You pick E2B for the sandbox. Or Modal. Or your own VPC. You feel clever about data gravity. Then you create an Agents API session and watch OpenAI own the part that actually keeps the agent alive: session state, context compaction, subagent orchestration, and recovery across long turns.
That is the September 10, 2026 story. OpenAI shipped the Codex harness as a managed Agents API in public beta. The operator decision is no longer which model answers the loop. It is whose control plane owns the loop. And because the docs are blunt about United States-only data residency and no Zero Data Retention, picking that harness is also picking OpenAI’s data posture, even when the sandbox is yours.
What actually changed
OpenAI’s launch post frames the Agents API as the same harness and infrastructure that powers Codex, exposed through a simple API. You create a session with a model, tools, and an environment. You can enable multi_agent with a max_concurrent_subagents budget. OpenAI hosts and maintains the harness. You choose compute: an OpenAI-hosted sandbox, your own infrastructure, or a partner sandbox. Named partners at launch include Blaxel, Cloudflare, Daytona, DigitalOcean, E2B, Modal, Oracle, Runloop, and Vercel.
The managed layer is not a thin router. OpenAI says the harness handles long-running sessions, automatic context compaction as a session approaches its limit, tool search that loads relevant tool definitions as needed, programmatic tool calling so agents can run and filter tool work in code, MCP and custom functions, and subagents that keep their own context while a main agent coordinates. The open-source Codex harness remains inspectable. OpenAI operates it.
Pricing is the soft sell. There is no additional fee for the Agents API itself. You pay for tokens and tools. Hosted sandboxes bill at container rates. That removes an orchestration line item while still accumulating model, tool, and compute spend for anything that runs for hours.
Vendor-supplied customer quotes on the launch page (label them that way) include Ciridae claiming evaluation scores from 0.71 to 0.85 plus a 4x latency reduction on subagent flows, SafetyKit claiming 60% lower cost per case, and Hypha claiming 86% fewer failed responses after separating harness from sandbox. Treat those as adoption signal, not your ROI model.
Independent coverage landed the same day. RuntimeWire’s Ryan Merket (Sep 10) called out the strategic move: OpenAI is competing for orchestration and compute spending that agent startups currently capture, while still letting you choose where code runs. Superpower Daily (Sep 10) stressed the data caveats as the enterprise filter. GIGAZINE (Sep 11) echoed the Codex-same-harness framing and the @OpenAIDevs pitch that OpenAI handles orchestration, long-running sessions, and context management.
Same day, OpenAI also launched GPT-Live-1 in the API at $0.05 per minute for the voice front end, with explicit delegation of reasoning and tools to a backend model and agent harness. That is an architecture rhyme, not the main thesis: the front end gets thinner while the harness behind it gets thicker.
The mechanism: sandbox choice is not control-plane choice
Strip the demo and you get a clean split.
The sandbox is where files live, packages install, and commands run. You can keep that on OpenAI, in a partner cage, or on your own metal. Network policy, CPU shape, and secret storage can stay close to your infra story. That is real. It is also incomplete.
The harness is where the session lives. Create, task, stream or webhook, continue or steer. Context gets compacted. Subagents get spawned. Recovery happens when a turn dies mid-flight. Your application sends input and receives events. OpenAI runs the agent loop.
OpenAI’s own API docs state the constraint without hedging: the Agents API currently supports data residency only in the United States and does not support Zero Data Retention. Choosing a self-hosted sandbox does not make the Agents API ZDR-eligible. Session state retained so you can continue work across turns is the feature. It is also the data surface.
That is the product boundary. Sandbox locality is not session locality. You can win the file-system argument and still lose the retention argument.
What operators get wrong
Mistake one: reading “bring your own sandbox” as “we kept the stack.” You kept compute. You handed OpenAI the durable session, the compaction policy, the subagent fan-out, and the recovery semantics. That is the hard part of agent ops. Congratulating yourself on VPC placement while ignoring who owns session state is cargo-cult sovereignty.
Mistake two: treating “no additional fee for Agents API” as free orchestration. Tokens, tools, and container rates still meter. Long sessions with compaction and concurrent subagents can burn more than a naive single-shot loop. Cost moves from your engineering payroll into your usage bill. Model that before you celebrate deleting your queue worker.
Mistake three: assuming self-hosted sandboxes inherit your enterprise data controls. The docs say otherwise for ZDR and residency. If your security review checklist stops at “where does code execute,” rewrite the checklist. Ask where session transcripts, tool results, and compacted summaries live, for how long, and in which region.
Mistake four: equating open-source Codex visibility with operational control. Seeing the harness code is useful. It does not mean you control the managed service’s compaction heuristics, retry policy, or incident response when OpenAI’s side of the loop misbehaves. Inspectability is not operability.
Mistake five: shopping models as if the loop were still yours. Once Agents API owns orchestration, swapping the model field is a config change. Swapping the control plane is a migration. Procurement language that only names model SKUs will miss the lock-in.
Mistake six: ignoring the voice rhyme. GPT-Live-1’s pitch is a natural front end that delegates reasoning and tools to a backend harness. If your product roadmap is “voice in front, agents in back,” you are already designing around whoever owns that back harness. Do not discover that in a compliance meeting.
Second-order effects
Agent startups that sold “we run the loop” just got a platform competitor with Codex credibility and a partner sandbox catalog. Some will integrate. Some will differentiate on vertical tools and evaluation. Pure orchestration wrappers get thinner overnight.
Platform teams inside enterprises will split into two tickets. Ticket A: sandbox and secrets. Ticket B: session residency, retention, and audit of compacted context. Security that only reviews Ticket A will rubber-stamp a US-only, non-ZDR control plane by accident.
Vendor lock-in changes shape again. Leaving means rebuilding session continuity, subagent orchestration, and compaction, not just pointing tools at another model endpoint. Export and delete story for sessions and artifacts belongs in the contract during public beta, while you still have leverage.
Pricing psychology will confuse boards. “No Agents API fee” sounds like a platform giveaway. Persistent agents still accumulate spend. Finance needs a unit cost per successful long session, including subagent fan-out, not a slide that says orchestration is free.
Competitive copy will sell “managed agents” for the next year. The durable question is whether you want OpenAI’s harness improvements for free with each model launch (their stated pitch) more than you want to own recovery and retention yourself. That is a strategy choice, not a demo choice.
Partner sandboxes do not dissolve the control-plane question either. Blaxel, Cloudflare, Daytona, DigitalOcean, E2B, Modal, Oracle, Runloop, and Vercel give you different cages. They do not give you a different session owner. If your RFPs celebrate multi-cloud sandboxes while the session API stays OpenAI-only, you diversified compute and concentrated state.
What to do this week
If you build agent products:
- Stand up one Agents API session in a disposable project. Exercise create, task, stream, continue/steer. Measure where state lives when you kill the client.
- Run the same task once on an OpenAI-hosted sandbox and once self-hosted or partner-hosted. Document what moved (files, packages) and what did not (session residency, ZDR eligibility).
- Write an explicit data-posture note: US residency only, no ZDR, self-hosted sandbox does not flip either. Get Legal and Security to initial it before production traffic.
- Cap max_concurrent_subagents in staging and watch token burn. Do not enable unbounded fan-out because a launch quote said 4x latency wins.
- Label every vendor-supplied win rate in your eval doc as vendor-supplied. Run your own harness-vs-Agents-API bakeoff on one production-shaped workflow.
If you buy or govern the stack:
- Update RFPs. Ask who owns session state, compaction, subagent orchestration, and recovery. Ask region and retention in writing. “We use a self-hosted sandbox” is not an acceptable answer to ZDR.
- Require a kill switch and session deletion path. Confirm published artifacts and session records can be purged on your timeline.
- Price the migration cost of leaving the managed harness, not just month-one token rates.
If you lead a platform org that already built an internal agent runtime:
- Decide in one page whether Agents API replaces your loop, sits beside it for greenfield work, or is blocked on data grounds. Ambiguity here will fork your codebase by Friday.
- If you stay on your own harness, document which Codex-open-source ideas you will track so you are not inventing compaction poorly while OpenAI ships it managed.
Sharp close
September 10 did not make sandboxes optional. It made the harness the product.
OpenAI packaged the Codex control plane as a public beta API, let you keep (or rent) the cage where code runs, and kept session lifecycle, compaction, subagents, and recovery on their side of the wire. The docs then told you the residency and retention rules that come with that choice.
Your sandbox choice does not buy you the control plane. If you adopt Agents API this week, adopt it with eyes open: you are buying the loop, not just the model, and you are buying OpenAI’s data posture with it.
