Who contributed to OpenAI on August 27, 2026?

9 developers shipped this update, including jif, felixxia-oai, copyberry, openai-sdks[bot], Hayden, Justin Beckwith, Morgan Carr, and apcha-oai, and 1 more.

What were the notable OpenAI updates?

Record reviewed actions with security risk scores (#40901), Trust invoked user skills in Guardian reviews (#41006), and fix(auth): secure first-class X.509 workload credentials (#2479).

OpenAI

Codex, the SDKs, and the engine behind ChatGPT

Pick a date

Topics: AI / ML Full archive →

The Wire · Showcase

OPENAI SHIPS SECURITY HARDENING AND OPTIONAL CALL IDS ACROSS SDKs

By RepoJournal · Filed 06:57 UTC on August 27, 2026 · About OpenAI

9 people shipped this

copyberry @copyberry 3 cited

openai-sdks[bot] @openai-sdks[bot] 3 cited

jif @jif-oai 1 cited

felixxia-oai @felixxia-oai 1 cited

Hayden @HAYDEN-OAI 1 cited

Justin Beckwith @jbeckwith-oai 1 cited

apcha-oai @apcha-oai 1 cited

Morgan Carr @morgan-coded

openai-sdks @openai-sdks

OpenAI's SDKs just got a batch of security fixes and a breaking API change that makes function call IDs optional.

The OpenAI ecosystem shipped three releases overnight across codex, openai-node, and openai-python, with 70 commits and 70 PRs landing in the span of 24 hours. The headline is a coordinated security push: codex now records reviewed actions with security risk scores [1] and trusts invoked user skills in Guardian reviews [2], while openai-node locked down X.509 workload credentials [3] and blocked run-step identity hijacking in assistants [4]. The release notes for openai-node 7.6.0 add an obfuscation field to ChatCompletionChunk [5], matching what shipped in openai-python 3.4.0 [6]. Both SDKs also picked up project residency and cost quantity fields [6] [5], and openai-python 3.5.0 makes function call output call IDs optional [7], aligning with the same change in openai-node's turn routing [9]. That's a breaking change for the Agents SDK, which "will need to be fixed after this PR merges" [8]. Meanwhile, codex tightened MCP metadata trust [10] and improved fork tracking in turn metadata [11].

Action items

→ Upgrade openai-python to 3.5.0 and openai-node to 7.6.0 for the security fixes and new API fields openai/openai-python [immediate]
→ Update Agents SDK to handle optional call_id in function call outputs openai/openai-python [immediate]
→ Review codex changes to Guardian security scoring and trusted user skills openai/codex [plan]
→ Monitor openai-node auth entrypoint fixes for workload identity users openai/openai-node [monitor]

References

[1] Record reviewed actions with security risk scores (#40901) openai/codex
[2] Trust invoked user skills in Guardian reviews (#41006) openai/codex
[3] fix(auth): secure first-class X.509 workload credentials (#2479) openai/openai-node
[4] fix(assistants): reject run-step identity hijacking before tool callbacks (#2476) openai/openai-node
[5] release: 7.6.0 (#2381) openai/openai-node
[6] release: 3.4.0 (#3682) openai/openai-python
[7] v3.5.0 ↗ openai/openai-python
[8] feat(api): make function call output call IDs optional ↗ openai/openai-python
[9] Support standalone function outputs in turn routing ↗ openai/codex
[10] Add trusted access context for MCP metadata ↗ openai/codex
[11] Track window and fork positions in turn metadata ↗ openai/codex

Quick answers

What shipped in OpenAI on August 27, 2026?: OpenAI's SDKs just got a batch of security fixes and a breaking API change that makes function call IDs optional. In total, 70 commits, 70 pull requests, and 13 releases landed.
Who contributed to OpenAI on August 27, 2026?: 9 developers shipped this update, including jif, felixxia-oai, copyberry, openai-sdks[bot], Hayden, Justin Beckwith, Morgan Carr, and apcha-oai, and 1 more.
What were the notable OpenAI updates?: Record reviewed actions with security risk scores (#40901), Trust invoked user skills in Guardian reviews (#41006), and fix(auth): secure first-class X.509 workload credentials (#2479).

X.509 Workload Identity Lands in openai-node

Part 3 of 5 is live, and OpenAIs Node SDK just got its most significant auth upgrade in years.

ai 136 shipped

OpenAI Aug 25

Two security patches land across OpenAI SDKs

OpenAI's SDKs shipped two security-critical patches overnight, and neither can wait.

ai 109 shipped

OpenAI Aug 24

Codex Drops the 'Plan' Nudge

OpenAI rolled back the Plan mode prompt in Codex, quietly removing the 'Create a plan?' nudge from the composer and the friction it brought to drafting.

ai 46 shipped

OpenAI Aug 23

CODEX TIGHTENS THREAD CLASSIFICATION, NODE SDK ADDS X.509 TRANSPORT

Codex now requires content classification for all thread sources and extension fragments, while the Node SDK introduces caller-attested X.509 transport for hardened auth flows.

ai 26 shipped