On 12 November, OpenAI described on its developer blog how it secures the persistent AI agents running inside the company. Kevin S Lin’s post covers some of the controls OpenAI uses but presents no measurements of how well they work.

A persistent agent runs around the clock across a broad range of tasks and acts on its own initiative. In that setting, Lin wrote, the threat also comes from within: an agent can change its own configuration, write arbitrary code and act in ways that diverge from its goals. OpenAI has hundreds of OpenClaw agents in use, Lin said.

Control and agent in separate containers

OpenAI separates trusted, pre-programmed logic from the untrusted behaviour of the language model. To do this, the company added remote harness execution to the open-source OpenClaw. A harness is the program that steers an agent: it gives the model its tools and runs its steps.

The OpenClaw Gateway, which configures the agent, can now run in a different container from the harness; at OpenAI it runs in a separate cluster. The agent, its environment and the code it writes are isolated in a sandbox.

OpenAI uses the Codex harness’s own sandbox. On the network, the agent can reach only addresses the organisation allows, and some addresses are explicitly blocked. It can write only to its working directories, and its processes are isolated. Secrets pass through a credential broker, so the agent cannot see them.

OpenAI also removed Codex’s unrestricted danger-full-access mode and allowed only cached web search, which runs through OpenAI’s own search index. The blog’s example configuration strips GitHub tokens from the environment variables of the agent’s commands. Lin noted that this does not hide tokens stored in files.

A second agent approves actions

In Auto-review, a built-in feature of OpenClaw and Codex, a second agent monitors and approves the main agent’s actions. OpenAI requires review of all agent actions. Constant approval requests, Lin wrote, train people to approve everything blindly. A reviewer based on a language model therefore filters the requests and leaves only the most important ones to humans.

Each agent has its own identity linked to a ChatGPT Service Account. The agent thus has an inference identity separate from the user’s, its actions can be traced and its inference can be cut off if needed.

OpenAI logs every configuration change made on the control plane, the system that configures the agents, as well as all agent turns. Because the logs can contain sensitive information, only a few members of the security team can access them.

Safeguards in the open-source OCE

Lin said the internal pilot clearly increased productivity and usage. More than 500 agents now run in the background, Lin wrote, for example opening pull requests based on product feedback.

Many of the safeguards are built into the open-source OpenClaw Enterprise (OCE), a vendor-neutral control plane for agents. They take effect when an agent is launched with the standard Codex preset. OCE is still in pilot, and OpenAI plans to release version 1.0 by the end of the year.