OpenAI's Latest Work, July 29–August 7, 2026: A 10-Day Field Report

The important OpenAI story of the last ten days is not a new foundation-model launch. Across the official product, developer-platform, and security release channels, the visible work from July 29 through August 7, 2026 concentrated on making agents easier to distribute, resume, govern, measure, and operate.

Codex gained portable Agent Plugins, richer conversation organization, a newer MCP client, and automatically reviewed approvals. The API gained infrastructure-as-code, API-key-level cost attribution, lower GPT-5.6 prices, and long-context Fast mode. Codex Security gained measured, consistent, and resumable deep scans. ChatGPT’s desktop surface gained stronger browser context, multi-repository review, and targeted image editing.

This is the dated update to the seven-part OpenAI 2026 research map. It covers only claims published in OpenAI’s official documentation and changelogs during the window. It separates shipped features from interpretation and does not treat release notes as proof of reliability or business value.

The window also contains OpenAI’s July 29 ARC-AGI-3 harness analysis and August 1 mathematics report. Those are already examined in the GPT-5.6 field guide and science and evaluation report, so the ledger below records the product and platform delta instead of duplicating that research.

The 10-day release ledger

The ledger is compiled from the official API changelog, ChatGPT and Codex changelog, and Codex Security plugin changelog. Several rows contain more than one feature, but each is anchored to a dated OpenAI release entry.

1. Agent Plugins are becoming a distribution layer

Codex 0.146.0 added Agent Plugin manifests, workspace plugin publishing, and additional plugin marketplaces. Version 0.147.0 then made those plugins portable across installation contexts and added search across local, personal, workspace, and remote catalogs.

That sequence matters more than the word “plugin” suggests. A reusable agent capability is no longer just a prompt or one MCP server configured on one machine. It can be a package that carries skills, connector mappings, tools, hooks, and metadata through a catalog. Portability and search turn extension discovery into a product surface.

The July 29 beta rollout of Sign in with ChatGPT adds a separate identity bridge. OpenAI says the initial partners include Airtable, GitLab, HubSpot, Notion, Supabase, and Vercel. Signing in can create or link the partner account and shares basic profile information, but it does not grant the plugin data access or approve actions. The plugin’s requested permissions still require separate review.

The boundary is therefore:

1. Package trust: Who built and published the plugin?
2. Account identity: Which partner account is linked?
3. Data and action authority: Which scopes and tools did the person approve?
4. Runtime policy: What may the agent do with those tools in this workspace and task?

Collapsing those four decisions into “the user signed in” would be a security error.

2. Codex is building a durable work graph, not only a chat transcript

The two CLI releases add a cluster of continuity features: named sessions, pinned threads, side conversations, temporary and persistent forks, paginated history, manually ordered conversation sections, and incremental browsing of long transcripts. Version 0.147.0 also imports Cursor-managed skills and synchronizes updates to imported Claude and Cursor conversations without duplicating them.

These features point toward a durable work graph. A task can branch, preserve its ancestry, organize related conversations, and continue without materializing its entire history at once. Amazon Bedrock sessions also gained remote conversation compaction in 0.147.0.

This improves usability and long-horizon continuity. It does not automatically create an audit-grade replay record. A reliable production system still needs immutable event identity, tool inputs and outputs, approval decisions, model and policy versions, and an explanation of what compaction removed. Conversation persistence and decision replay solve related but different problems.

3. MCP is moving from connection setup to runtime infrastructure

Codex 0.146.0 improved MCP reconnection after authentication or configuration changes. Version 0.147.0 added opt-in support for the MCP 2026-07-28 protocol, including paginated discovery, multi-round requests, and non-blocking server startup. It also upgraded the MCP SDK to 3.0.0.

The practical gains are clear:

• large tool catalogs can be discovered in bounded pages;
• a server can conduct a multi-round interaction instead of forcing everything into one request;
• optional or slow servers do not have to block the beginning of an agent turn;
• cached tools can remain available while a server starts;
• authentication and configuration updates can refresh affected connections without restarting every healthy server.

The same release hardens the failure path. OpenAI reports stronger plugin isolation, explicit trust for unfamiliar local projects, managed-authentication checks before credentials are used, full bearer-token redaction, and denial of network access when a policy update fails.

That combination is the signal: protocol capability and containment are advancing together. A larger, more dynamic tool surface needs bounded discovery, catalog revision tracking, credential isolation, timeouts, and fail-closed network policy—not merely a successful MCP handshake.

4. Approval automation is becoming risk-sensitive

Codex 0.147.0 introduced --approve-for-me, which enables automatically reviewed approvals. Two days earlier, 0.146.1 applied safer automatic-review defaults for cyber-capable models and made permission changes more visible in the terminal.

The order is instructive. Automatic approval review can reduce interruption fatigue, but the review mechanism itself becomes a control surface. It needs eligibility rules, model-aware defaults, an auditable decision, and a path that still requires a person for actions outside the allowed envelope.

“Automatically reviewed” should not be translated as “automatically allowed.” The release notes do not establish the false-allow rate, supported action classes, or suitability for a specific enterprise risk tier. Teams should evaluate the feature with representative approval requests, adversarial command shapes, and the exact permission profile used in production.

5. Codex Security is becoming a resumable, measurable workflow

Three plugin releases landed inside the window: 0.1.15, 0.1.16, and 0.1.17.

Together they change the operating character of a scan:

• completed scans remain available as projects change;
• false-positive feedback becomes part of the workflow;
• malformed finding records can be recovered during finalization;
• standard and deep scans use consistent threat-modeling, discovery, validation, attack-path, and reporting phases;
• token accounting distinguishes input, cached input, output, partial, and unavailable measurements;
• a scan fails when its repository or target changes during execution, rather than accepting stale findings;
• deep-scan state survives coordinator restarts and preserves completed discovery and file reviews;
• live progress exposes phase, elapsed time, workers, reviewed files, and token usage.

This is not evidence that every finding is correct. It is evidence that OpenAI is working on the less glamorous requirements that determine whether a security agent can join a real workflow: observability, cost measurement, stale-input detection, recovery, and feedback.

6. The GPT-5.6 ladder is now economic as well as technical

The July 30 API changelog records two price reductions: GPT-5.6 Luna became 80% cheaper and Terra 20% cheaper. The same update renamed Priority Processing to Fast mode and said GPT-5.6 Sol can run up to 2.5 times faster than Standard processing at twice the price.

On August 5, OpenAI expanded Fast mode to long-context prompts above 272K tokens for Sol, Terra, and Luna. The current Fast mode guide adds several constraints that matter in production:

• Standard and Fast share the same model rate limit;
• a rapid traffic ramp can downgrade some requests to Standard and return service_tier: "default";
• cached-input discounts still apply;
• images and long-context GPT-5.6 requests are supported;
• fine-tuned models and embeddings are not supported;
• Fast mode is billed separately from Scale Tier quota.

“Up to 2.5×” is a service claim, not a latency guarantee for every prompt. The correct test is end-to-end: measure time to useful result, retry behavior, downgrade rate, cached-token share, and cost per accepted outcome for the workload that actually needs lower latency.

7. The API control plane gained showback and infrastructure-as-code

OpenAI’s official Terraform provider manages projects, access, users, groups, roles, service accounts, certificates, rate limits, spend alerts, model and tool controls, and data settings through Administration APIs. It also supports importing existing resources and reconciling drift.

That is a meaningful change for platform teams because API governance can enter the same review and promotion path as other infrastructure. It also creates familiar responsibilities: pin provider versions, commit the lock file, protect the Admin API key, separate plan from apply, and define who may approve organization-wide changes.

On August 4, the Usage and Costs dashboards and APIs added filtering and grouping by API key. This enables workload showback only if keys map cleanly to workloads or services. Shared keys blur attribution; frequent untracked rotation fragments it. The reporting feature and the identity design must be planned together.

8. ChatGPT Work is absorbing more of the research-to-production loop

The July 30 desktop release added browser-history search, Chrome-extension access to open tabs and highlighted text, questions over YouTube videos, multi-repository diff review, a focused and canvas view for generated-image edits, and an Activity view for chats that need attention.

These are not isolated interface conveniences. They reduce handoffs between finding context, producing an artifact, inspecting changes, and returning to unfinished work. That strengthens the thesis of the original series: OpenAI is optimizing for completed work across surfaces, not just better answers inside a chat box.

The risk also follows the integration. Browser history, page context, repositories, generated media, and plugins carry different data classifications and action rights. A unified surface still needs task-specific context selection and authority.

The August 31 migration that should not be missed

OpenAI says GPT-5.4 and GPT-5.4 mini will leave Codex on August 31, 2026 for sessions authenticated with ChatGPT. The recommended replacements are:

• gpt-5.4 → gpt-5.6-terra
• gpt-5.4-mini → gpt-5.6-luna

The models remain available through the OpenAI API and in Codex sessions authenticated with an API key. That authentication distinction is easy to miss. Before the cutoff, check workspace defaults, saved model selections, managed configuration, custom agents, and scheduled tasks. Re-run the relevant evals; a recommended replacement is not proof of behavioral equivalence for one workflow.

A 10-day adoption checklist

Use this artifact to turn the release ledger into an engineering decision:

• Inventory Codex authentication modes and every saved GPT-5.4 or GPT-5.4 mini selection.
• Test Terra and Luna on task acceptance rate, tool behavior, latency, and cost before August 31.
• Upgrade a canary environment to Codex 0.147.0 and validate plugin discovery, MCP startup, imports, terminal behavior, and permission prompts.
• Replace any use of the removed codex exec --full-auto flag with an explicit sandbox policy; 0.147.0 directs users to --sandbox workspace-write.
• Treat every portable plugin as a supply-chain package with publisher, version, skills, connectors, hooks, scopes, and revocation recorded.
• Pilot MCP 2026-07-28 against a bounded catalog before enabling it broadly.
• Evaluate --approve-for-me with allowed, denied, and ambiguous actions under the real permission profile.
• Assign API keys at a workload boundary that makes cost attribution useful, and preserve identity across rotation.
• Compare Standard and Fast mode on cost per accepted outcome; monitor the response’s actual service_tier.
• Upgrade Codex Security in a canary repository and interrupt a deep scan deliberately to verify recovery, stale-target handling, and token accounting.
• Put Terraform’s Admin API key in a secrets manager, pin the provider, review plans, and import existing resources before declaring drift enforcement.

What the releases do—and do not—prove

The ten-day evidence supports one strong conclusion: OpenAI is investing heavily in the operating layer around agents. Packaging, histories, protocol negotiation, approvals, security workflows, cost attribution, and configuration drift are becoming first-class product concerns.

It does not prove that plugins are trustworthy, automatic approval is safe for every action, long-context Fast mode improves every application, or a resumable security scan finds more real vulnerabilities. Those questions require workload-specific evaluation and production evidence.

The direction is nevertheless clear. The competitive unit is moving beyond the model and even beyond the single agent. It is becoming the governed system that can discover capabilities, preserve work, cross tools, survive interruptions, expose cost, and fail safely.

What to read next

• OpenAI in 2026: the full-stack research map
• GPT-5.6 field guide: what changed beyond the benchmark chart
• ChatGPT Work, Codex, and OpenAI Presence as one agent stack
• Inside OpenAI’s agent platform: Responses, tools, MCP, and control
• OpenAI’s frontier safety and infrastructure stack