OpenAI gives AI agents a safe sandbox to run code

Giving an AI model access to the real world usually comes with a lingering fear: what happens when it goes off the rails and deletes half your hard drive?

OpenAI just rolled out a major overhaul to its Agents SDK. Instead of showing off another benchmark jump, the update tackles the messy engineering reality of building software that inspects files, runs shell commands, and actually stays on track across long-horizon tasks.

At the center of the release are two pieces: a model-native harness designed around frontier model behavior, and native sandbox execution to keep that work contained.

A standardized harness for messy work

Building an agent prototype takes an afternoon, but taking it to production usually involves painful tradeoffs. Framework-agnostic setups often miss the quirks that make frontier models shine, while fully managed agent platforms lock down your data and deployment options.

OpenAI is trying to hit the sweet spot in between. The updated harness pulls together several primitives that have become de facto industry standards over the past year. It natively supports the Model Context Protocol (MCP) for tool use, AGENTS.md for custom instructions, progressive disclosure through skills, Codex-like filesystem navigation, and dedicated tools for shell execution and patch application.

Karan Sharma from OpenAI's product team told TechCrunch that the launch is fundamentally about making the SDK compatible with existing infrastructure, letting developers build long-running agents with whatever compute they already have.

Disposable sandboxes with persistent memory

Giving an agent execution power requires treating prompt injections and exfiltration attempts as a guarantee rather than a possibility.

To address this, the SDK completely decouples the control harness from the compute layer. Model-generated code runs in isolated sandboxes where sensitive credentials never enter. A new Manifest abstraction lets developers define workspaces uniformly, mounting local directories or streaming data from AWS S3, Google Cloud Storage, Azure Blob Storage, or Cloudflare R2.

Crucially, the setup is built for durable execution. If a sandbox times out or crashes during an hour-long workflow, the harness uses built-in snapshotting and rehydration to spin up a fresh container and pick up right from the last checkpoint.

Developers can bring their own custom setups or hook straight into supported providers like E2B, Modal, Vercel, Cloudflare, Daytona, Blaxel, and Runloop. The update is generally available now via the Python API at standard token and tool-call pricing, with TypeScript support and subagent routing planned for upcoming releases.

Why it matters

We see this update as OpenAI planting its flag in the runtime layer of autonomous software.

For developers and teams building technical assistants, this dramatically lowers the barrier to entry. Building a bulletproof execution environment with state persistence previously took weeks of tricky infrastructure plumbing. Being able to wire up an E2B or Modal sandbox in an afternoon makes testing complex, long-running agent workflows practical right now.

Strategically, OpenAI played this smartly by avoiding a walled-garden trap. Embracing Anthropic-backed MCP and partnering with outside sandbox startups shows pragmatism: it lets ecosystem players win while positioning OpenAI's harness as the default operating system on top.

That said, there is an obvious vendor-lock risk. The more your workflows rely on a harness fine-tuned specifically to how OpenAI models reason and parse files, the harder it becomes to switch to competing frontier models down the road. If neutrality is a requirement for your stack, tread carefully.