OpenAI's Codex Harness: Speed, Context, and Security

Dominik Kundel of OpenAI dives deep into the technical architecture behind Codex in a recent presentation. He reveals how the team tackled critical performance and security challenges as their models scaled. The discussion offers a rare glimpse into the engineering efforts that underpin advanced AI systems, moving beyond theoretical capabilities to practical, high-speed deployment.

The Network Bottleneck and Websocket Mode

As OpenAI's GPT 5.3 Codex Spark began serving a thousand tokens per second on Cerebras hardware, a new bottleneck emerged. Inference, once the primary concern, became less of an issue than the network itself. The solution, Kundel explains, was the adoption of websocket mode.

This persistent connection replaces traditional server-sent events over HTTP. Websocket mode carries stateful context, meaning only the tool call result is sent back per turn. This drastically reduces redundant data transfer, as the model no longer needs to resend every item in its context. This optimization is crucial for maintaining speed and efficiency at scale.

Context Construction: A Balancing Act

The pressure to optimize also shapes how context is constructed. This process is a complex fight involving size, flexibility, and cachability simultaneously. Kundel outlines specific strategies employed to manage this.

Tools can now be marked as 'deferred.' These tools do not enter the context window directly. Instead, they surface through tool search only when the model actually requires them. Furthermore, the list of available skills is capped at 2% of the context window. Descriptions for these skills are trimmed as the context window grows, ensuring efficiency.

Action Execution: Security and Sandboxing

The 'harness' plays a critical role in executing actions safely and effectively. File edits are handled through an 'apply patch' tool, a method the models were trained on. All other actions go through a shell, which the model instinctively drives using tools like ripgrep. Everything happens within a secure sandbox environment.

This sandboxing is implemented differently across operating systems. macOS uses seatbelt, Linux employs bubblewrap, and for Windows, the team developed a custom open-source sandbox. These measures are vital for preventing unintended or malicious actions.

Escalation and Auto-Review for Security

Kundel addresses the common issue of 'approval fatigue.' This often leads users to grant full access, a situation their security teams dislike. To mitigate this risk, OpenAI implemented an escalation process involving an auto-review subagent.

When an escalation occurs, this subagent spins up with read-only permissions and cannot spawn further agents. It judges the action against the conversation transcript and the explicitness of user authorization. For instance, deleting a file the user requested is viewed differently from deleting a .git folder the user never mentioned. This adds a layer of intelligent oversight.

Long Horizon Goals and Verifiable Objectives

For managing long-horizon goals, the system injects a 'continuation prompt' until the model calls an 'update goal' tool. This approach emphasizes the importance of concrete, verifiable objectives over vague essay-like instructions. Clear goals lead to more predictable and controllable outcomes.

The Harness: Open Source and Rust-Based

Dominik Kundel concludes by highlighting that the harness is open source, licensed under Apache 2. It is written in Rust, a language known for its performance and safety. Much of what makes the harness distinct is found within its responses API, making its components reusable for others.