Enterprise Agent audit reaches source code

Opening the source broadens audit scope but does not prove release artefacts

At 05:14 China Standard Time on 21 September, Z.ai made a change entitled ‘feat: open source’ in its public repository. The repository README describes ZCode as an AI coding workspace with desktop, browser and terminal interfaces, and lists the desktop client, Web client, backend services, shared UI, and Agent CLI and runtime among the source-code areas. The Agent CLI and runtime are included as a regular directory when the repository is cloned, with no separate submodule initialisation required; the root licence applies Apache-2.0 to first-party code.

The ZCode 3.14.1 product update page published on the same day lists fixes for draft references, plan and thinking content, provider identity and start-up issues. The product update page and source repository provide two objects that can be checked separately: the former describes a user-facing version, while the latter provides buildable code and packaging steps. The public material does not thereby make a particular download, a local build and the hosted service the same runtime state, and readable source does not mean that a release binary has passed reproducible-build verification.

The public notice turns permissions and data paths into checkable boundaries

ZCode's project notice states that files, terminals, Git, Agent tools and external processes can read and write files, start processes and access the network within the permissions of the operating-system account that actually runs them. The shared Agent execution adapter provides no default operating-system sandbox. The notice also distinguishes between runtime modes and says that tool approval is not a single permission switch for the whole application: one approval cannot be taken to mean that terminal operations, plugin processes or update downloads all pass through the same process.

The same notice lists prompts, history, code, diffs, tool results and attachments among the data that model and auxiliary requests may send, and says that the recipient depends on the actual endpoint, gateway forwarding and proxy configuration. When the protocol, host, effective port and path conditions match for the two official Anthropic compatible model endpoints listed in the code, requests are automatically rerouted to the ZCode gateway, preserving the method, body, query parameters and every request header except Host. The notice also makes clear that the gateway's internal handling after receipt is outside what the client source has verified. Shared Agent model input and output logs are written locally by default in development and production, but the material does not describe all user text as redacted.

Main-branch commits change trace data, host mounts and read budgets

At 05:50 China Standard Time on 21 September, the OpenAI Agents SDK merged a tracing change. When the default BackendSpanExporter sends a generation's input and output to the OpenAI tracing receiver, it omits fields such as reasoning, reasoning_content, thinking_blocks and thinking from assistant or response structures, as well as content items whose type is reasoning. The filter does not traverse arbitrary user data and does not cover custom endpoints; the original span remains available to custom processors and exporters. A narrower default export therefore does not mean that every telemetry path has been redacted automatically.

Another commit at 07:36 on the same day rejects one combination before accessing Docker: a read-only host_path grant together with an in-container storage mount that requires SYS_ADMIN. The commit explanation says that SYS_ADMIN may allow a sandbox process to remount a read-only host bind as writable. At 08:49, another commit added the optional max_scan_items setting to EncryptedSession to limit the cumulative number of records read and unwrapped during one get_items call. The underlying store must honour the requested limit, and a RuntimeError is raised if the budget is exhausted before a complete result can be established. Its documentation also says that the limit does not bound the byte size of an individual record, backend-internal work, elapsed time or pop_item work, and the default remains unlimited.

This evidence comes from commits on the openai-agents-python main branch. It is not a new versioned SDK Release. It proves that the code has entered the main branch and shows which data and permission boundaries maintainers are addressing. Until it enters a formal release and a particular application upgrades to it, these behaviours cannot be presented as the default state of a currently installed production version.

A gateway pre-release puts control into configuration, sessions and supply chain

LiteLLM v1.103.0-rc.1 was released at 15:10 China Standard Time on 20 September and is explicitly marked as a Pre-release. The release page explains how to use a fixed public key to verify the cosign signature on this version's Docker image. Its change list also makes the configuration file take precedence over the database, refuses attempts through the configuration update interface to overwrite keys owned by the file, and returns 429 when a deployment's max_parallel_requests slots are all in use.

The same pre-release also allows proxy administrators to force-close active MCP sessions and revoke stored user credentials, adds RFC 8693 token exchange to the gateway token endpoint, and adds an allowlist for MCP client applications. These functions cover supply chain, configuration ownership, identity exchange, session termination and capacity rejection. The release record does not describe them as one unified security guarantee, and provides no independent penetration, latency or failure-recovery results from an enterprise production environment.