What is the OpenAI Agents API?

Launched September 11, 2026, the Agents API is OpenAI's managed agent platform: persistent agent sessions running in OpenAI-hosted sandboxed VMs, with SDK-based development, event streams, webhooks, and configurable network egress (enabled, disabled, or host-allowlist). It is billed via API usage only — ChatGPT and Codex subscriptions do not apply.

How much does the Agents API sandbox cost?

Sandbox environments are priced at $0.03 per 20 minutes at 1 GB (about $0.0015/minute), with a roughly 5-minute minimum per activated environment — a floor of about $0.0075 per session spin-up. You can avoid environment charges entirely with environment.type: "none".

Does the Agents API sandbox network restriction actually work?

Simon Willison tested the restricted mode on launch day: a blocked curl to example.com returned "Domain forbidden" at exit code 0, and he verified no /etc/hosts or Host-header workaround was being used. It is a real enforcement boundary — but the restricted container's own API responses are a plausible channel for an agent to request its own privileges be escalated.

OpenAI Agents API: Selling the Harness, Not the Model

OpenAI shipped a first-party Agents API today — managed, sandboxed agent sessions billed as infrastructure, not as chat. It hit 214 points on Hacker News within hours, and the thread did the diligence for free: sandbox compute is priced at $0.03 per 20 minutes at 1 GB, with a ~5-minute minimum per activated environment (a $0.0075 floor per session spin-up), and network egress has exactly three modes — enabled, disabled, or host-allowlist. Simon Willison tested the restricted mode live and the sandbox answered an attempted workaround with Domain forbidden at exit code 0. That's a real enforcement boundary, not a suggestion.

What Shipped

The shape: you develop with the SDK, then deploy persistent agent sessions to OpenAI-hosted sandboxes. Sessions run and continue across turns, emit events and items, support webhooks, and can be configured for restricted networking. Two details from the thread matter more than the feature list. First, it's API-billing only — your ChatGPT/Codex subscription doesn't apply, so this targets companies, not hobbyists. Second, there's an opt-out (environment.type: "none") if you just want orchestration without renting their VM.

Why It Matters

We've tracked the harness consolidation all month: OpenAI cutting Cursor off in August, "There Is No Neutral Harness," Vercel building a harness adapter layer. The Agents API is the logical endpoint — the harness is no longer scaffolding around the model; it's the revenue line item. Every rented sandbox minute is recurring margin that open-weight rivals can't match without operating the same fleet. And note the direction of travel: local coding agents on your machine are the thing this quietly obsoletes. HN commenters said it out loud — dev on your laptop, deploy to their box, and the work-in-progress lives on their infrastructure, not yours.

The honest counterweight: the sandbox security model looks genuinely well-built, and you can self-host sandboxes if lock-in scares you. But the network-policy trap is real — as one commenter put it, an agent inside a restricted container only needs one crafted API response header to ask its outside counterpart to "please update the container for full network access." Policy enforcement is now the attack surface.

Verdict

Strong engineering, wrong incentives. If you build on this, treat the egress allowlist as a security perimeter you audit, not a feature you trust — and keep a self-hosted sandbox path wired up from day one, because the exit gets more expensive every quarter you don't.

What Shipped

Why It Matters

Verdict

Related