OpenAI re-hosted the agent layer it spent a year un-hosting — and priced the harness at zero, which is the part that spends your money
TL;DR: On 10 September 2026 OpenAI opened the Agents API in public beta to all developers, exposing the managed Codex harness — durable sessions, orchestration, context compaction, recovery, subagents. Headline: no additional fee; you pay tokens and tools. That is accurate, and it is the thing to look at twice. The unpriced harness is the component that decides when to compact, when to retry, and when to spawn subagents (max_concurrent_subagents: 4 in OpenAI’s own example) — every one of those a token event, billed by the vendor that wrote the policy. Underneath, OpenAI-hosted containers bill wall-clock: $0.03 / $0.12 / $0.48 / $1.92 per 20-minute session at 1/4/16/64 GB, i.e. $0.09–$5.76 per hour, five-minute minimum, and a non-configurable one-hour idle deletion. So the “agents that run for days” pitch and the meter run in opposite directions: a saturated agent’s sandbox is ~3% of its bill, while an idle one is 100% of it — $8.64/day at 4 GB, $138.24/day at 64 GB. And in beta it is US-only with zero data retention unsupported, whichever sandbox you pick. For buyers: two weeks ago OpenAI was un-hosting its convenience layer. It just re-hosted it — on a shorter leash.
The reversal nobody named
On 26 August we wrote that OpenAI was un-hosting its convenience layer. The Assistants API died that day. Agent Builder, the centrepiece of AgentKit at DevDay 2025, dies on 30 November. ChatKit’s hosted backend goes away; the surviving path runs on your infrastructure. Reusable Prompts become “move it into your application code.” One direction, four shutdowns: state and hosting migrating from OpenAI’s servers onto yours.
Sixteen days later, OpenAI shipped the opposite. The Agents API hosts sessions, orchestration, context management and recovery — the exact responsibilities the previous year of deprecations handed back to developers.
This is not hypocrisy, and it is not a stability problem. It is a repricing. The layer came back because OpenAI found a version of it worth hosting: not a stored-configuration abstraction, but the harness — the loop that actually runs Codex. The question for a buyer is what it costs, and the answer is more interesting than the launch post suggests.
What is priced, and what conspicuously is not
| Component | Who runs it | What it costs |
|---|---|---|
| Agents API / Codex harness | OpenAI | $0 — no fee of its own |
| Model tokens (GPT-6 Astra) | OpenAI | $10 / $50 per M; $20 / $75 above 272K |
| Cache writes | OpenAI | $12.50 / M; $25.00 / M above 272K |
| Web search tool | OpenAI | $10 / 1k calls + content tokens at model rates |
| OpenAI-hosted sandbox | OpenAI | $0.03 / $0.12 / $0.48 / $1.92 per 20-min session (1/4/16/64 GB) |
| Partner or BYO sandbox | Cloudflare, Modal, E2B, Vercel, Daytona, DigitalOcean, Oracle, Blaxel, Runloop, or you | Their rates |
Read the first row against the rest. The component with no price is the component that issues the instructions to every other row.
The managed harness, per OpenAI’s own documentation, handles “summarizing previous work to manage its context window,” breaking work into subtasks, resuming sessions, and recovery. Restate those in billing terms:
- Compaction is an inference call. It reads the accumulated context as input tokens and writes a summary as output tokens. You pay for both, and how aggressively it fires determines how often you are paying to re-read versus paying to re-summarize.
- Recovery re-sends a prefix. Whether that prefix hits cache at $1/M or gets rebuilt as a cache write at $12.50/M is a harness decision — and as we noted when OpenAI shipped the
configuration_updateitem, a rebuilt prefix costs 12.5x a preserved one. - Subagents each carry their own context stream. OpenAI’s documented example sets
max_concurrent_subagents: 4. That is a 4x fan-out on token consumption at the harness’s discretion, not yours.
And sitting under all three: the 272K threshold, where crossing re-bills the entire request at $20/$75 instead of $10/$50. Compaction policy is precisely the mechanism that determines which side of that cliff a long session lands on. The free layer controls the 50% swing.
None of this makes the Agents API a bad deal. A good harness spends fewer tokens than a bad one, and most teams’ first attempt at compaction is worse than OpenAI’s. The point is narrower and it belongs in a procurement memo: the spend controller is now operated by the counterparty, and it is not exposed as a dial. The Codex harness being open source means you can read the policy. It does not mean you can change the one OpenAI runs.
The meter and the pitch disagree
The launch framing is agents that run reliably “for days.” The container pricing is wall-clock. Those two facts produce a result worth checking before you design anything.
Convert the published session rates to hours:
| Memory | Per 20-min session | Per hour | Per 24h held | Per 30-day month held |
|---|---|---|---|---|
| 1 GB | $0.03 | $0.09 | $2.16 | ~$65 |
| 4 GB | $0.12 | $0.36 | $8.64 | ~$259 |
| 16 GB | $0.48 | $1.44 | $34.56 | ~$1,037 |
| 64 GB | $1.92 | $5.76 | $138.24 | ~$4,147 |
Billing is by the minute with a five-minute minimum per session, so short bursty sessions round up — at 4 GB the floor is $0.03 no matter how fast the turn.
Now set that against tokens. The only production swarm with published unit counts is OpenAI’s own Navier-Stokes run, which we worked out to roughly $11 per agent-hour in output tokens for a continuously saturated frontier agent. Against $11/hour of thinking, a 4 GB sandbox at $0.36/hour is about 3%. Ignore it. Optimizing container size for a busy agent is a waste of your afternoon.
Then consider the workload the product is actually sold for: an agent that waits. Waits on a human approval, a nightly export, a slow partner API. Token spend during the wait is zero. Container spend is unchanged. The ratio does not shift — it inverts. The sandbox becomes the entire bill.
And you cannot simply let it idle, because the documentation states that if activity and keep-alives stop for an hour the sandbox can be deleted, and the timeout is not configurable. Keep-alives keep the meter running. Silence loses the machine.
The escape hatch is real but it has to be designed in: files under /workspace/outputs are published as immutable artifacts when a turn completes and remain downloadable after the sandbox expires. Everything else in /workspace dies with the container. So the rule for any agent with gaps longer than an hour is straightforward — promote state to artifacts, treat the sandbox as disposable, and never pay keep-alives to preserve something you could have written to outputs.
The gate most coverage skipped
During public beta, data residency is United States only, and zero data retention is not supported.
The detail that matters: this holds regardless of where your sandbox runs. You can execute agent compute inside your own VPC, or on Cloudflare, Modal, E2B, Vercel, Daytona, DigitalOcean, Oracle Cloud, Blaxel or Runloop. Sessions, context and compaction are still managed by OpenAI, in the US. Moving the sandbox moves the execution, not the orchestration — and the orchestration is the part holding your accumulated context.
This is the exact pattern we described when Coder shipped self-hosted agent execution and the inference still left the building. Self-hosting the runtime is not self-hosting the data path, and vendors are consistently imprecise about the difference.
For an EU buyer the timing is unkind. GPT-6 Astra launched on 3 September without EU data residency. A week later the managed agent layer for it arrives with the same constraint plus no ZDR. If you are in a regulated industry or under a ZDR contract, the Agents API is not available to you this quarter, whatever the launch post’s “available to all developers” implies.
What this does to the security picture
Two things improve, one does not.
Better: a managed sandbox with a hard one-hour lifetime and artifact-only persistence is a narrower blast radius than most hand-rolled agent runtimes. Short-lived, disposable execution environments are the correct default, and OpenAI has made the correct default the only option. After the GPT-5.6 Sol sandbox escape that reached Hugging Face credentials, a container that deletes itself is not nothing.
Also better: subagents with a documented concurrency cap are easier to reason about than an unbounded fan-out.
Not better: the agent still reaches the network through tools, MCP servers over HTTP, and web search. Meta’s own Rule of Two framing applies unchanged here — untrusted input, private data, and external communication, pick two. An Agents API deployment that reads customer tickets, holds account data in session, and calls an MCP server has all three, and the managed harness does not arbitrate that for you. Egress policy is still your job, and it is still the job most teams skip.
What to do with this
- Split your agents by duty cycle before you price them. Saturated agents: ignore container cost, watch the 272K cliff. Waiting agents: container cost is the bill — use 1 GB where you can, and prefer artifacts over keep-alives.
- Instrument compaction, because you cannot configure it. Log token counts per turn and watch for the summarize-then-re-expand cycle. If your input tokens are growing faster than your work is, the harness is spending and you need to see it.
- Cap subagents deliberately.
max_concurrent_subagentsis a cost multiplier with a benign name. Set it from your budget, not from the example. - Keep prompts, tools and skills in your own repository. This is the third managed-agent abstraction OpenAI has offered in three years, and Agent Builder’s 30 November shutdown is already on the calendar. Portability is the hedge.
- Do not plan EU or ZDR workloads on this yet, and do not accept “run the sandbox in your VPC” as the fix. It isn’t one.
- Sanity-check the vendor numbers. 4x latency, 60% cost per case, 86% fewer failures are single-customer results, not benchmarks — useful as evidence the harness is competent, useless as a forecast for your workload. Set them against the $600/day per researcher OpenAI spends internally and price your own pilot from measurement.
If you are choosing where to run fleets, our best AI agent tools rundown covers the orchestration layer and best AI harnesses covers the loop itself. The OpenAI Codex review tracks the harness this API exposes, and the ChatGPT review tracks OpenAI’s model tiers and what they cost. For the other half of OpenAI’s 10 September unbundling, see GPT-Live-1’s switch from token-metered to wall-clock voice billing.
Frequently asked questions
If the Agents API has no fee, what am I actually paying for?
Three meters, and only one of them is the one people quote. First, model tokens at the selected model's normal API rates — for GPT-6 Astra that is $10 input and $50 output per million below the 272K threshold, and $20/$75 above it, plus $12.50 or $25.00 per million for cache writes. Second, paid tools: the web search tool is $10 per 1,000 calls plus search content tokens billed at model rates, so a single agent making one search per step at 270 steps adds about $2.70 before the tokens it reads. Third, container time if you use OpenAI-hosted sandboxes, at $0.03, $0.12, $0.48 and $1.92 per 20-minute session for 1 GB, 4 GB, 16 GB and 64 GB respectively — $0.09 to $5.76 per hour, billed by the minute with a five-minute minimum. The Agents API layer itself is genuinely free. What it does is make spending decisions on all three meters.
Why does it matter that the harness is free rather than priced?
Because a free component with no line item still has a cost, and here the cost lands on a meter the same vendor owns. The managed harness decides when to summarize earlier context to stay inside the window, when to retry a failed step, and when to fan work out to subagents — the documented configuration exposes max_concurrent_subagents, with 4 shown in OpenAI's own example. Each of those is a token event. A compaction pass reads the accumulated context as input and writes a summary as output, both billed. A retry re-sends a prefix. Each subagent is a separate context stream. None of this is sinister; a harness has to make these calls and OpenAI's is better at them than most teams' first attempt. But the governance question is real: you have outsourced your spend controller to the firm that sells the units it spends, and during beta you cannot price the alternative because there is no version of the harness with the policy exposed as a knob. The Codex harness is open source and inspectable, which helps you audit after the fact. It does not put the dial in your hand.
How do the sandbox economics compare to the token bill?
It depends entirely on whether your agent is thinking or waiting, and the two cases invert. Take the only published production swarm figures we have: OpenAI's Navier-Stokes run worked out to roughly $11 per agent-hour in output tokens for a saturated frontier agent. Against that, a 4 GB sandbox at $0.36 per hour is about 3% of the bill — a rounding error, and you should not optimize it. Now take an agent holding state overnight between human approvals. Tokens go to zero. The container does not: 4 GB held for 24 hours is $8.64, and 64 GB is $138.24 per day, per agent. Over a 30-day month a single idle 4 GB sandbox is about $259 and a 64 GB one is about $4,147. The meter that is irrelevant for busy agents is the entire bill for patient ones, and 'patient' is exactly the workload the Agents API is marketed for.
What does the one-hour idle deletion actually break?
It forces you to choose between paying and losing work. The documentation is explicit that if activity and keep-alives stop for an hour the sandbox can be deleted, and that the timeout is not configurable. So a genuinely long-running agent — one waiting on a human approval, a nightly data drop, or a slow external job — has two options. Send keep-alives, which holds the container and keeps the clock running at wall-clock rates for time when nothing is being computed. Or let it die and rebuild the environment on resume, re-installing packages and re-fetching files. There is a partial escape: files written under /workspace/outputs are published as immutable artifacts when a turn completes and stay downloadable after the sandbox expires, so durable results survive even when the machine does not. Design for that deliberately. Anything your agent needs after a gap longer than an hour should be an artifact, not a file sitting in /workspace, and anything that takes more than a few minutes to reconstruct should not live only in container state.
Can I use this in the EU, or under a zero-data-retention agreement?
Not during the public beta. Data residency is United States only and zero data retention is unsupported, and — this is the part that catches people — that holds regardless of which sandbox you pick. Running your agent's compute on your own VPC, or with Cloudflare, Modal, E2B, Vercel, Daytona, DigitalOcean, Oracle Cloud, Blaxel or Runloop, moves the execution but not the orchestration: sessions, context and compaction are managed by OpenAI in the US. This is the same shape we flagged when Coder shipped self-hosted agent execution and the inference still left the building. For a regulated EU buyer this is a hard blocker rather than a procurement footnote, and it arrives one week after GPT-6 Astra launched without EU data residency at all. OpenAI has not published a timeline for lifting either limit. Until it does, treat the Agents API as a US-workloads product and keep a non-managed path — your own harness on the Responses API — warm for everything else.
Should I migrate off my own orchestration onto this?
Evaluate it, but do not retire anything yet, and price the layer with a short half-life. OpenAI's Assistants API shut down on 26 August after twelve months' notice, and Agent Builder — the centrepiece of AgentKit at DevDay 2025 — shuts down on 30 November after under fourteen months. The Agents API is the third managed-agent abstraction OpenAI has offered in three years and the second to arrive after the previous one's obituary was already on the calendar. The reported customer results are real enough to take seriously: 4x lower latency in one deployment, 60% lower cost per case and 86% fewer failed agent responses in another. Those are vendor-supplied single-customer figures rather than benchmarks, but they point at a harness that is genuinely good at the boring parts — recovery, compaction, session state — which is where most in-house agent code is worst. The sound move is to adopt it where the work is US-resident and short-lived, keep your tool definitions and prompts in your own repository so they are portable, use MCP over HTTP rather than proprietary tool plumbing where you can, and assume you will be asked to move again inside two years.
Sources
- OpenAI — Introducing the Agents API (10 September 2026)
- OpenAI API — Changelog, 10 September 2026: Agents API public beta
- OpenAI API — Agents API overview (sessions, compaction, subagents, residency)
- OpenAI API — OpenAI-hosted sandboxes (idle deletion, /workspace artifacts)
- OpenAI API — Pricing (container rates, Astra token rates, web search tool)
- OpenAI Developer Community — Introducing the Agents API and hosted sandboxes
- MarkTechPost — OpenAI launches the Agents API in public beta, putting the Codex harness behind one API call (10 September 2026)
Related tool reviews
Questions or corrections? Email Pick Right. Want the full list? See all news.