# OpenAI's Codex Harness: Speed, Context, and Security _OpenAI's Dominik Kundel details the Codex harness's technical innovations, from websocket mode to advanced security measures._ **Published:** 2026-08-08 **Source:** https://www.startuphub.ai/ai-news/ai-research/2026/openai-s-codex-harness-speed-context-and-security --- Dominik Kundel of OpenAI dives deep into the technical architecture behind Codex in a recent presentation. He reveals how the team tackled critical performance and security challenges as their models scaled. The discussion offers a rare glimpse into the engineering efforts that underpin advanced AI systems, moving beyond theoretical capabilities to practical, high-speed deployment. Codex Scaling BottleneckDriver inference less of an issue than network itself with 1000 tokens/secondFrom the articleAs OpenAI's GPT 5.3 Codex Spark began serving a thousand tokens per second on Cerebras hardware, a new bottleneck emerged.solved byWebsocket ModeCorepersistent connection replaces HTTP, drastically reducing redundant data transfer for contextFrom the article 2 mentionsThe solution, Kundel explains, was the adoption of websocket mode.enablesStateful ContextEffectonly tool call result sent back per turn, model avoids resending every itemFrom the article 6 mentionsWebsocket mode carries stateful context, meaning only the tool call result is sent back per turn.leads toEnhanced PerformanceOutcomewebsocket mode and stateful context enable high-speed, practical AI deploymentFrom the article 2 mentionsHe reveals how the team tackled critical performance and security challenges as their models scaled.requiresSecurity SandboxingCoreaction execution uses secure sandboxing to prevent unauthorized access or malicious activityFrom the article 3 mentionsThis sandboxing is implemented differently across operating systems. macOS uses seatbelt, Linux employs bubblewrap, and for Windows, the team developed a custom open-source sandbox.Auto-Review EscalationEffectsystem flags suspicious actions for human review, ensuring robust security measuresFrom the article 2 mentionsTo mitigate this risk, OpenAI implemented an escalation process involving an auto-review subagent.Open Source HarnessCoreCodex harness built in Rust, providing transparency and community contribution opportunitiesFrom the articleDominik Kundel concludes by highlighting that the harness is open source, licensed under Apache 2.contributes toVerifiable ObjectivesContextlong-horizon goals focus on measurable, auditable outcomes for AI safety and reliabilityFrom the articleThis approach emphasizes the importance of concrete, verifiable objectives over vague essay-like instructions. ## The Network Bottleneck and Websocket Mode As OpenAI's GPT 5.3 Codex Spark began serving a thousand tokens per second on Cerebras hardware, a new bottleneck emerged. Inference, once the primary concern, became less of an issue than the network itself. The solution, Kundel explains, was the adoption of websocket mode. This persistent connection replaces traditional server-sent events over HTTP. Websocket mode carries stateful context, meaning only the tool call result is sent back per turn. This drastically reduces redundant data transfer, as the model no longer needs to resend every item in its context. This optimization is crucial for maintaining speed and efficiency at scale. ## Context Construction: A Balancing Act The pressure to optimize also shapes how context is constructed. This process is a complex fight involving size, flexibility, and cachability simultaneously. Kundel outlines specific strategies employed to manage this. Tools can now be marked as 'deferred.' These tools do not enter the context window directly. Instead, they surface through tool search only when the model actually requires them. Furthermore, the list of available skills is capped at 2% of the context window. Descriptions for these skills are trimmed as the context window grows, ensuring efficiency. ## Action Execution: Security and Sandboxing The 'harness' plays a critical role in executing actions safely and effectively. File edits are handled through an 'apply patch' tool, a method the models were trained on. All other actions go through a shell, which the model instinctively drives using tools like ripgrep. Everything happens within a secure sandbox environment. This sandboxing is implemented differently across operating systems. macOS uses seatbelt, Linux employs bubblewrap, and for Windows, the team developed a custom open-source sandbox. These measures are vital for preventing unintended or malicious actions. ## Escalation and Auto-Review for Security Kundel addresses the common issue of 'approval fatigue.' This often leads users to grant full access, a situation their security teams dislike. To mitigate this risk, OpenAI implemented an escalation process involving an auto-review subagent. When an escalation occurs, this subagent spins up with read-only permissions and cannot spawn further agents. It judges the action against the conversation transcript and the explicitness of user authorization. For instance, deleting a file the user requested is viewed differently from deleting a .git folder the user never mentioned. This adds a layer of intelligent oversight. ## Long Horizon Goals and Verifiable Objectives For managing long-horizon goals, the system injects a 'continuation prompt' until the model calls an 'update goal' tool. This approach emphasizes the importance of concrete, verifiable objectives over vague essay-like instructions. Clear goals lead to more predictable and controllable outcomes. ## The Harness: Open Source and Rust-Based Dominik Kundel concludes by highlighting that the harness is open source, licensed under Apache 2. It is written in Rust, a language known for its performance and safety. Much of what makes the harness distinct is found within its responses API, making its components reusable for others. --- Original analysis from [startuphub.ai](https://www.startuphub.ai), the #1 AI startup directory.