security risk scores (#40901), Trust invoked user skills in Guardian reviews (#41006), and fix(auth): secure first-class X.509 workload credentials (#2479).
♥

$ log OpenAI --recent

Safety identifiers reach images, plugin approvals bind to contents 93 shipped Credential masking lands in Codex, Live gains Decisions across both SDKs 100 shipped Codex stabilizes environment tools, python adds residency options 135 shipped openai-python restores streaming connection reuse, browser and computer toolsets land in both SDKs 123 shipped

$ log --all # elsewhere on the wire

Alignment & Post-training verl rejects conflicting vLLM engine_kwargs, open-instruct adds MILES OPD behind a Megatron learner Interpretability nnsight 0.8.0 cuts import time from 7.6s to 1.6s

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.