---
type: "post"
id: "securing-persistent-agents-like-openclaw-at-openai-0fdd67"
slug: "securing-persistent-agents-like-openclaw-at-openai-0fdd67"
title: "Securing persistent agents like OpenClaw at OpenAI"
description: "OpenAI says it runs more than 500 persistent OpenClaw agents across the company and describes the controls used to contain them: separate trusted infrastructure from agent execution, restrict permissions, review actions with another model, assign distinct identities and lock down logs."
retrieval_nugget: "OpenAI says it runs more than 500 persistent OpenClaw agents across the company and describes the controls used to contain them: separate trusted infrastructure from agent execution, restrict permissions, review actions with another model, assign distinct identities and lock down logs. The account gives builders a concrete security architecture for agents that act continuously without a person steering every step."
published_at: "2026-11-13"
updated_at: "2026-11-13"
record_date: "2026-11-13"
date_kind: "published_at"
topics: ["codex"]
entities: ["OpenAI","OpenClaw","Codex","OpenClaw Enterprise","ChatGPT Service Accounts","WAG","XAA"]
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
novelty_label: "new_fact"
what_changed: null
prior_refs: []
source_url: "https://developers.openai.com/blog/securing-persistent-agents-like-openclaw-at-openai"
source_urls: ["https://developers.openai.com/blog/securing-persistent-agents-like-openclaw-at-openai"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:securing-persistent-agents-like-openclaw-at-openai-0fdd67"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/securing-persistent-agents-like-openclaw-at-openai-0fdd67/","markdown":"https://newruntime.com/posts/securing-persistent-agents-like-openclaw-at-openai-0fdd67.md","json":"https://newruntime.com/posts/securing-persistent-agents-like-openclaw-at-openai-0fdd67.json"}
markdown_url: "https://newruntime.com/posts/securing-persistent-agents-like-openclaw-at-openai-0fdd67.md"
---

# Securing persistent agents like OpenClaw at OpenAI

## Retrieval answer

OpenAI says it runs more than 500 persistent OpenClaw agents across the company and describes the controls used to contain them: separate trusted infrastructure from agent execution, restrict permissions, review actions with another model, assign distinct identities and lock down logs. The account gives builders a concrete security architecture for agents that act continuously without a person steering every step.

## Summary

OpenAI says it runs more than 500 persistent OpenClaw agents across the company and describes the controls used to contain them: separate trusted infrastructure from agent execution, restrict permissions, review actions with another model, assign distinct identities and lock down logs. The account gives builders a concrete security architecture for agents that act continuously without a person steering every step.

## What happened

OpenAI’s developer blog describes persistent agents as systems that run 24/7, operate with broad goals and can act proactively without user input, unlike Codex sessions built around a fixed goal and human steering. OpenAI says it has deployed these agents across the company, including hundreds of OpenClaw agents. It later reports that more than 500 agents are running proactively in the background, doing work such as opening pull requests in response to product feedback and continuously running data experiments on new features.

The first design choice is to separate trusted, deterministic components—networking, identity and sandboxing—from untrusted model execution, the agent’s environment and code it writes. OpenAI implemented remote harness execution in the open-source OpenClaw project so the OpenClaw Gateway runs in a separate container from the agent harness; at OpenAI, the two also run in separate clusters. The company treats the gateway that configures agents as trusted code and the agent workload as untrusted.

OpenAI says it limits agent actions through sandbox controls. Its deployment uses an organization-managed network allowlist and explicit denials, restricts file writes to agent working directories, uses process isolation from the Codex Linux sandbox and keeps secrets behind a credential broker. Its example Codex configuration allows only read-only and workspace-write sandbox modes, requires the managed network proxy and limits destinations to specified hosts such as GitHub domains. It blocks destinations including pastebin, webhook.site and cloud metadata endpoints. Cached hosted search is allowed, but live hosted search and the unrestricted `danger-full-access` mode are not. The example also denies access to an SSH directory, disables apps unless individually enabled, and disables destructive and open-world app operations by default. OpenAI notes that excluding credentials from command environments does not hide credentials stored in files the agent can access.

Static restrictions are paired with model-based review. OpenAI says it enforces Auto-review on every OpenClaw agent action: a second agent monitors and approves the primary agent’s actions. The company argues that requiring human review for every action can cause fatigue and blind acceptance of prompts, so model review can filter actions and reserve human attention for higher-value approvals. Each agent also has a unique identity associated with a ChatGPT Service Account, including its own inference credential, separate from the user’s. This supports auditing, connecting custom plugins and disabling inference if needed. OpenAI logs every control-plane configuration change and agent turn, but limits access to those potentially sensitive logs to a small number of security-team members.

## What the archive adds

This is a new deployment account, not a restatement of New Runtime’s earlier coverage of OpenAI hardening its internal frontier-model training and evaluation environments on [October 24, 2026](https://newruntime.com/posts/over-the-past-several-months-we-have-substantially-7f9243/). The earlier note concerned research infrastructure; this one details controls for persistent agents in company workflows.

## Trend signal

This supports [agent security moving to runtime boundaries](https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries/): OpenAI’s account centers on network, filesystem and process isolation, secret handling, identity and auditing rather than relying on instructions to the model. Auto-review adds a model-based layer, but the architecture still constrains what an agent can reach and do.

## Why now

OpenAI says persistent agents remain early in their adoption curve and that the lack of established practices makes enterprise deployment difficult. Its own account of operating more than 500 agents, alongside a pilot-stage control plane, is an attempt to make those practices concrete while adoption is expanding.

## Connections to other events

New Runtime’s earlier coverage of [Uber’s defense-in-depth lessons for AI agents](https://newruntime.com/posts/securing-ai-agents-lessons-from-real-world-deployment-bbe57a/) described risks including prompt injection, tool and memory poisoning, and goal hijacking. OpenAI’s new account meets that concern at the execution layer: it outlines controls on permissions, identity and network access for agents that can take actions over time.

## Why it matters

Persistent agents change the operating assumption for teams: an agent may continue acting after the prompt that started it, change configuration or write code, and encounter untrusted inputs along the way. OpenAI’s architecture offers a practical separation of concerns. Keep the control plane and authorization logic in deterministic services; treat generated code and agent environments as untrusted; grant bounded access through sandbox and network policy; and make actions attributable to a distinct identity.

The account also makes clear that controls must be layered. A model reviewer can filter routine actions, but it does not replace hard limits on files, processes, network destinations or secrets. Likewise, logs are useful only if they support investigation without becoming broadly accessible stores of sensitive conversations. Teams can use the configuration examples as a starting point, but should adapt allowlists, workspace permissions and review thresholds to each workload rather than copy them wholesale.

## Limits and uncertainty

OpenAI reports a “huge jump” in productivity and adoption during its internal pilot, but gives no measured productivity figures, comparison group or evaluation method. The blog does not report incident rates, false approvals or blocks, reviewer accuracy, operational cost, or how the controls perform under attack. It describes OpenAI’s implementation rather than an independently audited assessment. OpenAI says OpenClaw Enterprise is still in pilot and plans a 1.0 release by year-end; the account does not establish when that release will ship or which safeguards will be generally available.

## Skill to build now

Map one agent’s permissions before expanding its autonomy. List the specific destinations, directories, processes and credentials it needs; deny everything else by default; and give it an identity that can be audited and revoked independently of a human user. Then test whether the logs let a security reviewer reconstruct what changed and what the agent did without making sensitive turns broadly visible.

## Reader takeaway

OpenAI’s main operational lesson is that persistent agents need enforceable boundaries around execution, permissions, identity and audit—not just better prompts. Treat generated code and agent environments as untrusted, use model review as an additional filter, and keep human attention for consequential decisions.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Codex](https://newruntime.com/topics/codex.md): Explore the codex topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Sources](https://newruntime.com/sources/): See the original sources this archive cites.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)