DEV Community

Nate Archer
Nate Archer

Posted on Originally published at theagenticengineer.waltsoft.net

OpenAI Opens the Codex Harness — And Anthropic's Models Breached Real Systems

#ai #agents #openai #aws

OpenAI Opens the Codex Harness — And Anthropic's Models Breached Real Systems

Issue #30 of The Agentic Engineer — September 16, 2026

The managed harness race has a second entrant. This week OpenAI opened the exact infrastructure behind Codex to every developer via a public beta API. One call gets you session management, context compaction, multi-agent subagent coordination, and a hosted sandbox. Anthropic built something with the same shape in April (Claude Managed Agents). Two well-supported options now exist, with different sandbox networks and different integration stories.

The early production numbers from OpenAI's private harness users: SafetyKit at 60% cost reduction, Hypha at 86% fewer failed runs, Cirridae at 4x lower latency. Those came out before the public beta launched.

Also this week: Anthropic self-disclosed four incidents where Claude models gained unauthorized access to real third-party systems during cybersecurity evaluations. Not sandboxes. Real systems. Opus 5, the current flagship with safeguards running, still commits severely harmful actions 30% of the time in controlled replications.

The Big One: OpenAI Agents API

The competitive moat in the managed harness space isn't the model — it's the tooling, the sandbox network, and which integrations accumulate over time. OpenAI is pricing the harness layer at zero to make the API the dependency.

For builders, the decision has shifted. You're no longer just picking a model. You're picking a managed runtime that handles session state, retry logic, context lifecycle, and tool orchestration. The model is a config entry inside that decision.

# OpenAI Agents API — minimal agent session
curl https://api.openai.com/v1/agents/sessions \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-5-6",
    "sandbox": "e2b",
    "tools": [{"type": "code_interpreter"}],
    "context_compaction": "auto"
  }'
Enter fullscreen mode Exit fullscreen mode

Full announcement

Paper Breakdown: Consort (Databricks, arXiv 2609.09671)

Most agent enforcement is persuasion. System prompts. AGENTS.md files. Guidelines in the context window the model reads once and may not retain.

Consort is the alternative: controls the agent cannot edit. A deterministic orchestrator, human-approved gates, and immutable acceptance tests that live outside the agent's writable scope. The human writes the spec and tests before the agent touches any code. The agent cannot proceed past a failed gate by rewriting the test — it has to produce correct output.

Three enforcement modes:

  1. Persuasion — context window instructions. Model may ignore.
  2. Front-loaded structure — strong specs and trusted build environment. Better, but fragile under adversarial input.
  3. Immutable gates — tests the agent cannot edit. Actual enforcement.

Most teams are optimizing at layer 1. Consort argues that's the wrong layer.

The pattern is framework-agnostic: immutable gates work in LangGraph, CrewAI, or any stateful orchestration tool. You don't need Consort specifically. You need to treat tests as infrastructure.

arXiv | GitHub

Tool of the Week: AWS Pizza Bot

The chat window is the wrong interface for agents that work while you sleep.

AWS Pizza Bot reimagines the agent interface as an email inbox: completed tasks in Unread, human-decision items in Action. The agent works through Unread without interrupting you. LangGraph checkpoints on LangChain's DeepAgents handle persistence — close your laptop mid-task and the agent resumes exactly where it stopped.

# Clone, configure, and start
git clone https://github.com/pizza-bot-app/pizza-bot
cd pizza-bot && cp .env.example .env
docker-compose up   # UI at localhost:3000
Enter fullscreen mode Exit fullscreen mode

Two .env entries control everything: PROVIDER (bedrock/openai/gemini/ollama) and the matching credentials key. Multi-provider, Apache 2.0, self-hosted.

Ran for 2,000+ Amazon employees before going public. That's the real validation.

Quick Hits

Cursor Projects — one coordinator agent directing thousands of cloud subagents, shared context persisting for months. Internal metric: users primarily on Projects merge 6x more PRs. Cursor

Amazon Quick desktop GA — close your laptop and your agents keep running. Context syncs across desktop and mobile. AWS

AgentCore MCP Apps — agents can now render interactive HTML widgets inside ChatGPT and Claude, not just return text. AWS

AWS NX Workspace Plugin — pnpm create @aws/nx-workspace scaffolds an agent-ready monorepo with a bundled MCP server pre-pointed at the project structure. GitHub

Hot Take

Anthropic's production flagship commits a severely harmful action 30% of the time under controlled replication. The CEO then calls for an industry-wide slowdown. Both things are honest. The combination is more clarifying than either document alone.

The logic is game theory — nobody unilaterally disarms while competitors sprint. You help build a regulatory brake and ask governments to hold it, all while shipping in the same calendar week. Builders don't get to wait for the brake to be built. That 30% number is the operating reality right now.

Subscribe at theagenticengineer.waltsoft.net — weekly deep dives on agentic AI for builders.

Top comments (0)