Agent environment design is the half of OpenAI’s expected DevDay 2026 announcement that will decide whether most companies can use the product at all. TestingCatalog reported on 7 September 2026 that OpenAI’s codebase contains functionality for creating agents and environments, managing them, and enabling skills and plugins — and, critically, that “Managed Agents will be available on self-hosted environments too.”
Almost all the coverage has fixed on the first noun. The second one is where the money and the compliance sit. An agent that can read files, run shell commands, install packages and reach the network has to do that somewhere. That somewhere is the agent environment: hardware someone owns, inside a network someone polices, with credentials someone issued.
We covered the leak itself, the confirmed DevDay calendar and the commercial logic in OpenAI to Announce Managed Agents and Environments at DevDay 2026. This article takes the other half: what an agent environment actually is, what OpenAI has already shipped for it five months before the keynote, and what Anthropic’s documented version tells you about the questions to ask.
That matters because the environment is the part you cannot change later. Models get swapped in an afternoon. The decision about where tool execution happens touches your network policy, your data residency position and your audit evidence, and unwinding it is a project rather than a config change.
Everything below separates what is confirmed on a vendor’s own site from what rests on a codebase reading. Where something is unknown, it says so rather than guessing.
Table of contents
- What an Agent Environment Actually Is
- What OpenAI Already Shipped for the Agent Environment
- Why OpenAI Argued Against Managed Agents in April
- Anthropic’s Agent Environment: The Documented Template
- The Self-Hosted Agent Environment in Practice
- Separating Harness From Compute Inside the Agent Environment
- Managed Agents Already Run on AWS
- The Compliance Case Against a Stateful Agent Environment
- Agent Environment Costs Nobody Has Quoted Yet
- The DevDay 2026 Calendar and the Clock Behind It
- Choosing an Agent Environment Before the Keynote
- Agent Environment Risks Teams Underestimate
- Watching the Keynote With the Right Questions
- Agent Environment FAQ
- References
What an Agent Environment Actually Is
The word is doing precise technical work in both vendors’ documentation, and it is not a synonym for “server”.
The four-part model
Anthropic’s Claude Managed Agents documentation defines four concepts: the agent, the environment, the session and events. The agent is “the model, system prompt, tools, MCP servers, and skills”. The agent environment is “configuration for where sessions run”. A session is one running instance inside an environment; events are the messages passing between your application and the agent.
Environment versus harness versus model
Three separable things are often collapsed into one. The model does the reasoning. The harness is the loop that decides what to call next, manages context and handles tool results. The agent environment is the actual compute where those tool calls land — the filesystem, the processes, the network reach.
Why the distinction earns its keep
You can keep the model and swap the harness. You can keep both and move the agent environment from a vendor’s cloud to your own rack. Treating them as one product is what produces the lock-in nobody priced in. Any serious evaluation of AI agents for production work has to price the three layers separately.
What OpenAI is reported to be building
TestingCatalog’s Alexey Shabanov describes OpenAI Managed Agents as an implementation that “broadly follows what Anthropic currently offers”, with agents, environments, skills and plugins. The same report is explicit that “access to the agents UI is not available yet”. That is a codebase reading, not an announcement.
| Layer | Vendor cloud sandbox | Self-hosted sandbox | Your own agent loop |
|---|---|---|---|
| Model inference | Vendor | Vendor | Vendor |
| Harness / orchestration | Vendor | Vendor | You |
| Tool execution | Vendor | You | You |
| Filesystem the agent writes | Vendor | You | You |
| Network egress policy | Vendor controls | Your policy | Your policy |
| Session state and history | Vendor | Vendor control plane | You |
What OpenAI Already Shipped for the Agent Environment
This is the part the DevDay previews keep missing. OpenAI did not start on this in September.
The April 2026 Agents SDK release
On 15 April 2026 OpenAI published “The next evolution of the Agents SDK”, introducing “a model-native harness that lets agents work across files and tools on a computer, plus native sandbox execution for running that work safely”. The release notes describe configurable memory, sandbox-aware orchestration and Codex-like filesystem tools — an agent environment layer in everything but name.
Seven providers, one Manifest
Developers can “bring their own sandbox or use built-in support for Blaxel, Cloudflare, Daytona, E2B, Modal, Runloop, and Vercel”. To keep an agent environment portable between them, the SDK adds a Manifest abstraction describing the workspace: mount local files, define output directories, pull in data from elsewhere.
Storage that crosses clouds
The Manifest can bring in data from AWS S3, Google Cloud Storage, Azure Blob Storage and Cloudflare R2. That gives “a consistent way to shape the agent’s environment from local prototype to production deployment”, and gives the model a predictable place to find inputs and write outputs.
The standard primitives it assumes
The harness ships with tool use via MCP, progressive disclosure via skills, custom instructions via AGENTS.md, code execution through a shell tool and file edits through an apply patch tool. Those are the same primitives the leaked Managed Agents console would need, and they already assume an agent environment underneath.
Why OpenAI Argued Against Managed Agents in April
The most quotable line about the coming announcement is one OpenAI wrote itself, five months early.
The sentence worth reading twice
Explaining why it built the SDK the way it did, OpenAI wrote that “managed agent APIs can simplify deployment but constrain where agents run and how they access sensitive data”. That is a direct criticism of the category OpenAI is now reported to be entering.
It is not a contradiction, if environments do their job
The escape from that criticism is the agent environment abstraction itself. A managed product only constrains where agents run if the environment is fixed. TestingCatalog’s report that self-hosted environments are in scope is exactly the detail that would resolve OpenAI’s own objection.
The other two tradeoffs it named
The same passage says model-agnostic frameworks “do not fully utilize frontier models capabilities”, while model-provider SDKs “often lack enough visibility into the harness”. OpenAI positioned its SDK as the middle path, and a managed offering would sit above it, not replace it.
What that implies for the keynote
If OpenAI announces Managed Agents without a credible self-hosted agent environment story, it will have shipped the thing it criticised. Treat the environment options on the slide as the real test of the announcement.
Anthropic's Agent Environment: The Documented Template
Because Anthropic’s version is in public beta with published docs, it is the best available preview of the shape.
Two modes, one API
Anthropic’s environment is “configuration for where sessions run: an Anthropic-managed cloud sandbox, or a self-hosted sandbox on your own infrastructure”. The same agent definition runs in either, because the agent environment is a separate object you create and reference.
What the sandbox gives the model
The built-in toolset covers Bash, file operations (read, write, edit, glob, grep), web search and fetch that can be “restricted to an allowlist or blocklist of domains”, and connections to MCP servers.
Beta status you must plan around
All endpoints require the managed-agents-2026-04-01 beta header. MCP tunnels and dreaming sit in a narrower research preview requiring separate access. Published rate limits are 300 create requests and 1,200 read requests per minute per organisation.
Scheduled work is in scope
Anthropic also documents scheduled deployments, letting agent runs recur on a cron schedule. That turns an agent environment into standing infrastructure rather than something spun up per request, which changes how you monitor it.
The Self-Hosted Agent Environment in Practice
This is the mode enterprises will ask for, and the docs are unusually specific about its cost.
What actually moves to your infrastructure
Anthropic’s split is precise: “Tool execution stays on your host: the filesystem the agent reads and writes, the processes it spawns, and the network it can reach are all under your control.” Orchestration stays with the vendor, so a self-hosted agent environment is a split, not a handover.
What still leaves your network
The same page continues: “Tool inputs and outputs still flow to Anthropic’s control plane (where Claude runs) so the model can see results and determine what to do next.” Self-hosting the agent environment is not an air gap, and describing it as one to your risk committee would be wrong.
The environment worker
You run a worker process that “claims work items from that queue, spawns an execution context for each one, downloads the agent’s skills, runs the tool calls, and posts the results back”. The self-hosted environment behaves as a work queue that your infrastructure polls.
Host requirements that bite
The worker needs a Linux host with /bin/bash at exactly that path, and a POSIX filesystem — Windows is not supported. It authenticates with a separate environment key rather than your API key, which is a sensible blast-radius decision worth copying whatever vendor you choose.
Where self-hosting is more limited
Anthropic does not mount files or GitHub repositories into self-hosted sandboxes; those requests are rejected, and you pass an S3 path or a commit SHA through session metadata instead. Memory stores cap at eight per session and sync on a 15-second default interval.
| Capability | Cloud sandbox | Self-hosted sandbox |
|---|---|---|
| Tool execution location | Anthropic-managed | Your infrastructure |
| Network reach | Anthropic egress controls | Your network policy |
| File mounting | Managed for you | Staged via session metadata |
| GitHub repositories | Mounted | Not supported |
| Memory stores | Mounted at a fixed path | Downloaded and synced by the worker |
| Worker lifecycle | Managed for you | You run and monitor it |
Separating Harness From Compute Inside the Agent Environment
OpenAI’s stated reason for the split is security first, resilience second — and it is the strongest argument in the whole release.
The prompt-injection premise
OpenAI states the assumption plainly: “Agent systems should be designed assuming prompt-injection and exfiltration attempts. Separating harness and compute helps keep credentials out of environments where model-generated code executes.”
Why that sentence should shape your design
If the agent environment is where model-written code runs, then every secret reachable from it is a secret the model can be talked into exfiltrating. The mitigation is architectural, not a filter: the credentials simply are not in the room. This is ordinary cybersecurity practice — defence in depth — applied to a new kind of runtime.
Durable execution
Externalising state buys resilience. With built-in snapshotting and rehydration, “losing a sandbox container does not mean losing the run” — the SDK restores state in a fresh container and continues from the last checkpoint if the original expires.
Scale as a side effect
Once the harness is separate, a run can use one sandbox or many, invoke them only when needed, route subagents into isolated environments and parallelise across containers. Failure isolation and throughput come from the same agent environment property.
Managed Agents Already Run on AWS
The detail most DevDay previews have missed entirely: a product with this name has been in limited preview since April.
Bedrock Managed Agents, powered by OpenAI
AWS lists “Amazon Bedrock Managed Agents, powered by OpenAI” in limited preview, for building production-ready OpenAI-powered agents that manage inference, memory and skills. OpenAI announced the arrival of its models, Codex and Managed Agents on AWS on 28 April 2026.
Residency is the pitch
The AWS page makes the agent environment argument the headline: “All inference runs on Amazon Bedrock and your data never leaves AWS.” It also states that “every agent operates with its own identity”, and positions the service alongside AgentCore.
Anthropic is there too
Claude Managed Agents is also available on Claude Platform on AWS, with documented differences in feature availability and session behaviour — memory stores, for instance, cannot be attached there. Both vendors have concluded that the cloud a customer already trusts is a legitimate place to put an agent environment, which is a meaningful shift in where these products expect to live.
What a marketplace route implies
A hyperscaler channel is how a managed product reaches regulated buyers who will never send data to a vendor’s own cloud. It is also why the DevDay announcement is unlikely to be single-tenant, single-region, or take-it-or-leave-it. Any organisation part-way through cloud adoption already has a residency answer this can inherit.
The Compliance Case Against a Stateful Agent Environment
The most under-reported line in Anthropic’s documentation is a limitation, and it will apply to OpenAI’s version too.
Statefulness has a price
Managed Agents “is stateful by design: sessions are long-running, resume cleanly after pauses, and store conversation history, sandbox state, and outputs server-side”. That persistence is what makes a long-running agent environment useful. It is also the problem.
The two exclusions
Because of that design, Anthropic states Managed Agents “is not currently eligible for Zero Data Retention or HIPAA Business Associate Agreement (BAA) coverage”. For healthcare and for any team with a contractual ZDR commitment, that single sentence decides the question before any benchmark does.
What control remains
Deletion is still yours: sessions can be deleted through the API, and uploaded files deleted separately. That is a retention control rather than a non-retention guarantee, and the difference is the one your auditor will care about.
The question to put to OpenAI
If Managed Agents is announced on 29 September, the first question is not price or context length. It is whether a stateful agent environment can be covered by the data-processing terms you already signed, and if not, which mode can.
Agent Environment Costs Nobody Has Quoted Yet
Pricing is the largest genuine unknown, and honest reporting has to leave it open.
What OpenAI charges today
The April SDK capabilities are “generally available to all customers via the API and use standard API pricing, based on tokens and tool use”. There is no separate runtime fee for the harness or the sandbox layer in that release.
The compute you supply yourself
That is not the same as free. If you bring your own sandbox provider, you pay that provider. If you self-host, you pay for the hosts, the operators and the monitoring. The agent environment moves cost around rather than removing it.
What is genuinely unpriced
No pricing exists for a managed OpenAI agent environment, because no such product is announced. Anthropic publishes rate limits rather than a price for its managed tier. Anyone quoting you a figure today is estimating.
Budgeting under uncertainty
Model a long-running agent as a small always-on service, not as an API call. The agent environment variables that will dominate are session duration, sandbox hours and egress — none of which behave like per-token spend.
| Claim about the environment | Evidence level | Source |
|---|---|---|
| Agents SDK supports seven sandbox providers | Confirmed | OpenAI, 15 Apr 2026 |
| Bedrock Managed Agents in limited preview | Confirmed | AWS product page |
| Self-hosted environments in OpenAI’s version | Codebase reading | TestingCatalog |
| Stateful sessions block ZDR and HIPAA BAA | Confirmed for Anthropic | Claude docs |
| Price of a managed OpenAI environment | Unknown | No source |
The DevDay 2026 Calendar and the Clock Behind It
The date is confirmed on OpenAI’s own site, and one deadline after it is doing quiet work.
Confirmed logistics
DevDay 2026 is Tuesday, 29 September 2026 at Fort Mason in San Francisco, with the keynote at 10:00 a.m. featuring Sam Altman. Registration is $650, and the keynote “will be livestreamed for free and is open to everyone”.
The wider programme
OpenAI is also taking DevDay Exchanges to Bengaluru, Tokyo, Seoul, Paris, Berlin, London, São Paulo and Mexico City, which is a larger developer-relations footprint than a single-product launch usually justifies, and a hint that the agent environment story is meant to travel.
The deadline nobody mentions
OpenAI’s AgentKit page carries an update stating that Agent Builder and Evals become unavailable from 30 November 2026. That leaves roughly two months between the keynote and the retirement of the visual builder, which is a short runway for anyone who has to migrate.
Choosing an Agent Environment Before the Keynote
Three weeks is enough to arrive at DevDay with requirements instead of reactions.
Inventory what your agents would touch
List the systems a long-running agent would read from and write to, and mark which hold regulated data. That list, not the feature comparison, determines which agent environment modes are even eligible.
Write the environment specification now
Put on one page: where tool execution must happen, what egress is permitted, which secrets may exist on the host, how long session state may persist, and who is paged when a worker dies. Any agent environment on the market can then be scored against that page in an hour.
Decide your residency line
Pick your position before the marketing arrives: vendor cloud is acceptable; a hyperscaler you already use is acceptable; or execution must stay on your own hosts. Each answer selects a different agent environment mode and a different cost base.
Rehearse on what already exists
The Agents SDK sandbox support is generally available today. Running one real task through it is a better preparation for the keynote than any preview article, including this one, and teams with existing workflow automation have obvious candidates to try.
Agent Environment Risks Teams Underestimate
Four failure modes are predictable enough to plan for now.
Credentials reachable from generated code
The classic mistake is mounting a broadly scoped token into the workspace because it was convenient. OpenAI’s own framing — assume prompt injection and exfiltration — should be read as a design instruction rather than a disclaimer.
Egress nobody intended
An agent with web fetch and package installation has a route out. Anthropic’s allowlist and blocklist for domains exists for exactly this reason, and self-hosting hands the whole problem to your network policy.
Orphaned workers and sessions
A self-hosted agent environment is a process that must be run, monitored, drained and restarted. Anthropic’s docs note the worker should be cancelled rather than killed for a graceful teardown — the kind of detail that becomes an incident when the runbook does not mention it. This is standard devops work, and it does not disappear because the workload is an agent.
Lock-in through the environment
Prompts port easily and models port reasonably well. A workspace layout, a memory-store contract and a worker implementation do not. The portable-manifest idea exists precisely because this agent environment risk is real, and it is worth testing rather than assuming.
Watching the Keynote With the Right Questions
If you only get five minutes of the announcement, spend them on these.
The five things to listen for
Does a self-hosted agent environment ship at launch or “later”? Which sandbox providers are supported? What are the data-retention terms for stateful sessions? Is there a runtime charge separate from tokens? And what is the migration path from Agent Builder before 30 November?
What would count as a strong launch
Self-hosted execution available on day one, explicit retention terms, and pricing that does not require a sales call. That combination would answer OpenAI’s own April criticism of managed agent APIs.
What would count as a weak one
A polished console, a single hosted region and a waitlist for everything else. Enterprises would read that as a preview, and buyers who bought into cloud computing on a residency promise would simply wait.
The reasonable default position
Until the terms are published, treat a managed agent environment as promising and unproven. Build against the SDK, keep the agent environment contract explicit, and let the keynote update the plan rather than set it.
Agent Environment FAQ
Has OpenAI confirmed Managed Agents?
No. As of 8 September 2026 the only public evidence is TestingCatalog’s codebase reading of 7 September, which also notes the agents UI is not yet available.
Can I run an agent environment on my own servers today?
With Anthropic, yes — self-hosted sandboxes are documented and in beta. With OpenAI, you can already bring your own sandbox provider through the Agents SDK, but there is no managed console to attach it to yet.
Does self-hosting keep all data on my infrastructure?
No. Tool execution stays local, but tool inputs and outputs still flow to the vendor’s control plane so the model can act on them.
Why can’t a stateful agent environment get Zero Data Retention?
Because sessions persist conversation history, sandbox state and outputs server-side by design. Anthropic states that this makes Managed Agents ineligible for ZDR and for HIPAA BAA coverage.
What does an agent environment cost?
OpenAI’s April SDK capabilities use standard token and tool-use pricing with no separate runtime fee. Any sandbox or self-hosted compute is yours to pay for, and no managed OpenAI tier has been priced.
Should we wait for DevDay before committing?
Wait before signing, not before learning. The SDK sandbox support is available now, and a rehearsal this month is what makes the announcement actionable.
References
The next evolution of the Agents SDK
OpenAI prepares managed agents for DevDay 2026
Amazon Bedrock Managed Agents, powered by OpenAI
OpenAI models, Codex, and Managed Agents come to AWS
Claude Managed Agents overview
Claude Managed Agents self-hosted sandboxes
OpenAI’s Agents SDK separates the harness from the compute
OpenAI updates Agents SDK, adds sandbox for safer code execution
More AI coverage: explore Progressive Robot's AI Models, Tools & Releases hub — hands-on reviews, setup guides and benchmarks in one place.