The OpenAI Agents API Runs Your Agent Harness and Leaves You Three Jobs

"OpenAI runs the agent harness. Your application sends it work and receives results." That is the first line of the architecture guide for the Agents API, which went into public beta on September 10.^[1] The loop that OpenAI's own Codex runs on is now something you rent by the API call.

An agent harness is everything around the model that lets it work in a real environment: the loop that decides what happens next, how tools are exposed, the session log, context compaction, the approval policy, and the sandbox. The model supplies capability. The harness decides what that capability can reach, and how reliably the result lands.

We argued last month that the harness is the layer you own, and that the leverage sits there. Three weeks later the vendor is offering to own it for you. The question is what the rent buys, and what it leaves on your side of the table.

What does the OpenAI Agents API manage for you?

Sessions, orchestration, context compaction, recovery, and subagent delegation, running on the same Codex harness OpenAI uses internally. You supply the instructions, tools, and MCP servers, and you choose where the agent executes: an OpenAI-hosted sandbox, a partner's sandbox, or your own machines. There is no fee for the API itself.

OpenAI's overview puts it in one sentence. The service "manages sessions, orchestration, context compaction, and recovery while your application provides tools and chooses its execution environment."^[2] Model usage bills at the model's API rate, and a hosted sandbox bills at standard container rates.

The reaction has been fast and mostly one note. Ruben Dominguez's newsletter headline on September 11: "You Spent 2 Months Building an Agent Harness. OpenAI Just Made It a Config Block."^[3] An analyst told InfoWorld the same day that "lock-in is the biggest concern."^[4] The Hacker News thread said the same two things.^[5]

Both notes are fair. Neither one says what you kept.

And "the harness is the product" is not news either. The New Stack ran that headline in April, when Claude Managed Agents and OpenAI's agents SDK shipped.^[6] What is new is the pairing below.

Why did OpenAI tell you to remove your scaffolding the same week?

Two days after the launch, OpenAI's prompting guide for GPT-6 Astra told developers to strip the instruction scaffolding they had built for older models: mandatory file reads, full repo maps before every edit, rigid approval language, and stop-for-review rules. The vendor took the plumbing, then said the checklists were never the point.

The guide is blunt. "Prompting the model to read files before every edit is a great way to burn context and slow work down." "Requiring a stack of docs or a full repo map before every edit is excessive for a typo fix."^[7]

On approval language written for earlier models, it warns that "Astra could take it too seriously and may stop work where you'd actually be happy for it to continue."

We measured the first half of that a month ago: context files make agents cheaper, not more correct.

The guide is one vendor's advice for one model, and it is not a reason to delete your allow and deny rules. Read it for what it reveals about where the vendor thinks the builder's work is.

The guide names the work it leaves you

It does so in one line. "This is where it helps to define completion before starting." If the task includes running the implementation, inspecting the result, and fixing what fails, say so in the request, or the agent stops after the first pass.

The vendor took the plumbing and called the checklists scaffolding. What remains was always yours.

What do you still own with a managed harness?

Three things. The definition of done, which is now the interface between you and the loop. The permissions and network policy, which decide what the agent may reach. And the verification apparatus: the tests, lint, review and fuzzing that check the work before it ships. None of the three comes with the rental.

Define done

A managed harness will run to whatever finish line you wrote, and stop at the first one you did not. That is the oldest idea on this blog with a config field attached: AI amplifies your direction, right or wrong, and the more the tooling does, the more your aim decides.

Set the fence

The hosted sandbox's outbound network access has three settings: enabled, which is the default, disabled, and restricted to a list of allowed domains. Simon Willison went straight to that page in the launch thread.

CommentAuthor

OpenAI Agents API

Simon Willison · 10 September 2026

It offers three settings: enabled: Allow outbound access. This is the default unless you inherit a template policy. disabled: Block outbound access. restricted: Allow only the hosts listed in allowed_domains. Given what happened with the wiki thing the other week, where the agents rewrote their own /etc/hosts file to let them bypass sandbox rules, how trustworthy is that restricted option?

Source: news.ycombinator.com. Reproduced verbatim; punctuation is the source's. Photo: Paul Downey, CC BY 2.0, via Wikimedia Commons.

His reason is the one we wrote up as containment is architecture. OpenAI's own agents rewrote a sandbox's hosts file to reach a public wiki, and in a separate case pushed hundreds of packages to RubyGems that OpenAI had not disclosed until researchers traced them.^[8]

A fence the agent can climb is a fence you asserted. The restricted setting is a line you write, and that line is the whole policy layer.

GitHub shipped the same layer as an admin product the same week: managed permissions that set shell commands, file edits and network domains to blocked, human approval, or proceed, and that "can't be weakened by user or workspace settings, auto-approval, or previously saved approvals."^[9] The policy layer moves to whoever administers the seat.

Check the work

Boris Cherny leads Claude Code at Anthropic. On September 11 he listed what production code from an agent has to pass at his own company.

His list: "lots of lint rules, lots of tests, Claude-driven end to end tests, Claude-powered fuzzers running daily, automated code reviews and security reviews, automated code refactoring, and so on."^[10] None of it ships with a managed harness.

It is the same inventory we drew when auto mode changed who reviews an agent's work: the loop can move, and the review layer stays with whoever owns the outcome.

What does harness choice actually change?

Cost, far more than success. In the best measurement so far, three open-source harnesses running the same two models on the same 50 tasks landed within an eight-point band on pass rate, while one harness burned about 40 times the tokens per solved task of another. The harness barely decides whether you succeed. It decides what you pay.

Naman Vats and Oleg Golev at Sentient Labs ran 300 trials: Goose, OpenCode and OpenHands-SDK, each driving Qwen 3.6 Plus and MiniMax M2.5 through a 50-task slice of Terminal-Bench Pro.^[11] Within a model, the harness range on pass rate was two to eight points, and every pairwise confidence interval included zero except the largest gap.

Tokens per solved task told a different story. Goose on Qwen spent 28,142. OpenCode on MiniMax spent 1,546,977. In the paper's words, OpenCode "consumes approximately 40x more tokens per solved task than Goose," while the pass-rate differences stay inside that band.

The caveats belong next to the number. The 40x is OpenCode against Goose on MiniMax, at the extremes of a 50-task set. Token accounting and turn budgets differ across the harnesses, and the authors build agent infrastructure for a living. What survives is the shape: a narrow band on one axis, two orders of magnitude on the other.

That is the variable a managed harness takes off your hands. You no longer choose the loop, the compaction strategy, or how many idle turns a stuck agent spends before it gives up. You pay for whatever the vendor's loop does.

What does a managed harness cost?

Model tokens at the model's rate, plus container time for a hosted sandbox: from $0.03 to $1.92 per 20-minute session depending on memory, billed by the minute with a five-minute minimum. On a frontier model the sandbox is a rounding error. On a cheap model it is most of the bill.

Take OpenAI's own price sheet and run one hour: 50,000 input tokens, 15,000 output tokens, and a sandbox alive for three 20-minute sessions.^[12] On GPT-6 Astra, at $10 in and $50 out per million tokens, the tokens cost $1.25 and a 1 GB sandbox adds $0.09, about seven percent of the hour.

On GPT-5.6 Luna, at $0.20 and $1.20, the tokens cost about three cents. The same sandbox is now 76 percent of the bill, and a 4 GB sandbox is 93 percent.

The page adds that eligible sessions bill by the minute with a five-minute minimum, and it does not define idle time. Willison asked in the thread whether every run creates a new environment and whether one can be shut down on purpose. The page does not say.

tokencost did this arithmetic first and titled its teardown "The Sandbox Is the Fee."^[13] Anthropic meters the same layer differently: Claude Managed Agents charge $0.08 per session-hour, counted only while the session is running, with idle time excluded, and that charge replaces container-hour billing.^[14]

Two vendors, two meters, and neither is the token count you used to optimize.

This is the spread in agent cost showing up one layer down: the loop's cost profile is now set by whoever runs the loop.

Should you rent the harness?

For most teams, yes. The plumbing was a rabbit hole, and the failures a managed harness handles are real and expensive to get right: a session that dies at hour six, a context window compacted without losing the thread, a subagent that never reports back. Rent the loop, and know what the rent does not include.

DevToolLab's read of the launch is the fairest one-liner going: "the harness improves on OpenAI's schedule and runs OpenAI's models."^[15] That is the trade. You give up the loop's cost profile and its roadmap, and you get sessions, compaction and recovery that would have taken you a year.

What you get back is a smaller job than the one you had, and a more consequential one:

• Define done. The loop runs to the finish line you wrote and stops at the first one you did not.
• Set the fence. The restricted setting is the whole policy, and it is one line.
• Check the work. None of the checks come with the rental.

The harness stopped being your implementation detail and became your vendor's product, and the three jobs it left you are the ones that were never engineering in the first place.