OpenAI Unveils Codex Harness for Coding Agents

Kundel's presentation centered on key architectural hurdles, including message processing efficiency and intelligent context management, which are crucial for the practical application of these agents.

The Codex agent utilizes a dual-protocol architecture, as detailed by Dominik Kundel, to manage distinct communication flows.

The App Server protocol handles interactions from the user interface to the harness, while the Responses API governs communication between the harness and the large language model's inference engine.

Both protocols are designed for extensibility, supporting third-party integrations like Theo's T3 code, Remote X, and Cloud Code, with the Responses API specifically re-engineered to facilitate agentic functionalities such as web searches and image generation.

Effective context management aims to prevent the exhaustion of token budgets and avoid model confusion that can arise from conflicting data, while maintaining flexibility regardless of the number of installed plugins or MCP servers.

Cache-ability is also emphasized as a key performance metric, directly addressing the cost-sensitive nature of agent development for users.

The Codex harness's context is composed of core model instructions and variable elements such as tool registries, which must be carefully managed to control costs and context size.

Dominik Kundel explained that deferred tools use markers to keep tools out of the immediate context window until they are explicitly searched via the Responses API.

Furthermore, available skills are capped at 2% of the maximum context window to prevent unnecessary bloat, and if this limit is exceeded, the system automatically shortens skill descriptions to maintain efficiency.

To enhance concurrency, agents can perform asynchronous actions, allowing them to continue primary tasks while delegated operations run in the background, as highlighted by Dominik Kundel.

Agents are equipped with a 'spawn agent' tool, which enables them to create new agent instances for task delegation, and background terminals operate similarly to sub-agents, using standard input for continuous interaction.

Models from GPT-5 onward are specifically trained to utilize an 'applied patch' tool for file editing, meaning they are accustomed to modifying files by applying diffs, according to Dominik Kundel.

This same tool pattern is also consistently applied when agents need to create new files within the development environment, standardizing file system interactions.

Dominik Kundel stated that the model naturally attempts to use Ripgrep for file searches, having been trained with it.

The Codex harness includes Ripgrep by default to ensure its availability, and on Windows, the model is specifically trained to leverage PowerShell commands natively for system interactions.

All file system interactions within the Codex harness pass through a dedicated sandbox layer to ensure security and isolation.

Dominik Kundel specified that macOS agents employ Seatbelt for sandboxing, while Linux environments use Bubblewrap; for Windows, a custom open-source sandbox was developed to meet specific internal requirements.

Dominik Kundel discussed the issue of 'approval fatigue,' where users often grant agents excessive full access privileges, especially during lengthy tasks.

To mitigate this, the system incorporates an 'auto review' sub-agent that operates in a read-only capacity.

This sub-agent evaluates proposed actions against user authorizations, predefined risk taxonomies, and the context of the task to assess potential security risks.

The system effectively differentiates between safe actions, such as testing network connectivity, and more precarious operations, like data exfiltration, by identifying harder-to-predict agent behaviors.

Dominik Kundel highlighted that as models like Codex Spark on Cerebras achieve inference speeds of 1,000 tokens per second, the primary bottleneck has shifted from model inference to network performance due to high-frequency tool calls.

To address this, the system transitions from traditional HTTP/Server-Sent Events to a WebSocket mode, establishing persistent, stateful connections.

This stateful context allows only modified data to be transmitted, substantially reducing payload sizes and mitigating network overhead.

The '/goal' command in the Codex harness enables continuous execution of tasks, where the harness injects a 'continuation prompt' containing the objective until the model signals task completion with an update goal tool.

Dominik Kundel explained that clear, verifiable prompts, rather than complex essays, help the agent identify when a task is finished, facilitating autonomous operation and reducing the need for constant human oversight.

To prevent context bloat in agents operating over extended periods, the Codex harness implements server-side auto-compaction.

This process, which can be triggered manually or automatically, transforms the previous context window into a condensed representation for subsequent turns, and the models are specifically trained with this compaction mechanism to maintain performance after history summarization.

This design allows developers to build their own agents using the API's capabilities, independent of the official harness, incorporating core functionalities like tool search, patch application, and compaction.