Building an agent that works in a demo is one thing. Building one that runs reliably for hours, handles ambiguous permissions, searches a hundred tools without choking on context, and still feels fast — that is a different engineering problem entirely. OpenAI’s Codex team has spent serious time on it, and because the harness is now open source, the decisions they made are available to anyone who wants to look.
What follows is a tour of the most instructive choices.
Context is an engineering problem, not a prompt problem
The instinct when building agents is to stuff every tool, every skill, and every instruction into the system prompt. Codex took the opposite view.
The harness separates context into stable and variable parts. Model instructions — the things that rarely change — are kept stable so they land in the model’s cache (a cache is a saved computation: if the same text has been processed before, the model skips reprocessing it, which saves both time and cost). The variable parts — tool definitions from connected services and available skills — are kept lean.
Skills in particular are capped at two percent of the total context window. As more skills are added, descriptions compress. And tools that are not needed right away are not included at all: they are marked as deferred and loaded on demand when the model searches for them. The Responses API — OpenAI’s protocol layer for agentic interactions — has supported this tool-search capability since GPT-5.4.
The practical lesson is that context is a resource to be managed, not a scratchpad to fill.
The approval-fatigue trap, and how to escape it
Any agent with real file system or network access runs into the same problem: full access is dangerous, but constant approval prompts train users to click through without reading. That defeats the purpose of asking.
Codex addresses this with an auto-review subagent — a separate, read-only agent that is spun up when an action would normally require human escalation. It receives the full conversation transcript, a risk taxonomy, the user’s stated authorization level, and the specific tool calls in question. It then judges whether the action is safe to approve automatically.
The logic is contextual rather than rule-based. Deleting a file the user explicitly asked to delete: fine. Deleting the version-control history directory without being asked: not fine. Network calls follow the same pattern — fetching a URL is treated differently from uploading a file to an external service.
This approach keeps sandboxing meaningful without turning every agentic run into an approval queue.
From click-by-click to scripted interaction
Early approaches to browser and computer use sent one action at a time: click here, type there, take a screenshot, decide what to do next. It works, but it is slow and brittle.
Codex moved to code execution as the primary interaction mode. The agent has a persistent Node.js environment with a Chromium instance attached. It writes Playwright-style JavaScript across turns — meaning it can examine a page structure once and then script bulk operations across dozens of similar pages without pausing to re-inspect each one. The shift from action-by-action to scripted interaction is significant: it trades fragility for leverage.
The same principle applies to file system work. Recent models are trained on an `apply_patch` tool — a structured diff format (the same kind developers use to represent code changes) for editing files — and on Ripgrep for search, which the harness ships automatically if it is not already installed.
When inference is no longer the bottleneck
Running GPT-5.3 on Cerebras hardware at a thousand tokens per second surfaced an unexpected constraint: the network round trip between the model and the harness was slower than the model itself. Every agentic turn requires sending the accumulated context back to the API, and with long transcripts that overhead adds up.
The fix was WebSocket mode: a persistent connection that sends only the delta on each turn rather than re-transmitting the full context. For long agentic sessions this makes a measurable difference.
For very long sessions — hours or days — the harness also supports auto-compaction: the transcript is periodically summarized into a compact context item that preserves all the information needed to continue without carrying the full history forward. The model was trained on this compaction format, so performance does not degrade after a compaction event.
The reusable layer
Most of what makes Codex distinctive is not exclusive to Codex. Tool search, apply_patch, WebSocket mode, server-side compaction — these are all features of the Responses API, and they are available to anyone building on it. The harness itself is open source under MIT and Apache 2 licenses.
The more interesting question is what the next generation of harnesses will look like as these building blocks become standard infrastructure. The engineering surface is well understood now; what remains is deciding what to build on top of it.
Text summarized and optimized using Anthropic’s models and reviewed by a human.