ChatGPT conversations become agent sessions, and spend limits now stop Codex and Cursor

ChatGPT workspace conversations now import from the OpenAI Compliance Logs Platform and appear as agent sessions alongside your Claude traffic, so the assistant most of your company already uses stops being a blind spot. Spend limits that already denied over-budget Claude usage now deny Codex and Cursor at parity, Codex cloud surfaces like GitHub code review are metered for the first time, and webhooks are open to every organization. Prospects can also reach the platform on their own now, through a self-serve sign-up page and a live read-only demo organization.

Features

• ChatGPT conversations appear as agent sessions #4860 - A new ChatGPT Conversations integration polls your workspace's compliance conversation logs and lands them in the same Agent Sessions surface as the Anthropic compliance import, configured from a card in organization settings. (Author: @daviddanialy)
• Spend limits now enforce on Codex and Cursor #4870 - Over-budget actors are denied on Codex and Cursor exactly as they are on Claude, on both the legacy hook endpoints and the unified ingest path. Denies link to a durable block page, and the gate keeps failing open on infrastructure errors so an outage never locks anyone out. (Author: @daviddanialy)
• Codex cloud usage is metered and its transcripts imported #4908 - Codex surfaces with no telemetry stream of their own, such as GitHub code review and cloud web tasks, now count toward tokens under management from the compliance cost feed, and cloud task prompts and responses import as agent sessions for post-hoc review (#4910). Codex sessions also carry an account type (team or personal) and the billing mode declared on your integration (#4876). (Author: @daviddanialy)
• Webhooks are available to every organization #5000 - The design-partner preview gate is gone. Webhooks are marked Beta, and delivery is controlled solely by your organization's own webhooks toggle. (Author: @disintegrator)
• Sign up without talking to sales #4990 - A new sign-up page collects a company name and work email, hands off to the identity provider with the email pre-filled, and creates the organization the moment authentication completes. A company name never travels through a redirect or the address bar. (Author: @alx-xo)
• Explore a live demo organization #4952 - Any authenticated user can switch into a shared read-only demo organization to see the product working on real-looking data, then exit back to their own organization without logging out. The book-a-demo gate links straight into it. (Author: @adaam2)
• Role-based access control is on for every organization #4780 - New organizations are provisioned with built-in roles and grants, and the first user is assigned the Admin role. (Author: @tgmendes)
• Control which OAuth clients an MCP server accepts #4901 - Session issuers can admit a curated catalog of verified MCP clients (Claude Code, Claude, VS Code, Zed, ChatGPT, Codex CLI, and more) plus your own URLs, admit any spec-valid client, or admit none. Issuers that haven't chosen a mode record what the curated policy would have decided without enforcing it yet. Clients whose metadata omits an auth method, including ChatGPT and Codex CLI, are now accepted as public clients per the spec. (Author: @bflad)
• Trigger assistants from Microsoft Teams #4855 - Bot Framework activities posted to a trigger webhook are verified against Microsoft's signing keys and dispatched to assistants with the same event filtering as other webhook triggers. (Author: @danielkov)
• Provision and monitor LiteLLM integrations #4830 - Project-scoped LiteLLM provisioning with key rotation and revocation, authenticated OTLP trace ingestion (#4819), opt-in operational metrics that never touch usage billing (#4826), and health and attribution diagnostics (#4841). (Author: @danielkov)
• Search agent sessions by email #4887 - Session search now matches resolved member and AI account email addresses, so finding one person's sessions no longer depends on knowing their user id. (Author: @danielkov)
• One stable link to the macOS device-agent installer #4897 - A stable URL redirects to the current signed installer package, so IT instructions link one address instead of a version that goes stale every release. (Author: @mfbx9da4)
• Configure the device-agent fleet remotely #4693 - Organization admins can set per-tool enforcement layers, release policy, and reconciliation cadence from a new configuration tab, with versioning, validation, and audit logging behind it. (Author: @speakeasyforgebot)
• Figma connects directly from the catalog #4967 - Adding Figma now points your project at Figma's official server instead of routing through a proxy, so there is nothing extra to authorize or allowlist. (Author: @mfbx9da4)
• Setup guides fill in your OAuth callback URL #4907 - Wherever a setup guide asks you to register a redirect URI on an upstream provider, the guide now shows the deployment's real callback URL ready to paste. (Author: @walker-tx)
• See your trial status in the sidebar #4994 - Organizations on an active trial see the current trial day, remaining days, and a link to sales in the navigation. (Author: @alx-xo)
• Bring-your-own cloud credentials move to organization settings #4714 - Requires the customer-managed encryption keys entitlement. Organization admins register how the platform authenticates into their cloud account, and new verification calls confirm service-account impersonation actually works before anything depends on it. (Author: @bflad)
• Platform admin: curate the shared identity provider catalog #4775 - Visible to platform operators only. The providers every organization inherits can be listed, created, edited, and deleted from the dashboard, with client counts that say up front which delete blockers belong to whom. (Author: @bflad)
• Internal: model key lockdown and groundwork #4986 - A locked-down platform model key now fails with a distinct error rather than an upstream rejection, protecting shared capacity. Internal changes to risk finding storage (#4839) and hook binary serving (#4895) also landed. (Author: @walker-tx)

Bug fixes

• API keys no longer leak to unproxied MCP servers #4958 - A server whose URL points directly at a vendor could have your organization's API key attached as a static header, sending it to the third party. Unproxied servers now carry no platform-managed credential in any generated client config, and no longer prompt for an API key during install. (Author: @mfbx9da4)
• Shadow MCP policies now cover Codex's resource meta-tools #4923 - Codex reaches MCP servers through three meta-tools that carry no MCP prefix, so a block-all policy didn't stop a Codex session from reading any server's resources. The gate now recognizes them, resolves the named server against the session's inventory, and denies what it cannot clear. An inventory that could not be read is no longer treated as proof of an empty one (#4978), and explicit empty snapshots are accepted and cached (#5034). (Author: @daviddanialy)
• Codex telemetry is attributed to Codex #4913 - Headless runs, the TUI, MCP mode, and the unified ChatGPT desktop app each report a different service name, and only the interactive CLI matched, so the rest was persisted as Claude traffic and never metered as Codex. Every Codex client mode now routes correctly, per telemetry resource rather than per batch. (Author: @daviddanialy)
• The Codex plugin installs on the unified ChatGPT app #4912 - The installer now probes the merged ChatGPT desktop app's bundled Codex binary first, keeping the legacy path for pre-merge installs. The renamed Codex MCP client user agent passes the Figma allowlist again (#4915), and the Codex setup copy reflects the merged app (#4916). (Author: @daviddanialy)
• Enforcement block pages always exist #4972 - A block early in a session could race its own chat row and silently fail to write, leaving the blocked user opening a page that didn't exist. The write now drops unresolvable links and retries, so the block always lands. (Author: @daviddanialy)
• Quiet MCP streams no longer log spurious errors #4968 - A proxied SSE stream ending on the 60-second idle bound is now a clean close instead of one fake 500 per minute per connected client. (Author: @danielkov)
• Unreachable MCP servers fail the tools probe in seconds #4996 - Two compounding retry layers could stretch a live tool-listing probe past a minute against a dead vendor server. The probe is now time-boxed to its intended ~10-second bound. (Author: @mfbx9da4)
• Chat analysis no longer exhausts shared model capacity #4911 - The shared LLM judge rate limiter now buckets by the key a call actually spends, so platform-key traffic can't starve a model and fail with 429s. (Author: @danielkov)