OpenAI explains how it secures more than 500 proactive OpenClaw agents

OpenAI says more than 500 OpenClaw agents are working proactively inside the company, opening code-change requests and running experiments without waiting for each instruction. In a November 12 disclosure, it explained how it contains that autonomy: fixed limits on access, another AI reviewing actions, and identities that keep agent activity separate from users.

These are persistent agents: systems that run around the clock, pursue broad goals and can act without a fresh user prompt. That differs from a conventional Codex session built around a fixed task and human direction. OpenAI’s examples include responding to product feedback with proposed code changes and continuously testing new features through data experiments.

Keep the agent outside the trusted machinery

The architecture starts with a distinction between software that enforces rules and software the agent can change. OpenAI treats networking, identity and sandbox controls as trusted, conventional code. It treats the agent, its execution environment and the code it writes as untrusted. The concern is not only an outside attacker: an agent can itself take actions that depart from its intended goal.

To enforce that split, OpenAI implemented remote execution in OpenClaw. The Gateway, which configures the agent, runs separately from the harness—the software around the model that executes its work. They occupy different containers and, inside OpenAI, different computing clusters. This lets the company isolate the agent’s workload without treating its control machinery as equally untrusted.

The Codex sandbox, an execution environment with enforced limits, then restricts four kinds of access:

• Network: agents can reach only organization-approved destinations, with explicit blocks for restricted endpoints.
• Files: writes are limited to agent working directories.
• Processes: the Codex Linux sandbox isolates running processes.
• Secrets: a credential broker manages credentials without exposing them to the agent.

OpenAI also removes the unrestricted danger-full-access mode, requires a managed network proxy and permits cached hosted search rather than live hosted search. The published configuration prevents user-level settings from widening the approved network destinations.

An AI reviewer, not an endless permission queue

The second layer depends on model judgment rather than fixed software rules. OpenAI says it enforces Auto-review on all agent actions. A second agent monitors and approves what the primary agent wants to do. The feature is supported in both OpenClaw and Codex, and sits alongside the sandbox restrictions rather than replacing them.

OpenAI’s stated reason is human attention. Repeated permission prompts can create review fatigue, training people to approve requests without examining them. It positions the model reviewer as a filter that reserves human attention for higher-value approvals. That is the company’s rationale for the design, not a measured result showing how reliably the reviewer catches mistakes.

Trace the worker, protect the record

Each agent also gets a unique identity linked to a ChatGPT Service Account, with its own model-access credential separate from the user’s. OpenAI says this supports auditing and lets operators turn off an agent’s inference access—the ability to call the model—when needed.

The company records every configuration change in the management layer and every agent turn. Those records create their own sensitivity: agent turns can contain private information. Access to the logs is therefore restricted to a small group within the security team, rather than made broadly available to employees.

Some of this architecture is available through OpenClaw Enterprise, the previously announced open-source, vendor-neutral management layer for agents. OpenAI says its standard Codex preset includes many of the safeguards described. But the project remains in pilot, with a 1.0 release planned by the end of 2026; this disclosure is not a finished-platform launch.