OpenAI's Agents SDK Now Ships with Sandboxed Execution and a Model-Native Harness

OpenAI shipped a significant update to its open-source Agents SDK on April 15, adding native sandboxed execution, a model-native harness for file and shell operations, configurable memory, and workspace portability. The update targets developers building agents that need to run for a long time, touch real files, and do so without compromising the surrounding system.

Python support is available now. TypeScript is coming in a later release.

The Model-Native Harness

The biggest change is a new harness layer that sits between your agent and the tools it calls. It gives agents structured access to file trees, file reads and writes, patch-style edits, and shell commands, without requiring the agent to construct and manage those interfaces from scratch.

The key design choice is patch-style file modification. Instead of the agent reading an entire file, rewriting it in memory, and overwriting the original, the harness applies targeted edits. That reduces errors from state drift, where the model’s mental model of what a file contains diverges from the actual disk state.

The harness also integrates with MCP (Model Context Protocol), so tools from any MCP-compliant server connect using a standardized interface.

Sandboxed Execution

Long-running agents that can run shell commands and modify files are a security problem if they’re not contained. The SDK now has native sandbox support, meaning agents can work inside isolated environments with restricted file access and execution limits.

OpenAI supports eight sandbox providers out of the box: Blaxel, Cloudflare, Daytona, E2B, Modal, Runloop, and Vercel. You can also bring your own sandbox if you already have an execution environment you trust.

The practical effect: an agent that spins out during a long coding task can’t touch things outside its workspace. That matters for enterprise deployments where agents run autonomously for hours on production-adjacent code.

Configurable Memory

The SDK adds controls for what agents remember and for how long. Teams can set granularity, duration, and access policies instead of letting context accumulate without bounds. The intent is to make memory a resource you manage, not a liability that grows until it breaks something.

Workspace Portability

Agents can now describe their workspace using a Manifest abstraction. You mount local files, define output directories, and pull in data from external storage: AWS S3, Google Cloud Storage, Azure Blob Storage, and Cloudflare R2. That makes it easier to run the same agent in CI, locally, or in a cloud sandbox without rewriting file paths.

Non-OpenAI Models

The SDK now supports over 100 non-OpenAI LLMs via the Chat Completions API. You’re not locked into GPT models to use the tooling.

Why It Matters

Most agent frameworks leave sandboxing, file handling, and memory management as exercises for the developer. That works until it doesn’t: a tool call hangs, a file gets corrupted by concurrent writes, a credential gets exposed because an agent had more access than it needed.

What OpenAI is shipping is an opinionated execution layer that handles the boring, dangerous parts. You still build the agent logic, but the runtime enforces sensible defaults for isolation and state management.

The Agents SDK source is on GitHub. The official documentation covers setup and the new harness API.

Sources: OpenAI announcement, TechCrunch, Dataconomy