AI 開發平台
OpenAI Agents API Turns the Codex Execution Framework Into a Managed Service, While Sandboxes Can Still Be Deployed in Your Own Environment
The public beta provides managed sessions, context compaction, tool orchestration, and sub-agent delegation, eliminating the need for developers to maintain agent loops themselves. Execution can take place in an OpenAI sandbox, on your own infrastructure, or through a partner provider, but versions, permissions, and usage costs must still be controlled separately.
On September 10, OpenAI packaged the agent execution framework that powers Codex as the public beta of the Agents API. Callers need only specify the task, model, tools, and environment; the service then handles persistent sessions that continue across turns, progress streaming, failure recovery, and automatic compaction as the context limit approaches. The difference from the standard Responses API is not merely the addition of an agent object: it turns the control loop for long-running work into a stateful service continuously operated by the provider.
The tool layer supports MCP, custom functions, and web search. Tool search can load definitions on demand, avoiding the need to repeatedly include the full tool list in the prompt. Programmatic tool calling can execute calls in parallel within code, filter the results, and send only the necessary content back to the model. Multi-agent mode creates a separate context for each subtask, while the primary agent handles delegation and aggregation. The API also provides boundaries such as a maximum number of concurrent sub-agents.
The compute and control planes are intentionally separated: OpenAI can host the harness, while code can run in its managed sandbox, in a self-hosted environment, or in partner sandboxes from Cloudflare, E2B, Modal, Vercel, and others. Managed sandboxes can install packages, load files and skills, and preserve workspace state. The open-source Codex repository allows teams to inspect the core orchestration logic.
Engineering teams should still not equate “managed” with “maintenance-free.” Interfaces and defaults may change during the public beta, while models, tools, and container resources are each billed separately. External MCP servers, network egress, secret injection, and file permissions also form real security boundaries. Before adoption, teams should validate the system using pinned versions, replayable traces, tool allowlists, and spending limits, and confirm that session data retention and deployment regions meet their requirements.