OpenAI opened its Agents API to the public on September 10, and what it’s actually shipping is more interesting than the announcement makes it sound. This isn’t a new model. It’s the internal plumbing OpenAI built to run Codex, the session handling, orchestration, context compaction, and recovery logic that keeps a long-running coding agent from falling over, now available for anyone to build on.
What Developers Actually Get
The pitch is that most of the hard part of building an agent isn’t picking a model, it’s everything around the model: managing a session that might run for minutes or hours, keeping context from overflowing as the agent works, and recovering gracefully when something breaks partway through a task. OpenAI is now handling that layer directly through the API, which means developers building on it mainly need to supply tools and choose an execution environment rather than reinvent agent infrastructure from scratch.
Built-in sandboxed code execution and file handling ship as part of the managed harness, which puts OpenAI in more direct competition with the growing pile of third-party agent frameworks that have emerged over the past year to solve exactly this problem.
The Timing Is Not Great
The launch lands in an awkward week for agent security. Researchers at GreyNoise reported that a Russian-speaking threat actor built and ran hundreds of AI agents on OpenAI’s Codex and a DeepSeek model to exploit a pair of vulnerabilities in PaperCut print-management software, compromising at least 440 servers across 395 organizations in 48 countries. Separately, a stealth security startup called Accomplish disclosed sandbox vulnerabilities it found across Claude Code, OpenAI Codex, and Cursor, after privately flagging them to the respective vendors over the summer.
Neither disclosure is about the new Agents API specifically, but they land in the same news cycle for a reason: the infrastructure that makes agents useful for legitimate developers is the same infrastructure that makes them useful for attackers automating exploitation at scale. Managed sandboxing helps on the defensive side, but it doesn’t make the underlying tension go away.
What This Means
Opening the Codex harness as a general-purpose API is a bet that agent infrastructure is becoming a commodity layer worth owning outright, the same way cloud compute became a commodity layer a decade ago. Whether that bet pays off probably depends less on how good the orchestration is and more on whether OpenAI can keep the sandboxing tight enough that this week’s headlines about compromised print servers don’t become a recurring theme.
