OpenAI will host the agent loop. You still own the mistake.
The Agents API, launched 10 September 2026, rents you the Codex harness. Here is when a hosted agent loop is the right buy — and when it just moves the risk.
On 10 September 2026 OpenAI put the harness behind Codex and ChatGPT for Work into a public API. You send a task. They run the loop: model calls, tools, context, a session you can continue. You can rent that loop today. You cannot rent away the decision of what the agent is allowed to touch, or the apology if it touches the wrong thing.
That is the whole buying decision. Everything else is packaging.
10 Sept
Agents API enters public beta — the Codex harness, operated by OpenAI
No separate API fee. You pay for tokens and tools.
3 cages
no sandbox, an OpenAI-hosted sandbox, or a sandbox you run
OpenAI Agents API FAQ. The hosted one bills at container rates, on top of the model.
16 Sept
Google opens a private preview that reads agent traces and flags bad runs
Agent Anomaly Detection on the Gemini Enterprise Agent Platform. A signal, not a switch you can flip this afternoon.
What you are actually renting
For two years, "we built an agent" usually meant a team had written the unglamorous middle: call the model, pass it tools, trim the context when the window fills, store the session, retry the weird step, stop when it loops. OpenAI is now selling that middle. The launch post is plain about the deal. They host and maintain the harness. You choose where the work runs. There is no extra fee for the API itself. You pay for the tokens and the tools the agent uses.
Read the second sentence twice. The hosted sandbox is a tool. OpenAI's docs say those sandboxes bill at standard container rates, with the model billed separately. "No additional fee" means there is no cover charge for the orchestration. It does not mean a day of frontier-model runs in a sandbox is free. If the quote you are holding treats the harness as a rounding error, ask for a weekly cap before you celebrate.
The FAQ is more useful than the keynote. An agent in this API can run code, edit files, use MCP connections, and hand files back. You can send another instruction into the same session. You keep the API key outside the sandbox. Requests that try to inject OPENAI_API_KEY into the environment are rejected. That last detail is the one to steal even if you never call this API.
Three environments, and only one of them is a default
OpenAI's own FAQ splits the choice cleanly. Use their words, then apply them to a business rather than a demo.
No environment. The agent answers or calls external tools. It does not get a shell or a workspace. This is the right shape for a bounded lookup: read this ticket, draft a reply, stop. It becomes the wrong shape the moment "external tools" means a production admin key that can refund, delete, or email the whole list. A tool with no sandbox is not a safer agent. It is an agent whose blast radius is whatever that key can do.
OpenAI-hosted sandbox. They provision a Linux workspace with Python, Node, and a shell. You supply the task and take the artifacts back. Their sample session turns network access off. Leave it off unless a named host is required. The Hugging Face incident was a model that found a path out of a cage and went looking for the answer on the public internet. Default the path to closed. Open it for one API, on purpose.
A sandbox you run. You need your own image, your own network, or data that cannot sit in their container. You are back to operating the cage: lifecycle, isolation, logs, the weekend pager. That is a legitimate choice. It is not a smaller project. It is the project, with their loop in the middle.
Your task + your allowlist
↓
Harness they operate (session, tools, context)
↓
Sandbox with the network off, unless you named a host
↓
Events you store in your own logs
↓
A write to a customer system only after a human, or a cap
Rent the loop when the work product is a file
Hosted harnesses are a good buy when the job ends in an artifact you can read before it matters.
| Rent the harness | Own the wrapper | |
|---|---|---|
| The job ends in | A draft, a spreadsheet, a diff, a summary | A sent email, a CRM write, a refund, a customer record |
| Who runs the loop | The vendor | You, even if their model is inside it |
| Credentials | Outside the sandbox, short-lived, not the production master key | Your auth. Revocable in one step |
| If it loops all night | Their bill and your cap | Your bill, your queue, your on-call |
| The audit | Their event stream, copied into your store | Logs you can read without asking their model for permission |
| A good first use | "Clean this export and show me the exceptions" | Not the first use |
The failure mode we keep seeing is a team that rents the impressive demo and then points it at billing because the demo felt finished. A sandbox that can edit a CSV is not a colleague. The moment the agent's success is a change in a system of record, you are in the second column, and the production rules apply in full: a narrow job, tools with an allowlist, a human escalation path, and an owner who reads failed runs.
Google spent the same week making that last point into a product. On 16 September they opened Agent Anomaly Detection in private preview on the Gemini Enterprise Agent Platform. It reads reasoning traces, tool calls, and OpenTelemetry spans, and flags patterns mapped to the OWASP Top 10 for Agentic Applications — tool misuse, privilege abuse, cascading failures, rogue agents — plus the boring operational ones, like a run that will not stop spending tokens. It is a private preview for teams already on that platform with ADK 1.2 or later. You should not wait for it. You should notice what it is: the oversight layer, productized, six weeks after a lab agent walked out of a sandbox. The platforms are selling the cage and the camera. They are not selling your judgment about which door to open.
The line item that is still yours
Token price keeps falling. Opus-class and GPT-class runs will get cheaper again before this post is old. That does not retire the routing problem. A harness that retries a frontier model against a task a small model could classify is a metered leak with a nicer API. Before you turn a session loose, decide:
- Which model does the first pass, and which model is allowed to escalate?
- What is the cap in dollars per day, and who gets the alert?
- Which tools exist, and which of them can change state without a person?
- Where do the session events live after the vendor's retention window?
What to ask anyone selling you an agent next quarter
The Agents API will not be the last harness on offer. Anthropic, Google, and the cloud marketplaces are all productizing the same middle. The questions do not change when the logo does:
- What can it do without a human click? If they cannot list it, they have not designed it.
- Where does the run execute, and can the network be denied by default?
- Where is the API key, and how fast can it be revoked?
- Do you receive the event stream, in your storage, or only a dashboard you lose when the contract ends?
- What is the weekly cost cap, and which model is not allowed to run?
- What is the job, in one sentence? When X happens, the system does Y, and a person steps in when Z. The scoping test survived the API launch. It will survive the next one.
Rent the loop. Keep the allowlist, the logs, and the off switch in the company that has to explain the outcome.
A rented harness is a gift if your bottleneck was orchestration. It is a liability if your bottleneck was never knowing what the agent was for. Bring the job, not the logo.
