OpenAI is adding native sandbox execution and a model-oriented control harness to its Agents SDK. The update addresses a central enterprise problem: agents need access to files, tools and code to perform useful work, but granting that access directly can expose credentials, sensitive data and infrastructure.
The new architecture separates orchestration from the environment where generated code runs. Developers can define predictable workspaces, restrict inputs and outputs, preserve state outside disposable containers and choose among several sandbox providers.
The result is intended to make prototypes easier to move into governed production without every team building its own execution layer.
A standard harness reduces custom infrastructure
Agent teams often maintain vector synchronisation, memory, connectors, tool routing and failure recovery themselves. Those bespoke components can become brittle as models and applications change.
OpenAI’s model-native harness introduces configurable memory, sandbox-aware orchestration and filesystem tools. It supports MCP tool connections, instructions through AGENTS.md, patch-based file editing, skills and shell execution. These common primitives let developers focus on domain logic rather than repeatedly implementing the same agent scaffolding.
A Manifest abstraction describes the workspace. Teams can mount local files, specify output directories and connect storage from AWS S3, Azure Blob Storage, Google Cloud Storage or Cloudflare R2.
Explicit workspaces improve governance because an agent receives validated context rather than unrestricted access to a data lake. Provenance can follow inputs and outputs from local development into production.
Sandboxes isolate code from credentials
Any system reading external content or executing generated code should be assumed vulnerable to prompt injection and attempted data exfiltration. OpenAI separates the control harness from compute so primary credentials do not enter the sandbox where model-generated code runs.
If malicious instructions reach the execution environment, isolation limits access to the wider control plane and corporate network. Teams can bring custom sandboxes or use providers including Blaxel, Cloudflare, Daytona, E2B, Modal, Runloop and Vercel.
The SDK also externalises run state. If a container crashes or expires during a long task, snapshotting and rehydration can restore progress inside a fresh environment. A 20-step workflow does not necessarily need to restart after failing at step 19, reducing compute cost and duplicate actions.
Separated execution can scale across one or several sandboxes, isolate subagents and parallelise work. That flexibility needs firm resource and permission limits so speed does not expand the blast radius of a mistake.
Healthcare shows the value of bounded workflows
Oscar Health tested the infrastructure on complex clinical records. Its agent needed not only to extract metadata, but also to identify the boundaries of individual patient encounters inside long documents. Previous approaches were not reliable enough for production.
The updated SDK helped automate the workflow, allowing the healthcare provider to understand patient visits faster and support care coordination. The example illustrates why domain context and execution controls matter together: a technically correct extraction can still be wrong if it attaches information to the wrong encounter.
The capabilities are generally available through the API under standard token and tool-use pricing. Python support arrives first, with TypeScript planned later. OpenAI also intends to add code mode, subagents and more providers.
Native sandboxing is not a complete security guarantee. Teams must still minimise mounted data, validate outputs, scan generated code and monitor tool calls. Isolation should be tested against escape attempts and configured for the consequences of each task.
The update nevertheless gives enterprises a clearer architecture for agent governance. Useful autonomy requires a place to act; safe autonomy requires that place to be constrained, observable and recoverable.
By standardising the boundary between model reasoning and execution, OpenAI is turning sandboxing from a custom engineering project into a default building block. That may help more organisations deploy agents without giving experimental code direct access to the systems they are meant to improve.
