OpenAI Acquires Ona to Give Codex Persistent Enterprise Agent Capabilities

Three core capabilities stand out:

• Persistent, cloud-based workspaces. Agents run inside secure cloud sandboxes that remain active even after a user closes their laptop. This decouples agent work from local hardware and enables long-running jobs like large-scale refactors, dependency updates, or multi-repository changes that simply aren't practical in a single session .
• Access to tools and context over time. Inside Ona environments, agents can securely access the project files, credentials, APIs, and runtime context they need to make autonomous progress. Users can then review the results, provide new instructions, and let the agent continue—without restarting from scratch each time .
• Orchestration for production-grade workflows. Ona’s platform handles the full agent lifecycle: provisioning isolated environments, running tasks, managing dependencies, and tearing down sandboxes when work is complete. This orchestration layer moves Codex from experimental, single-shot tasks to sustained, repeatable production workflows .

Enterprise Security and Infrastructure Benefits

For enterprise customers, the most significant shift is the control model. Ona’s architecture ensures that agents run inside the organization’s own cloud environment—on AWS or GCP, for example—rather than on OpenAI’s infrastructure. This keeps source code, credentials, and sensitive data within the customer’s existing security boundary .

Key security and governance features include:

• Scoped credentials and access controls. Agents are restricted to designated file system areas, encryption keys, and credentials, preventing overreach into sensitive parts of the network .
• Ephemeral, secure sandboxes. Environments are automatically deleted once a task is complete, dramatically reducing the risk of data exfiltration or residual access compared to persistent local environments .
• Activity logging and auditability. All agent actions are recorded, providing the detailed logs required for governance, compliance, and forensic review in regulated industries .
• Malware and obfuscation detection. Ona uses cryptographic hashing to identify and block malicious programs even if they have been renamed, moved, or embedded inside scripts .
• Outbound connection blocking. The platform can prevent agents from connecting to potentially malicious external servers, containing the blast radius of any unexpected behavior .

This customer-controlled execution model is particularly relevant for financial services, healthcare, and other regulated sectors that require strict data residency and access governance. Enterprises can deploy AI coding agents without re-architecting their security posture or moving sensitive data to a third-party cloud.

Executive Perspectives on Trust, Control, and Regulated Environments

Leadership from both companies framed the acquisition as a direct response to enterprise demands for governance and reliability.

Johannes Landgraf, Co-Founder and CEO of Ona, emphasized the importance of trusted infrastructure for AI agents:

“Agents need more than intelligence; they need a trusted workspace. We built Ona to give agents cloud environments with the context, control and collaboration enterprises require. Joining OpenAI lets us bring that foundation into Codex, helping organizations deploy agents with confidence and giving humans more agency over their work.”

Landgraf later added on LinkedIn that the acquisition felt less like an ending and more like the work becoming “bigger and more important” .

Thibault Sottiaux, Core Products Lead at OpenAI, focused on the operational requirements of enterprise AI deployment:

“Enterprises want powerful agents that can do real work while meeting the security and control requirements of their environments. Ona will help us make Codex easier to deploy securely across production workflows for customers operating at the highest standards of trust and scale.”

Both statements underscore a shared goal: making AI coding agents not just more capable, but auditable, governable, and safe enough for the most demanding enterprise environments.

What This Means for the Future of AI-Powered Development

The Ona acquisition signals a maturation in how AI coding tools are being positioned for the enterprise. Rather than competing solely on model intelligence or benchmark scores, the conversation is shifting toward execution infrastructure—where the agent runs, who controls the environment, and how work is audited. By embedding Ona’s secure runtime directly into Codex, OpenAI is building a foundation for autonomous software engineering that can operate continuously, safely, and inside the enterprise perimeter.