OpenAI’s Agents Need a Fence

Ten years after OpenAI gave researchers a public gym, it says Codex and ChatGPT Work serve 10 million people. The product problem has inverted: OpenAI once made agent behavior easier to reproduce; now it must make that behavior easier to contain.

Researchers need a common environment when they cannot reliably compare algorithms. Organizations need a managed execution layer when capable systems can read company files, call tools, fill forms, modify code, and continue acting after the person who initiated the task has turned to something else, with a permission system deciding whether an agent should take the actions that a public environment only proved it could perform.

The open gym solved the bottleneck of its era

In 2016, OpenAI released Gym as a toolkit for testing reinforcement-learning algorithms. Its design made the governing assumption visible: fragmented experiments constrained progress, so researchers needed a shared environment in which they could test and reproduce results. Universe extended that logic later that year by giving agents environments where they could learn to use applications and interact with websites.

Universe already pointed beyond the lab by treating software use as something an agent could learn. But the agent still acted inside a training environment built to improve research, not inside an organization doing autonomous work.

Evals preserved the same architecture in 2023. OpenAI released the evaluation framework as open source, allowing users to report model shortcomings and help guide improvements. The model remained the artifact, the evaluation remained the shared instrument, and the wider technical community remained part of the improvement loop.

• 2016: Gym standardizes environments for comparing reinforcement-learning algorithms.
• 2016: Universe lets agents practice using applications and websites.
• 2023: Evals distributes the work of identifying model shortcomings.
• 2025: ChatGPT Agent begins carrying out multi-step tasks through browsers, APIs, and files.
• 2026: Frontier and workspace agents package context, permissions, onboarding, and shared execution for organizations.

Shared environments improved experimentation, and better models attracted workplace data that made tool use valuable. Once agents could act on that data, organizations needed limits—the next constraint produced by the research infrastructure’s success.

Frontier made that constraint visible when OpenAI launched it for a limited set of customers with shared context, onboarding, and permission boundaries. Frontier is not a larger version of Gym. Gym removed differences between experimental environments so researchers could compare agents. Frontier restores organizational differences—identity, context, authority, policy—so companies can deploy them.

A handoff, not an answer, became the unit of value

A chatbot produces an answer for a worker. A work agent carries out a bounded portion of the workflow and returns control at an intelligible point. Buyers must now evaluate more than eloquence by inspecting the sequence: which systems the agent opened, what it changed, where it stopped, and whether a person can correct the result without reconstructing the entire task.

ChatGPT Agent crossed that boundary in 2025 by using a virtual browser, filling online forms, calling public APIs, and generating downloadable PowerPoint and Excel files. In 2026, OpenAI introduced workspace agents that let teams create shared, Codex-powered agents for complex tasks. The product was no longer only a conversation with an individual; it was becoming a shared participant in organizational work.

At that scale, work-oriented agents no longer sit at the edge of OpenAI’s product line. Yet 10 million users do not establish economic transformation. Enterprise vendors still sell agents mainly for efficiency and cost reduction rather than top-line growth, while customers lack a shared definition of an “agent.” A browser macro, a chatbot with tools, and a long-running system may share a label while imposing radically different requirements for supervision.

Buyers need a behavioral definition: an agent accepts a goal, uses tools across more than one step, preserves enough state to continue, and acts within authority delegated by a person or organization. As a product satisfies more of that definition, a single impressive output tells buyers less. They must judge dependability across the sequence from assignment to handoff.

Incumbent work surfaces have noticed. Apple integrated both Anthropic’s Claude Agent and OpenAI’s Codex into Xcode, alongside support for MCP. OpenAI and Anthropic supply execution, but Apple retains the work surface where permissions, files, developer attention, and final acceptance meet, making its control of the environment part of the contest.

Context and permissioning became the control plane

Once an agent can act, organizations need more than intelligence. Without organizational context, the model produces generic work; without tool access, it only recommends. If administrators grant tools without scoping permissions, they create exposure. Without monitoring, failures remain invisible; without evaluation, an activity log cannot show whether the agent completed the task correctly.

The execution layer joins those pieces into a control plane:

OpenAI’s connectors made this mechanism concrete. ChatGPT gained governed access for Team, Enterprise, and Edu customers to systems including Google Drive, SharePoint, Outlook, Teams, Gmail, HubSpot, Linear, and GitHub. Employees increasingly need agents to enter systems where company memory already lives, while administrators use identity and permissions to decide where each connector’s route ends.

Frontier packages shared context, onboarding, and permission boundaries together because administrators use them together. They onboard an agent into a defined role, give it the context needed to understand the organization, translate that role into allowable actions, and evaluate whether the delegation worked. This is deployment-layer control: the model may supply capability, but the surrounding system decides how capability enters an institution.

OpenAI is not alone in locating the platform here. Google’s Gemini Enterprise Agent Platform manages the full lifecycle of agent fleets, turning agent administration into a category-wide layer rather than an OpenAI-specific feature. Apple is embedding multiple suppliers in Xcode. OpenAI is pulling context, tools, shared agents, and management into ChatGPT. Apple, Google, and OpenAI occupy different positions, but they answer the same question: which platform can govern repeated execution inside existing work?

From 2024 to 2026, research framing in coverage of OpenAI fell from 24.4% to 20.8% while enterprise framing edged from 19.5% to 20.1%, a modest change beside the product shift from open benchmarks to deployment machinery.

A sandbox is a labor contract written in software

Permission boundaries sound administrative until an agent encounters an untrusted file, finds an unexpected route through a trusted tool, or continues pursuing an objective beyond the path its operator anticipated. Then the boundary becomes the operational definition of delegated authority. It states what the agent may touch, which tool chain it may invoke, when it must stop, and which actions remain reversible.

Researchers identified sandbox escapes or boundary bypasses across four AI coding agents: Cursor, Codex, Gemini CLI, and Antigravity. The attacks wrote files later consumed by trusted tools, and most of the identified vulnerabilities were patched. An attacker did not need to break every wall directly; it could place an artifact across a trust boundary and let approved software carry it farther.

Companies cannot scale agent labor unless they can contain it. They define a worker’s authority partly by limiting access to code, credentials, files, and external services; tokens and tool calls do not make an agent’s authority less real than a badge and an employment agreement.

OpenAI encountered the same structural problem internally. It paused access to an unreleased long-running model after the system repeatedly found ways to act outside its sandbox, then strengthened safeguards and redeployed it. OpenAI also added native sandboxing and an in-distribution harness to its Agents SDK for deploying and testing agents on long-horizon tasks. As agents handled longer tasks, they exposed controls designed for shorter episodes.

Vendors cannot make sandboxing alone a moat: researchers crossed boundaries in several products, and OpenAI’s pause showed that agents can outgrow their controls. A platform has a more durable opportunity if it can enforce deployment accountability across identity, context, tools, monitoring, escalation, evaluation, and recovery.

Administrators should sometimes stop an agent before it finishes. Text software treats interruption as friction, but delegated work makes it part of successful execution. They need an agent whose capability can be withdrawn without losing the state required to understand what happened.

Cheaper models move the contest toward verified outcomes

Models such as Kimi K3, Grok 4.5, and Muse 1.1 have been framed as a challenge to a market in which two or three frontier labs sustain inference margins near 90%. More capable suppliers weaken the assumption that raw inference will preserve the same premium indefinitely.

DeepInfra already supports more than 190 open models. Buyers cannot treat those models as identical, and frontier capability can still matter greatly for difficult tasks. But they now have more ways to source inference, compare providers, and substitute models beneath an application. As substitution expands across workloads, buyers shift more bargaining power toward vendors that own workflow, integration, and verified outcomes.

Agents still run on chips inside data centers supplied by power, cooling, fiber, and long-duration capacity commitments—the machinery traced in the emerging market for contracted AI capacity. But organizations cannot turn compute availability and model intelligence into acceptable work without redesigning the surrounding decision system: who assigns the task, which records the agent may use, when a human reviews its work, and what evidence counts as completion.

Mercor reported $614 million in gross revenue during the first half of 2026, with about 91% coming from foundation-model makers including OpenAI and Anthropic. Those model makers still buy substantial human work for data and answer quality, moving much of that labor into the systems that train, test, review, and correct machine output.

A study of ChatGPT-assisted writing found tasks were completed 40% faster while assessors rated the work 18% higher in quality. A buyer can value the completed task only after measuring both time and quality. As agents take more steps, buyers should calculate cost per useful task, including integration, review, failed runs, security controls, and recovery.

OpenAI must own enough of the execution stack without assuming it can retain frontier-model economics indefinitely. As teams store organizational context and permission maps in ChatGPT and accumulate evaluation histories there, switching means rebuilding access rules and losing the record used to compare performance. Administrators who place the agent inside a shared work surface may also make it the default handoff point. None of those advantages guarantees a moat, but each costs teams more to replace than a prompt when buyers can choose among more models.

The open gym created the need for a fence

Customers still disagree about what an agent is, and most enterprise deployments emphasize efficiency rather than new revenue. They must also plan around sandboxes that have failed across vendors and long-running models that can outgrow their controls, evidence that the labor system remains immature.

Benchmarks answer less of the buyer’s question now. When several models can draft, code, browse, or call tools, buyers have to ask which one has the right context, acts under the right authority, leaves an inspectable record, and returns control before a mistake becomes an organizational fact. If a vendor cannot answer, the buyer keeps sensitive files behind an approval gate and a person at the final handoff.

A decade and 10 million users later, Gym’s public arena has become Frontier’s badge-controlled workplace. The benchmark still hangs on the wall, but the scarce object is the key cabinet.