RepoJournal
OpenAI OpenAI
110 wires and counting

$ follow OpenAI

Keep up with OpenAI in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-03
stories 107
RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Windows sandbox provisioning goes live, SDKs gain canonical security models

By RepoJournal · Filed · About OpenAI

copyberry Justin Beckwith johnl-oai
3 people shipped this
copyberry @copyberry 4 cited Justin Beckwith @jbeckwith-oai 3 cited johnl-oai @johnl-oai 1 cited

Codex enables authenticated Windows sandbox provisioning, and both openai-node and openai-python now document a canonical repository threat model.

Codex enabled authenticated Windows sandbox provisioning [1]. The sandbox service now serves framed provisioning requests over a local named pipe, authenticates packaged clients, validates requests and machine policy, and reports outcomes through bounded responses and Windows event logging. Configuration parse failures return `unavailable` so clients can handle the failure mode explicitly.

The provisioning pipeline also gained resilience [2]. A valid Ready report can now replace a deferred environment's provisioning failure while preserving the same environment instance; failures are treated as retryable, and stale failures no longer poison later startup attempts. Separately, app-server responses now expose loaded thread environments via the experimental `Thread.environments` field, populated from live thread state across start, resume, read, list, and unarchive responses [3]. New experimental context management adds configuration under `features.context_management.experimental_mode`, enabling token-budget context and the `new_context` tool for eligible ChatGPT Plus, Pro, and Pro Lite sessions on the Codex backend, while staying disabled for custom providers and non-Codex endpoints [4]. A test-only RMCP OAuth credential store adapter maps RMCP refreshes onto Codex's pinned credential backend with refresh transaction guards [5].

The openai-node and openai-python SDKs each added a canonical security model [6][7]. Both introduce docs/architecture/security-model.md as the single detailed repository threat model, keep SECURITY.md focused on coordinated disclosure, and clarify that tracked executable checkout files run with repository-code authority. The Python version verifies 98 source citations resolve to existing files and valid lines [8].

Action items

References

  1. [1] Enable authenticated Windows sandbox provisioning (#42351) ↗ openai/codex
  2. [2] Recover deferred environments after provisioning failure ↗ openai/codex
  3. [3] Expose loaded thread environments in app-server responses ↗ openai/codex
  4. [4] Add experimental context management activation ↗ openai/codex
  5. [5] Add an RMCP OAuth credential store adapter ↗ openai/codex
  6. [6] docs: add canonical SDK security model (#2566) ↗ openai/openai-node
  7. [7] docs: add canonical SDK security model (#3778) ↗ openai/openai-python
  8. [8] docs: add canonical SDK security model ↗ openai/openai-python

$ ls openai/reviews/ # the step-back reads

the week in review Codex hardens sandbox and auth across platforms the month in review August: Codex hardens, SDKs consolidate security, GPT-5.5 lands
Topics: AI / ML Full archive →

Quick answers

What shipped in OpenAI on September 3, 2026?
Codex enables authenticated Windows sandbox provisioning, and both openai-node and openai-python now document a canonical repository threat model. In total, 52 commits, 52 pull requests, and 3 releases landed.
Who contributed to OpenAI on September 3, 2026?
3 developers shipped this update, including johnl-oai, copyberry, and Justin Beckwith.
What were the notable OpenAI updates?
Enable authenticated Windows sandbox provisioning (#42351), Recover deferred environments after provisioning failure, and Expose loaded thread environments in app-server responses.
♥

$ log OpenAI --recent

Codex TUI and openai-node fix stale state and timers 66 shipped Codex voice-host ships real-time microphone audio; openai-node fixes streaming hangs 108 shipped OpenAI ships retry fix, prompt cache diagnostics, sandbox security 152 shipped macOS Codex sandbox hardened against terminal input injection 174 shipped

$ log --all # elsewhere on the wire

Meta React Native adds Stable API guards to renderer attributed string FastAPI & Pydantic Pydantic fixes Mypy plugin crash, tightens datetime constraints

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.