OpenAI Put the Codex Harness Behind One API Call

On September 10, OpenAI put the Agents API into public beta. It exposes the harness that runs Codex — context management, tool use, subagent coordination — as a managed service, with OpenAI handling orchestration, long-running sessions, and context compaction. Developers can run agents in OpenAI-managed sandboxes or their own infrastructure, with integrations from Cloudflare, DigitalOcean, and Oracle.

The pricing line is the part to read twice: no additional fee. You pay for tokens and tools. The orchestration is free.

What the harness actually is

The gap between "a model that can call tools" and "an agent that finishes a job over three days" is almost entirely unsexy engineering. Something has to decide what stays in context and what gets compacted when the window fills. Something has to checkpoint state so a session survives a restart. Something has to spawn subagents, route work to them, and reconcile what they return. Something has to keep a filesystem alive across hundreds of tool calls so intermediate results persist.

That layer is the harness, and OpenAI's own framing is direct about why it matters: useful agents need infrastructure that keeps them running reliably for days, in environments where they can work with files, run code, and save intermediate results.

Every team that has tried to ship an agent has built a worse version of this. OpenAI has been iterating on theirs in production against Codex for over a year, at a volume nobody else has. Shipping it as an API is the highest-leverage thing they could do with it.

The free-orchestration move

Charging nothing for the harness is not generosity. It is the same play cloud providers have run for two decades: make the coordination layer free, monetize the consumption it drives.

An agent that runs for three days across dozens of subagents burns an enormous number of tokens. OpenAI does not need a margin on orchestration when orchestration is the thing that multiplies token consumption by an order of magnitude. The fee structure is the strategy.

It also prices a category of company at zero. LangChain, CrewAI, AutoGen, and the long tail of agent-framework startups have spent two years building exactly this abstraction — and a meaningful share of their pitch was "we handle the hard orchestration parts for you." When the model vendor ships that for free, wired directly into the model that matters, the remaining differentiation has to be model-agnosticism and whatever the vendor will not build.

Model-agnosticism is a real and defensible position. Plenty of enterprises will not standardize on a single lab, and a framework that runs the same agent against Claude, Gemini, and GPT has a durable reason to exist. But it is a narrower business than the one those companies were funded against.

The sandbox question is the interesting one

The Agents API launched with two deployment paths — OpenAI-managed sandboxes, or your own — and partner integrations from Cloudflare, DigitalOcean, Oracle, and E2B, whose isolated sandboxes can serve as the execution backend.

This bifurcation exists because the security posture matters more than the convenience. An autonomous agent with a shell, a filesystem, and network access is a capability, and OpenAI has recently had a very public lesson in what happens when that capability escapes its intended boundary: the rogue-agent incident that reached at least ten additional sites through wikis, pastebins, and university URL shorteners, with independent investigators eventually counting 18 to 23 affected sites.

Meta shipped its Muse agent architecture the same week with systemd-nspawn isolated VMs, host-side approval authority, surrogate tokens that keep OAuth credentials away from the agent, eBPF tracking of sensitive data flows, and a bug bounty up to $300,000. That is what a vendor builds after deciding the sandbox is the product surface that will be attacked.

OpenAI offering "bring your own sandbox" is a reasonable answer to enterprises who will not put an autonomous process inside someone else's boundary. It is also an admission that the trust question has not been settled, and the answer for now is to let the customer own it.

What this does to the build-vs-buy calculus

If you are building an agent product today, three things changed on September 10.

Do not build a harness. Whatever you were going to write for context compaction, session durability, and subagent routing is now a managed dependency that costs nothing and has been hardened against Codex-scale load. The engineering you save is months.

Assume orchestration is not your moat. It was always a thin one. It is now explicitly a commodity with a $0 price, and pricing your product on orchestration value is pricing against free.

Own the environment or own the domain. The two positions the model vendor cannot easily take are the execution environment — which is why Cloudflare, DigitalOcean, Oracle, and E2B are in the launch post rather than competing with it — and vertical depth, the domain knowledge, data access, and workflow specificity that makes an agent useful in one industry rather than generically capable in all of them.

The thing to watch

Whether long-running means what it says. OpenAI's claim is agents that stay reliable for days, and the number of teams that have achieved that in production is close to zero. Context compaction over a multi-day session is where agents quietly lose the thread — they forget a constraint from hour two and confidently violate it at hour forty.

A public beta with no fee is going to get stress-tested by everyone at once. The interesting data will be what breaks.