OpenAI now has over 500 agents that run proactively in the background doing work across the company, it said in an OpenAI Developers blog post published on 13 November on how it secures persistent agents such as OpenClaw. The post, by Kevin S Lin, says OpenAI has persistent agents deployed across the entire company, including hundreds of OpenClaw agents.
Lin introduced it on X by writing that “agents are more like contractors than traditional saas software, able to take proactive actions in the background without human intervention”. The post sets out its controls under five headings, and the sample sandbox configuration it publishes holds 18 settings that block, strip or switch something off against three allowed domains, by our count.
Business Pill · The Model and the Harness
A short explainer on why products built on the same model differ: the harness around the model. It teaches the general idea only and does not discuss OpenAI’s controls.
The key insight: As we read the post, OpenAI’s design puts the security boundary outside the agent: the gateway that configures each agent runs as trusted code in a separate cluster, and everything the agent does or writes is treated as untrusted.
First, OpenAI splits trusted from untrusted execution. The post says agents, their environment and the code they write are treated as untrusted, while networking, identity and sandboxing are trusted deterministic logic. To do that, OpenAI implemented remote harness execution in the open-source OpenClaw project, so the OpenClaw Gateway runs in a separate container, and in OpenAI’s case a separate cluster, from the agent harness.
Second, hard sandbox boundaries. The post lists four sandbox controls: network access through an organization-managed allowlist with explicit denials, file writes allowed only in agent working directories, process isolation via the Codex Linux sandbox, and secrets managed through a credential broker so they are not visible to the agent. OpenAI says it also removed the ability to use the danger-full-access mode and relied on cached web search, which routes queries through OpenAI’s own index.
Third, model-based safeguards. With Auto-review, a second agent monitors and approves the actions of a primary agent, and OpenAI says it enforces auto review on all agent actions in its OpenClaw deployment. The post gives the reason: “Constantly requiring human review creates review fatigue where humans are trained to blindly accept all permission prompts”.
Fourth, agent identity separate from user identity. Each agent has a unique identity associated with a ChatGPT Service Account, which gives it an inference credential separate from the user’s, the post says. OpenAI says this lets it audit agent actions and, if needed, turn off inference. Fifth, observability: OpenAI says it logs every configuration change on the control plane and all turns from the agent, and that those logs are available only to a select few individuals in the security team.
Items in the sample sandbox configuration (requirements.toml and config.toml) that OpenAI published for its OpenClaw agents, grouped by type. The count is ours; it describes the published sample, not OpenAI’s full production setup.
What Was Posted on X
deploying persistent agents like Openclaw or Dots pose a major challenge for enterprise IT
agents are more like contractors than traditional saas software, able to take proactive actions in the background without human intervention they are capable of fulfilling entire job functions but they can also take misaligned actions and write arbitrary code with unintended consequences
today, we are sharing some of the best practices we use to manage fleets of claws at @OpenAI
Kevin S Lin, the author of the OpenAI Developers blog post, introduced it on 12 November. He describes persistent agents such as OpenClaw or Dots as more like contractors than traditional SaaSsoftware; the piece quotes that line and draws the controls from the blog post itself.
My team wrote about how we run persistent agents inside OpenAI.
Peter Steinberger shared Lin’s post on 13 November, writing that his team wrote about how they run persistent agents inside OpenAI. His post adds no figures of its own.
What the Sample Configuration Shows
The post publishes the settings it used, split between a requirements.toml file that limits what can be configured and a config.toml file. By our count, the sample switches off six proxy features, blocks five destinations by name, removes four GitHub credential variables from agent command environments and turns off three app permissions by default. That is 18 settings that say no, against three allowed domains, all on GitHub.
The blocked destinations are pastebin.com and its subdomains, webhook.site and two cloud metadata endpoints. The configuration also denies access to the agent user’s .ssh folder. A comment in the sample says the credential exclusion “does not hide credentials stored in accessible files”, and another says to replace the allowed domains with the workload’s required hosts.
Why It Matters for Enterprise Agents
The post argues that persistent agents differ from traditional software because they can change their own configuration and write arbitrary code, and it says real-world deployment has been limited to date. In its words: “Attacks come from the inside when agents take misaligned actions”. OpenAI says its internal OpenClaw pilot brought a huge jump in productivity and adoption from technical and non-technical teams.
The examples it gives are agents automatically opening pull requests in response to product feedback and continuously running data experiments on new features. OpenAI also points readers to OpenClaw Enterprise, an open-source, vendor-neutral agent control plane announced at its dev day, which it says is still in a pilot phase with a 1.0 release planned by the end of the year.
As we read it, the review step is the scaling choice: OpenAI says it enforces auto review on all agent actions so that human attention is reserved for high value approvals, rather than asking people to approve every prompt.
As we read the sample configuration, most of it is about removing options: 18 settings block, strip or switch something off, against three allowed domains, by our count, and one comment notes that removing credential variables does not hide credentials stored in accessible files.
Kevin S Lin, OpenAI Developers blog, 13 November 2026
“We believe many of AI’s biggest gains in industry will come from persistent agents.”
Three Implications
FOR ENTERPRISE IT The post lists four sandbox controls (network, workspace, process, secrets), a per-agent identity tied to a ChatGPT Service Account, and logs of every agent turn as the controls OpenAI used.
FOR AGENT BUILDERS OpenAI says it implemented remote harness execution in the open-source OpenClaw project so the gateway can run apart from the agent harness.
FOR OPENCLAW ENTERPRISE OpenAI says the open-source control plane ships many of these safeguards in a standard Codex preset, is in a pilot phase, and is planned to reach 1.0 by the end of the year.
The framework says: “The limiting factors are organizational readiness, governance, workflow redesign, training, and trust.”
As we read it, OpenAI’s post is a worked example of the governance and trust part: a sandbox, a reviewing agent, an identity per agent and full logs around more than 500 agents. The framework predates this post and does not discuss these controls.
What Is Not Established
The post gives no figure for security incidents, cost, time saved or how many employees run agents, and it does not quantify the productivity jump it describes. It uses both “hundreds of OpenClaw agents” and “over 500 agents”; we report both as written. Our counts describe the sample configuration published in the post, which OpenAI presents as some of the settings it employed, not a full audit of its production fleet.
Peter Steinberger shared the post on X, writing that his team wrote it; we covered his token spend figure in October. We read the blog post in full and both X posts; we did not contact OpenAI for this piece.
This Week In The AI Supercycle
The Great Convergence of Capital, Power, and Geopolitics
This week’s issue: for two years the AI build-out was priced as a supply story, and last week as a credit story. This week it was priced as a permission story, and the answer arrived as a cost, not a ban.
OpenAI says it runs over 500 proactive agents internally and treats each one as untrusted code: a gateway in a separate cluster, a sandbox with a domain allowlist, a second agent reviewing every action, an identity per agent and logs of every turn. Its published sample configuration has 18 settings that say no and three domains that say yes, by our count.
A note on sourcing. Every fact about OpenAI’s controls and agent numbers comes from the OpenAI Developers blog post of 13 November 2026 by Kevin S Lin, which we read in full, including its sample configuration files; the contractor comparison is from Lin’s X post introducing it. The counts of settings and the five-heading grouping are ours and describe the published sample, not OpenAI’s full production setup. We did not contact OpenAI for this piece. This piece is not investment advice.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
