openai 3.37.0

Source: https://github.com/openai/openai-python
Artifact scanned: openai-3.37.0-py3-none-any.whl (wheel · 2.2 MB · SHA-256 d9f5b000f523…)
Compared with: openai-3.36.1-py3-none-any.whl (0 signals introduced since)
Files: 2008 scanned, 7 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 44 info
Scan time: 26.3 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 44 of 44 warn and critical signals; 44 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 10:43

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-attribute openai/__init__.py:139:13

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            value = getattr(import_module(module, __name__), name)
            globals()[name] = value
            return value
        raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
```
likely benign LLM, confidence 0.95 Module-level lazy attribute loader for the openai package that imports submodules and caches them in globals.
Reasoning
This is the standard lazy-loading __getattr__ pattern: it imports a submodule by name from a fixed package and caches the attribute in globals. No external input or decoding is involved, so the dynamic getattr is benign.
info ~~warn~~ → info by review dynamic-attribute openai/lib/streaming/__init__.py:19:13

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            value = getattr(import_module("._assistants", __name__), name)
            globals()[name] = value
            return value
        raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
```
likely benign LLM, confidence 0.95 Lazy submodule loader in openai streaming package caching resolved attributes into globals.
Reasoning
Same lazy-import __getattr__ idiom, importing a relative submodule '._assistants' within the package. Standard and harmless.
info ~~warn~~ → info by review dynamic-attribute openai/resources/__init__.py:350:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy resource-module loader in openai resources package.
Reasoning
Lazy-loading pattern restricted to the package's own resources; the name is resolved via import_module from a known package and cached. No network, decoding, or execution of arbitrary data.
info ~~warn~~ → info by review dynamic-attribute openai/resources/admin/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy submodule loader for openai admin resources.
Reasoning
Identical generated lazy-import __getattr__ idiom inside the openai admin subpackage; benign SDK code.
info ~~warn~~ → info by review dynamic-attribute openai/resources/admin/organization/__init__.py:233:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy attribute loader for openai admin organization resources.
Reasoning
Same generated lazy-loading pattern that imports and caches package-internal attributes; no malicious indicators.
info ~~warn~~ → info by review dynamic-attribute openai/resources/admin/organization/groups/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy loader for openai organization groups resources.
Reasoning
Standard lazy __getattr__ importing internal modules and caching into globals; benign.
info ~~warn~~ → info by review dynamic-attribute openai/resources/admin/organization/projects/__init__.py:230:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy loader for openai organization projects resources.
Reasoning
Generated SDK lazy-import idiom confined to package-internal modules; benign.
info ~~warn~~ → info by review dynamic-attribute openai/resources/admin/organization/projects/groups/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy loader for openai project groups resources.
Reasoning
Standard lazy-import __getattr__ pattern with no external input; benign.
info ~~warn~~ → info by review dynamic-attribute openai/resources/admin/organization/projects/service_accounts/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy loader for openai project service accounts resources.
Reasoning
Standard lazy-import idiom resolving internal submodules; benign.
info ~~warn~~ → info by review dynamic-attribute openai/resources/admin/organization/projects/users/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy loader for openai project users resources.
Reasoning
Standard lazy-import __getattr__ within the SDK package; benign.
info ~~warn~~ → info by review dynamic-attribute openai/resources/admin/organization/users/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy loader for openai organization users resources.
Reasoning
Standard lazy-import idiom for internal submodules; benign.
info ~~warn~~ → info by review dynamic-attribute openai/resources/audio/__init__.py:113:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy loader for openai audio resources.
Reasoning
Generated lazy-loading __getattr__ resolving package-internal modules; benign SDK pattern.
info ~~warn~~ → info by review dynamic-attribute openai/resources/beta/__init__.py:113:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy loader for openai beta resources.
Reasoning
Same lazy-import idiom for internal beta resource modules; benign.
info ~~warn~~ → info by review dynamic-attribute openai/resources/beta/agents/__init__.py:83:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy loader for openai beta agents resources.
Reasoning
Standard lazy __getattr__ importing and caching internal submodules; benign.
info ~~warn~~ → info by review dynamic-attribute openai/resources/beta/agents/environments/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.95 Lazy loader for openai beta agent environments resources.
Reasoning
Standard lazy-import idiom confined to the package; benign.
info ~~warn~~ → info by review dynamic-attribute openai/resources/beta/agents/sessions/__init__.py:128:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Module-level lazy attribute loader that caches resolved names into globals().
Reasoning
The snippet is the standard PEP 562 module __getattr__ pattern: it raises AttributeError for unknown names and caches a lazily imported submodule or value into globals(). The name comes from attribute access on the module, not untrusted input, and nothing is executed or fetched. This is a common SDK lazy-loading idiom.
info ~~warn~~ → info by review dynamic-attribute openai/resources/beta/agents/sessions/subagents/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy module attribute resolver caching names into globals() in the subagents package.
Reasoning
Same lazy-import __getattr__ idiom: unknown names raise AttributeError and resolved names are cached in globals(). It is a generated package __init__ in an SDK with no execution or network behaviour.
info ~~warn~~ → info by review dynamic-attribute openai/resources/beta/agents/sessions/subagents/turns/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy attribute loader for the subagent turns package, caching into globals().
Reasoning
Standard PEP 562 lazy loader in a generated SDK package __init__. It only resolves and caches attributes of the package's own submodules.
info ~~warn~~ → info by review dynamic-attribute openai/resources/beta/agents/sessions/turns/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy attribute loader for the session turns package, caching into globals().
Reasoning
Standard PEP 562 lazy loader pattern in an SDK package __init__. No decoding, execution or external I/O is involved.
info ~~warn~~ → info by review dynamic-attribute openai/resources/beta/agents/vaults/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy attribute loader for the agents vaults package.
Reasoning
Standard PEP 562 module __getattr__ lazy-import idiom in a generated SDK __init__; the dynamic lookup is confined to the package's own names.
info ~~warn~~ → info by review dynamic-attribute openai/resources/beta/chatkit/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy attribute loader for the beta chatkit package.
Reasoning
Standard lazy-loading __getattr__ that raises AttributeError on unknown names and caches resolved attributes. Typical of generated OpenAI SDK package initialisers.
info ~~warn~~ → info by review dynamic-attribute openai/resources/beta/responses/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy attribute loader for the beta responses package.
Reasoning
Standard PEP 562 lazy attribute resolution in a generated SDK __init__; reaching names through globals() here is an ordinary caching step with no malicious indicators.
info ~~warn~~ → info by review dynamic-attribute openai/resources/beta/threads/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy attribute loader for the beta threads package.
Reasoning
Same lazy-import __getattr__ pattern used across the SDK. It only resolves the package's own exports.
info ~~warn~~ → info by review dynamic-attribute openai/resources/beta/threads/runs/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy attribute loader for the threads runs package.
Reasoning
Standard lazy-loading module __getattr__ with AttributeError fallback and globals() caching. No obfuscation or dynamic execution beyond the normal idiom.
info ~~warn~~ → info by review dynamic-attribute openai/resources/chat/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy attribute loader for the chat package.
Reasoning
Standard PEP 562 lazy-import idiom in the SDK's chat package __init__. The name lookup is bounded by the module's own exports.
info ~~warn~~ → info by review dynamic-attribute openai/resources/chat/completions/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy attribute loader for the chat completions package.
Reasoning
Standard lazy-loading __getattr__ with a caching assignment into globals(). Benign generated SDK code.
info ~~warn~~ → info by review dynamic-attribute openai/resources/containers/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy attribute loader for the containers package.
Reasoning
Same PEP 562 lazy loader idiom in a generated SDK __init__, with no execution, network or encoding involved.
info ~~warn~~ → info by review dynamic-attribute openai/resources/containers/files/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy attribute loader for the container files package.
Reasoning
Standard lazy-import __getattr__ that caches resolved names. It matches the rest of the generated SDK and has no malicious signal.
info ~~warn~~ → info by review dynamic-attribute openai/resources/conversations/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy attribute loader for the conversations package.
Reasoning
Standard PEP 562 lazy loader in a generated SDK package __init__. Resolution is limited to the package's own names.
info ~~warn~~ → info by review dynamic-attribute openai/resources/evals/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy attribute loader for the evals package.
Reasoning
Standard lazy-import __getattr__ idiom with AttributeError fallback and globals() caching. Expected in generated SDK code.
info ~~warn~~ → info by review dynamic-attribute openai/resources/evals/runs/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy attribute loader for the evals runs package.
Reasoning
Same lazy-loading module __getattr__ pattern. It only caches the package's own attributes and does nothing beyond normal import resolution.
info ~~warn~~ → info by review dynamic-attribute openai/resources/fine_tuning/__init__.py:83:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy-import __getattr__ in the openai fine_tuning package that caches resolved names into globals().
Reasoning
The snippet is a module-level __getattr__ that caches a lazily imported submodule or attribute into globals() after raising AttributeError for unknown names. This is a standard lazy-loading idiom in the OpenAI SDK package layout, with no decoding, execution, or network access.
info ~~warn~~ → info by review dynamic-attribute openai/resources/fine_tuning/alpha/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy-import __getattr__ caching resolved names into globals() in the openai fine_tuning alpha package.
Reasoning
Same lazy-loading __getattr__ pattern: it resolves a name, stores it in globals(), and otherwise raises AttributeError. It matches the SDK's generated package structure and does nothing suspicious.
info ~~warn~~ → info by review dynamic-attribute openai/resources/fine_tuning/checkpoints/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy-import __getattr__ caching into globals() in the openai fine_tuning checkpoints package.
Reasoning
The snippet shows the standard lazy attribute resolution pattern: raise AttributeError for unknown names, otherwise cache into globals(). The file is a plain SDK resource package initializer.
info ~~warn~~ → info by review dynamic-attribute openai/resources/fine_tuning/jobs/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy-import __getattr__ caching into globals() in the openai fine_tuning jobs package.
Reasoning
This is the generated lazy-loading __getattr__ idiom used across openai resource packages. It reads a name, caches it in globals() and returns it, with no sensitive operations visible.
info ~~warn~~ → info by review dynamic-attribute openai/resources/live/__init__.py:67:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy-import __getattr__ caching into globals() in the openai live resource package.
Reasoning
The snippet is the usual module-level __getattr__ that lazily binds submodule attributes into globals() and raises AttributeError otherwise. This is an ordinary performance pattern in the SDK.
info ~~warn~~ → info by review dynamic-attribute openai/resources/realtime/__init__.py:83:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy-import __getattr__ caching into globals() in the openai realtime resource package.
Reasoning
Standard lazy __getattr__ that stores resolved attributes in globals(). The pattern is common in generated SDK package initializers and shows no decoding or process execution.
info ~~warn~~ → info by review dynamic-attribute openai/resources/realtime/translations/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy-import __getattr__ caching into globals() in the openai realtime translations package.
Reasoning
Lazy attribute resolution via __getattr__ with caching into globals(), identical to the other openai package initializers. Nothing in the snippet is dynamic execution or network activity.
info ~~warn~~ → info by review dynamic-attribute openai/resources/responses/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy-import __getattr__ caching into globals() in the openai responses resource package.
Reasoning
This is the generated lazy-loading __getattr__ pattern, which raises AttributeError for unknown names and caches resolved names in globals(). It is consistent with the SDK's package structure.
info ~~warn~~ → info by review dynamic-attribute openai/resources/safety/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy-import __getattr__ caching into globals() in the openai safety resource package.
Reasoning
Standard module __getattr__ that binds lazily loaded names into globals(). It is a common SDK idiom and does not reach the network or run decoded code.
info ~~warn~~ → info by review dynamic-attribute openai/resources/skills/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy-import __getattr__ caching into globals() in the openai skills resource package.
Reasoning
Lazy __getattr__ with globals() caching, the same generated idiom as the rest of the openai resource tree. There is no sign of malicious intent in the snippet.
info ~~warn~~ → info by review dynamic-attribute openai/resources/skills/versions/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy-import __getattr__ caching into globals() in the openai skills versions package.
Reasoning
The snippet shows the usual lazy __getattr__ resolution with caching into globals(), with an AttributeError fallback. This is benign SDK package scaffolding.
info ~~warn~~ → info by review dynamic-attribute openai/resources/uploads/__init__.py:53:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy-import __getattr__ caching into globals() in the openai uploads resource package.
Reasoning
Lazy attribute loading via __getattr__ with globals() caching, matching the generated SDK pattern. The snippet contains no decoding, execution, or network calls.
info ~~warn~~ → info by review dynamic-attribute openai/resources/vector_stores/__init__.py:68:9

reach-by-name through `globals` (ast pass, confidence 0.60)
```
            raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
        globals()[name] = value
        return value
```
likely benign LLM, confidence 0.93 Lazy-import __getattr__ caching into globals() in the openai vector_stores resource package.
Reasoning
Standard lazy __getattr__ that caches resolved names into globals() and raises AttributeError otherwise. This is a routine package-initializer idiom in the OpenAI SDK.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o openai-3.37.0-py3-none-any.whl https://files.pythonhosted.org/packages/56/73/c605f0cee1882e453a4b7fc2f17f4a42a7d4c1ed2304aff4b163ffade819/openai-3.37.0-py3-none-any.whl
printf '%s  %s\n' d9f5b000f52397a7f9f946012744c5bc4c962eed3c100385252464c273a63e57 openai-3.37.0-py3-none-any.whl | shasum -a 256 -c -
unzip -q openai-3.37.0-py3-none-any.whl -d pkg
disclude scan --untrusted --severity info pkg