OpenAI Launches Agents API for Codex

OpenAI launched its Agents API in public beta on September 10, 2026, turning the Codex agent harness into a managed cloud service. Developers can define an AI agent, connect its tools, select an execution environment, and start durable sessions without building the entire control loop themselves.

The important change is architectural. A conventional model API returns responses and tool calls, leaving the application to manage execution, context, retries, orchestration, and recovery. The Agents API runs that surrounding harness for the developer. OpenAI says the resulting agents can keep working for hours or days, survive interruptions, and coordinate subagents while remaining steerable.

OpenAI pairs the service with gpt-6-astra, its agentic coding model designed to power these longer-running workflows. The launch pitch is summarized neatly in the accompanying X post:

OpenAI Is Turning the Codex Harness Into Infrastructure

An agent model does not become useful simply because it can call a function. It needs a harness that decides when to inspect files, run commands, invoke external services, revise a plan, compress old context, recover from failures, and stop.

OpenAI already exposes that orchestration layer locally through the open-source Codex App Server. The Agents API provides a cloud-hosted version of the Codex harness, with OpenAI operating the session and orchestration infrastructure. Developers can still control the prompts, tools, model configuration, and compute environment.

The Agents API architecture centers on four concepts:

• Agent: Reusable configuration covering instructions, model settings, tools, skills, plugins, and execution policy.
• Environment: The sandbox in which the agent can read files, execute code, and interact with permitted systems.
• Session: A durable instance of the agent performing a task.
• Items and events: Structured records describing messages, tool calls, subagent activity, progress, and output.

This structure makes an agent session closer to a managed workload than a sequence of chat messages. The developer specifies the work and monitors events while the Codex harness maintains the loop around the model.

The API Separates the Agent Harness From the Sandbox

“Fully managed by OpenAI” does not require every command to run on OpenAI-controlled compute. The Agents API separates the hosted harness from the environment where generated code executes.

Developers can choose among three broad approaches:

• An OpenAI-hosted sandbox with Python, Node.js, common command-line tools, package installation, file storage, and configurable network access.
• A self-hosted sandbox running on the developer’s own infrastructure.
• A managed environment from partners including Daytona, E2B, Runloop, and Modal.

For a self-hosted environment, OpenAI’s codex exec-server process runs inside the sandbox and opens an outbound WebSocket connection to the Agents API. The harness sends commands through that connection, while files and execution stay within the developer-controlled environment. A restricted executor key authenticates the sandbox without providing full API access.

That separation is one of the launch’s strongest technical decisions. An organization can use OpenAI’s managed orchestration while retaining its own container images, regional infrastructure, internal dependencies, security controls, and data-access policies.

However, “connect it to any sandbox” should not be read as automatic compatibility with arbitrary compute. In practice, the environment must run the executor integration and support the command, file, and event protocol expected by the harness.

Durable Sessions Change the Programming Model

Agents API sessions are designed for work that cannot be completed reliably in a single synchronous request. Applications can start a session asynchronously, stream its events, poll for status, or receive webhook notifications when important events occur.

OpenAI’s session documentation says the service maintains context, compacts long histories, retries certain tool operations, and rehydrates interrupted sessions. Developers can also steer an active session by adding instructions instead of terminating the job and starting again.

This removes a considerable amount of distributed-systems work. A production agent would otherwise need its own state store, worker queue, context-compaction logic, recovery process, and event protocol.

Managed sessions do not eliminate the need to inspect results. OpenAI notes that a session marked as completed can still contain individual tool failures. Applications should examine structured events and tool records rather than treating the final status as proof that every intermediate action succeeded.

Bring Your Own Tools, Connectors, and Compute

Agents can use OpenAI tools such as web search alongside custom functions, shell commands, skills, plugins, and Model Context Protocol connections. The MCP integration supports both remote servers reached by the Agents API service and local servers accessed from inside the execution environment.

Image: Self-hosted sandboxes | OpenAI API.

That distinction matters for private systems. A remote MCP server might expose an approved SaaS connector, while a local MCP server could provide access to an internal database or service that is reachable only from the company’s network. Developers can decide which part of the system initiates the connection and where the credentials live.

The environment abstraction also allows an agent to work with existing programming infrastructure rather than a narrow set of OpenAI-hosted utilities. A team could provide a container containing its compiler, repository, test suite, internal CLI, deployment scripts, or data-processing dependencies.

The practical result is a division of responsibility:

• OpenAI manages model execution, the Codex harness, session state, and orchestration.
• The developer controls agent instructions, available tools, permissions, and sandbox configuration.
• The sandbox handles code execution, files, packages, and permitted network activity.
• External services remain behind the developer’s authentication and authorization policies.

This approach gives the Agents API a wider target than coding assistants alone. The same structure could support incident investigation, data analysis, software maintenance, internal research, document processing, or operational workflows that require many tool calls.

Astra Can Delegate Work and Search for the Right Tools

OpenAI positions gpt-6-astra as the model designed to power the Agents API, but the surrounding harness features may matter as much as the model itself.

The API supports multi-agent orchestration, allowing a coordinator to delegate independent tasks to subagents. A programming agent could ask one subagent to inspect a repository, another to review documentation, and a third to run tests, then combine their results in the parent session.

Parallelism is not free. OpenAI’s documentation recommends subagents for work that can proceed independently and acknowledges that delegation increases token consumption and latency. Splitting a tightly coupled task among too many agents may create more coordination work than useful progress.

Astra also supports tool search. Instead of placing every available function schema into the initial context, developers can mark large tools or namespaces as deferred. The model searches for and loads a tool only when the task requires it. That keeps extensive MCP catalogs and enterprise integrations from consuming context before the agent knows what it needs.

Programmatic tool calling takes a different approach. The model can generate Python code that invokes several tools inside a container, processes their results, and returns a smaller final result. Intermediate outputs do not all need to travel back through separate model turns, which can reduce round trips and prevent large tool responses from filling the context window.

“Let Astra cook” therefore has a concrete technical meaning: give the model an execution environment, a searchable tool catalog, and the ability to delegate work without forcing the application to coordinate every step.

Where the Agents API Fits in OpenAI’s Stack

OpenAI now offers several overlapping ways to create AI agents. The appropriate choice depends on how much of the runtime a development team wants to own.

The Agents API is likely excessive for a chatbot that makes one or two predictable tool calls. The Responses API or Agents SDK gives developers more direct control with less infrastructure between the application and the model.

The managed API becomes more attractive when tasks involve large workspaces, many tool invocations, long pauses, process failures, user steering, or parallel subagents. Those requirements are where a homegrown agent loop tends to turn into a distributed job-processing system.

The Beta Removes Plumbing, Not Production Responsibility

OpenAI manages the harness, but developers remain responsible for what the agent can reach and what generated code can do. The company’s sandbox security guidance explicitly recommends treating agent-generated code as untrusted.

This warning is especially important because outbound network access is enabled by default in OpenAI-hosted environments. Production deployments should disable it when unnecessary or restrict it to an allowlist of required domains. Sandbox isolation should also prevent one agent session from accessing another session’s files, processes, or credentials.

Secrets deserve similar care. Putting a long-lived API key in an environment variable or file still exposes it to any generated code running inside that environment. OpenAI recommends placing third-party credentials behind a broker that adds scoped authentication only to approved requests.

Cost also needs monitoring. OpenAI says there is no additional fee for the Agents API, but applications still pay standard model-token, tool, and container charges. A session that spawns several subagents, searches a large tool catalog, and runs for hours can consume considerably more resources than a single model response.

The service also provides environment portability rather than complete harness portability. Developers can bring their compute and tools, but OpenAI still operates the orchestration layer. Teams that require a fully self-managed agent runtime can continue running the public Codex harness locally through App Server.

Final Thoughts

The Agents API reflects a broader change in AI programming: the hard part is moving from a capable model response to a reliable process that can keep working. Context management, recovery, event delivery, sandbox communication, tool routing, and parallel coordination have become infrastructure concerns.

OpenAI is productizing that infrastructure without requiring every workload to move into an OpenAI sandbox. That balance gives the service a credible role in enterprise and developer environments where local dependencies, private networks, or custom security policies cannot be replaced by a generic hosted container.

The public beta still has to prove its reliability, observability, security, and cost during real multi-hour workloads. If it succeeds, the Agents API could let developers spend less time rebuilding orchestration machinery and more time defining the tools, permissions, environments, and success criteria that make an agent useful.