500 Agents Working 24/7: OpenAI First Puts Them in a Cage

OpenAI is now running more than 500 persistent agents internally, hundreds of which are OpenClaw. Kevin S Lin wrote on the developer blog about how they manage these agents, and Peter Steinberger shared the post (original tweet, blog post).

The so-called persistent agent is different from one that solves a single goal in one session: it is online 24/7, has a broader scope, and can proactively do things when no one is watching. The greater the capability, the bigger the headache for enterprise IT.

The blog makes the problem plain at the start: a persistent agent is more like a contractor than traditional SaaS. It can complete a whole block of work, but it can also take actions that deviate from the goal, or even write arbitrary code. Traditional software mainly defends against external attacks; part of a persistent agent's risk comes from the inside—from the agent's own actions. This is a judgment enterprises should remember first.

OpenAI's approach starts with the boundary. They separate trusted deterministic logic from untrusted LLM execution. OpenClaw implements remote harness execution; the Gateway runs separately in a container and is actually also in a separate cluster, with the agent harness separated. Key parts such as network, identity, and sandbox are treated as trusted code, while the agent execution environment and the code it writes are treated as untrusted.

The sandbox boundary covers network, workspace, processes, and secrets. Network access goes through an organization-managed allowlist, explicitly denies restricted endpoints, and even cloud metadata addresses are on the deny list. The workspace only allows writes to the agent working directory. Processes are isolated by the Codex Linux sandbox. Secrets are not given directly to the agent; they go through a credential broker. The configuration also disables danger-full-access mode, allows only cached web search, denies .ssh, and removes GH_TOKEN and GITHUB_TOKEN from the command-line environment. There is an easily overlooked detail here: removing environment variables does not mean credentials in files are safe, so directory permissions and the broker must be used together.

The second line of defense is the model. Auto-review lets another agent review the main agent's actions. If human approval pops up a dialog for every step, people quickly start clicking approve mechanically. Using a model as a filter leaves human attention for high-risk actions. For example, reading email can be allowed, while sending email requires approval. This idea is like a worker getting a supervisor's signature before a dangerous operation—not new, but very practical when applied to agents.

Identity is also split apart. Each agent has a unique identity, bound to a ChatGPT Service Account, with its own inference credentials, separate from user identity. This way auditing can tell who initiated an action, and teams can plug in custom plugins. Someone asked what happens to tasks already in flight after an identity is revoked. Kevin replied that what is revoked is the identity's access to downstream services; all calls go through a centralized credential broker, so once access is cut, the related calls fail.

Observability is not omitted. Every control-plane configuration change and every agent turn are logged. Because conversations may contain sensitive information, log permissions are tightly restricted and opened only to a few people on the security team. Internally, OpenAI uses these agents to automatically open PRs based on product feedback, and also continuously runs data experiments on new features.

Enterprise deployment is still early. At Dev Day, OpenAI released OpenClaw Enterprise, an open-source, vendor-neutral agent control plane. It is currently in pilot and planned to reach 1.0 by the end of the year. Configuration is genuinely troublesome, too. Dmytro Brokhin replied that the more he uses OpenClaw and Hermes, the more he feels there is a lot to configure. In another reply, 神宮司誠仁 posted a screenshot of the developer website on mobile, and the text cannot be read:

The value of persistent agents is not in doubt. First nail down permissions, identity, auditing, and escape hatches; then talk about letting them work 24/7. Reverse the order, and the contractor will become a colleague you cannot take offline.