gpt-oss is OpenAI's family of open-weight language models, and this repository is the official home for running them. There are two: gpt-oss-120b, a 117-billion-parameter mixture-of-experts model that fits on a single 80 GB GPU, and gpt-oss-20b, which runs within 16 GB of memory and suits a well-equipped desktop or Apple Silicon Mac. Both are reasoning models with adjustable effort (low, medium or high), full access to their chain of thought, and native function calling.
The repo holds reference code rather than an app: PyTorch, Triton and Apple Metal implementations, a terminal chat client, an example Responses API server, and reference versions of the browser and Python tools the models were trained to use. Most people run the weights through Ollama, LM Studio, vLLM or Transformers instead, and the README gives the commands for each. The models expect OpenAI's harmony prompt format, which those runners apply for you.
Code and weights are Apache-2.0, with about 20,500 stars, at release v0.0.9 when scanned. The PyTorch version is for learning only and needs four H100s, the reference implementations are untested on Windows, and commits have slowed since launch, so treat the repo as documentation more than a project to follow.
- Repository: github.com/openai/gpt-oss
- Licence: Apache-2.0 (Apache License 2.0)
- Language: Python. Stars: 20.5K. Forks: 2,187. Last push: Oct 12, 2026.
- Scan: safe, Oct 26, 2026, commit 5681a6b
Who it is for
Developers who want a capable open model they can run, fine-tune and ship commercially, and anyone with a 16 GB graphics card or an Apple Silicon Mac who wants an OpenAI-built model that works offline.
Getting started
1. Run the smaller model with Ollama (install Ollama first)
ollama run gpt-oss:20b2. Or install the reference package
pip install gpt-oss3. Download the original weights from Hugging Face
hf download openai/gpt-oss-20b --include "original/*" --local-dir gpt-oss-20b/gpt-oss-120b needs about 80 GB of GPU memory. LM Studio users can fetch the small model with lms get openai/gpt-oss-20b.
Safety scan
We cloned openai/gpt-oss at commit 5681a6b on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no suspicious patterns, no install hooks and no committed binaries across 160 files and about 34,500 lines of Python, C, Metal and notebooks.
- The python tool executes code the model writes inside a permissive Docker container; the README warns that prompt injection could abuse it and asks you to add your own limits. The browser tool sends searches to You.com or Exa with your own key for those services.
- All 41 known advisories (1 critical, 22 high) sit in two JavaScript lockfiles, compatibility-test/package-lock.json and examples/agents-sdk-js/package-lock.json, mostly an older MCP SDK and Express helpers. Both are test and example projects, not part of the pip package or the weights.
- One workflow, with its single third-party action pinned to a commit. OpenSSF Scorecard is 5.8 out of 10, pulled down by low recent activity and by having no security policy, CodeQL or Dependabot in the repository.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | None: nothing runs at install beyond the package manager itself. |
| Committed binaries | None. |
| CI workflows | 1 workflow. None use pull_request_target. 0 of 1 third-party action pinned to a tag rather than a commit. |
| Network hosts | 16 distinct hosts referenced from source; most often www.example.com, github.com, docs.unsloth.ai, huggingface.co. No URLs to bare IP addresses. |
| Known vulnerabilities | 41 advisories across 166 pinned packages: 1 critical, 22 high, 14 moderate, 4 low. compatibility-test/package-lock.json: 126 packages, 34 advisories; examples/agents-sdk-js/package-lock.json: 130 packages, 21 advisories. |
| Project hygiene | Has licence file. Missing security policy, automated dependency updates, CodeQL, contributing guide. |
| OpenSSF Scorecard | 5.8 out of 10, as of Oct 19, 2026. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Worst known vulnerabilities (24 of 41)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-jqcg-44mw-7w3h | critical | proxy-addr@2.0.7 | proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet |
| GHSA-345p-7cg4-v4c7 | high | @modelcontextprotocol/sdk@1.17.1 | @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse |
| GHSA-46jr-4wx8-v453 | high | @modelcontextprotocol/sdk@1.17.1 | MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation |
| GHSA-6qxp-vccf-f47h | high | @modelcontextprotocol/sdk@1.17.1 | MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server |
| GHSA-8r9q-7v3j-jr4g | high | @modelcontextprotocol/sdk@1.17.1 | Anthropic's MCP TypeScript SDK has a ReDoS vulnerability |
| GHSA-w48q-cv73-mx4w | high | @modelcontextprotocol/sdk@1.17.1 | Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default |
| GHSA-27r3-jxmh-p828 | high | body-parser@2.2.0 | body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body |
| GHSA-4c8g-83qw-93j6 | high | fast-uri@3.0.6 | fast-uri vulnerable to host confusion via failed IDN canonicalization |
| GHSA-7p8r-x3mc-p8w7 | high | fast-uri@3.0.6 | fast-uri vulnerable to host confusion via backslash authority introducer |
| GHSA-f65p-4m7j-42xc | high | fast-uri@3.0.6 | fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization |
| GHSA-jqff-g426-hqxp | high | fast-uri@3.0.6 | fast-uri vulnerable to host confusion via percent-encoded scheme normalization |
| GHSA-q3j6-qgpj-74h6 | high | fast-uri@3.0.6 | fast-uri vulnerable to path traversal via percent-encoded dot segments |
| GHSA-qw65-cvwx-89v3 | high | fast-uri@3.0.6 | fast-uri vulnerable to authority injection via an unvalidated port in serialize |
| GHSA-v2hh-gcrm-f6hx | high | fast-uri@3.0.6 | fast-uri vulnerable to host confusion via literal backslash authority delimiter |
| GHSA-v39h-62p7-jpjc | high | fast-uri@3.0.6 | fast-uri vulnerable to host confusion via percent-encoded authority delimiters |
| GHSA-j3q9-mxjg-w52f | high | path-to-regexp@8.2.0 | path-to-regexp vulnerable to Denial of Service via sequential optional groups |
| GHSA-96hv-2xvq-fx4p | high | ws@8.18.3 | ws: Memory exhaustion DoS from tiny fragments and data chunks |
| GHSA-mrhx-c7xc-m3w5 | high | zod@3.25.67 | Zod can exhaust memory while validating oversized constrained collections |
| GHSA-345p-7cg4-v4c7 | high | @modelcontextprotocol/sdk@1.17.0 | @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse |
| GHSA-46jr-4wx8-v453 | high | @modelcontextprotocol/sdk@1.17.0 | MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation |
| GHSA-6qxp-vccf-f47h | high | @modelcontextprotocol/sdk@1.17.0 | MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server |
| GHSA-8r9q-7v3j-jr4g | high | @modelcontextprotocol/sdk@1.17.0 | Anthropic's MCP TypeScript SDK has a ReDoS vulnerability |
| GHSA-w48q-cv73-mx4w | high | @modelcontextprotocol/sdk@1.17.0 | Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default |
| GHSA-6prh-2h8m-c8cw | moderate | @modelcontextprotocol/sdk@1.17.1 | MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom … |
By the numbers
| Stars | 20.5K |
|---|---|
| Forks | 2,187 |
| Contributors | 65 |
| Commits | 131 |
| Open issues | 28 |
| Open pull requests | 142 |
| Releases | 6 |
| Latest release | v0.0.9 |
| Licence | Apache-2.0 |
| Main language | Python |
| Project age | 1 year |
| Last push | Oct 12, 2026 |
| Tracked files | 160 |
| Lines of code | 34.5K |
| Checkout size | 45 MB |
Lines by language: Python 10.8K, Jupyter 9,408, C 4,391, C/C++ header 3,262, Metal 2,506, C++ 1,763.
Questions
Is gpt-oss free?
Yes. The code and both models are Apache-2.0, so you can use, fine-tune and ship them commercially without fees. Running them costs only your hardware, or whatever a hosted provider charges if you use one.
What hardware do I need for gpt-oss?
gpt-oss-20b runs within 16 GB of memory, so a 16 GB graphics card or an Apple Silicon Mac with enough unified memory will do. gpt-oss-120b is built to fit a single 80 GB GPU such as an NVIDIA H100 or AMD MI300X.
Does gpt-oss send my prompts to OpenAI?
No. Once downloaded, the weights run entirely on your machine. The only network calls in the repo are the model download and the optional browser tool's searches.
Do I need to use the harmony format?
The models were trained on it and do not work properly without it. Transformers' chat template, Ollama, LM Studio and vLLM apply it automatically; only direct model.generate calls or custom servers need the openai-harmony library.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.