Analyse: OpenAI hat das Gerüst open-sourced, nicht das Modell — und das ist die Strategie

There is a version of this story that reads as a routine open-source release, and a version that reads as OpenAI telling the market where it thinks the value in agents actually sits. The second one is closer.

On 20 August the company published the machinery behind Codex — the codex exec command line, the app-server execution service, and the Codex SDK — under Apache-2.0 in the openai/codex repository. The model did not move. Everything around the model did.

A harness is the part nobody demos

Vendors demo models. Teams ship harnesses.

The harness is the code that turns a text completion into work getting done. It decides what context the model sees on this turn, executes the tool calls the model asks for, streams results back as they happen, keeps a long session from overflowing its window, lets a person interrupt mid-run, and holds irreversible actions behind an approval gate.

Anyone who has taken an agent prototype into production has written some version of this, usually twice, usually badly the first time. That is what OpenAI has now standardised and given away.

If the model is the engine, the harness is the chassis, the gearbox and the brakes. Nobody buys a car by comparing engines alone, and the past two years of agent procurement have been almost exactly that.

The number everyone will quote

OpenAI reports that harness changes alone — retaining reasoning across steps and compressing context — moved the same model from 13.3% to 38.3% on ARC-AGI-3, alongside a roughly sixfold reduction in token consumption.

It is a striking figure, and it is worth being precise about what it does and does not say.

What it says: the scaffold is a first-class variable. A team that benchmarks two models through its own harness is measuring three things — two models and one scaffold — and is mostly reporting the scaffold. Published model scores without a published harness are, on this evidence, close to unreadable.

What it does not say: that the same margin is waiting in your product. A harness tuned against a benchmark is, in part, tuned to that benchmark, and a reasoning puzzle set is not a reconciliation queue.

The useful reading sits between the two. If you are getting poor results from a frontier model today, the prior should now be that your loop is wrong before your model is.

The licence is the announcement

Apache-2.0 is not a footnote here. It is the substance.

A copyleft licence would have made this harness unusable for exactly the customers the launch was built around — companies that want to compile it into a commercial product without publishing what they wrapped around it. Cisco runs the Codex SDK inside App Builder, part of Cisco Cloud Control. GitHub and JetBrains put the agent inside the editor a developer already has open, rather than in a separate window. Thrive Holdings and Crete built a tax-preparation workflow with practitioner review in the loop; reporting around the launch puts it at roughly 7,000 filings with preparation time down about a third.

None of those are chatbot deployments. All of them are the same agent loop wearing somebody else's interface.

And the part that is not open remains firmly shut: the model. Opening the layer that was going to be commoditised anyway, while the metered layer stays closed, is a well-worn shape — well-worn because it works. Every embedded harness is a client with a billing relationship attached.

The question moves from integration to permission

The Model Context Protocol already shifted much of the connector work from bespoke glue in every application to reusable servers maintained once. A standard, open harness moves most of what was left.

What remains is not a smaller problem. It is a different one, and it belongs to whoever owns the product rather than whoever owns the model:

• Scope. What is this agent permitted to do — read, write, spend, send, delete — and is that enforced in the runtime rather than requested in a prompt?
• Gates. Which actions require a person, and does that person see enough to actually judge, or are they clicking approve on a summary?
• Untrusted input. An agent that reads customer email, ticket bodies, web pages or pull request comments is reading attacker-controllable text. The mitigation is the permission boundary, not better instructions.
• Recall. After an incident, can you answer «what did it actually do» from a log, in front of an auditor?

An open harness forces those questions earlier, which is an improvement. It does not answer any of them.

Where it spreads, and where it stalls

The expectation attached to this release is that agents move out of developer tooling and into security, support, sales and marketing consoles. Much of that will happen, and its shape is predictable from what already worked.

The deployments that stick share cheap verification. Coding went first because tests deliver an automatic verdict. Tax preparation qualifies for the same reason: a return either reconciles or it does not, and a practitioner reviews the exceptions rather than the whole. Support triage, invoice reconciliation, evidence gathering — same family.

The ones that stall are the ones where a person has to read the entire output to know whether it is right. There the agent saved typing, not work, and no harness fixes that.

What we are watching

• Portability. Whether teams genuinely run non-OpenAI models through this loop, or whether the defaults quietly make it a distribution channel.
• Governance defaults. Approval gates, budgets and logging that ship on by default become the industry's floor. The ones that ship off by default become the industry's incident reports.
• Where standardisation lands next. Tool exposure standardised at MCP. Execution is standardising now. Permission and audit are the obvious next layer, and nobody has claimed them.
• The scoreboard. If a scaffold change is worth twenty-five points, benchmark tables need to start reporting the harness alongside the model, or stop being cited as model results.

The headline is that OpenAI open-sourced Codex's core. The more durable change is that «which model» became a smaller question than it was last week, and «what is it allowed to do» became a larger one.