OpenAI buys the sandbox layer

OpenAI announced this morning that it is acquiring Ona, a Berlin and San Francisco startup that builds isolated cloud environments for AI agents to run in. Terms were not disclosed. Ona's team folds into the Codex organisation. This is the second coding-infrastructure acquisition OpenAI has made in six weeks, after the roughly $3bn Windsurf-via-io deal in May, and the structural read is that OpenAI is buying its way to enterprise-grade agent execution rather than building it.

What was actually announced. OpenAI's blog post says Ona "builds secure, pre-configured environments that give AI agents a persistent place to work — across sessions, across devices, and under customer control." ¹ The phrase doing the heavy lifting there is customer control. Bloomberg frames the deal as part of OpenAI's push "to expand its AI agents into enterprise software workflows." ² CNBC notes it is intended "to support its AI coding assistant, Codex." ³ No financial terms, no close date, regulatory approvals pending.

What Ona actually does. It runs sandboxes — isolated, pre-configured cloud environments where an agent can execute code, hold state across tasks, and operate inside the customer's own cloud tenant rather than OpenAI's. The neutral description is that Ona lets a Codex agent live inside an enterprise's AWS or GCP account, with policy enforcement and audit logging attached. That is the missing layer between "Codex finishes a task in a session" and "Codex is a junior engineer your compliance team will sign off on."

The structural frame

The frame that fits cleanly here is enterprise deployment structure — what I'd call the FDE problem (Forward Deployed Engineering, the Palantir-derived model where vendor capability has to land inside the customer's environment, on the customer's data, under the customer's controls). For regulated buyers, banks, defence primes, healthcare systems, pharma, an agent that runs on OpenAI's infrastructure and touches the customer's code is a non-starter. Procurement won't sign. Data residency rules won't allow it. The audit trail doesn't exist.

Codex has, per OpenAI, 5 million weekly active users. ¹ That is a usage figure, not a revenue figure, and the gap between those two numbers is the gap Ona is meant to close. Five million developers using a coding assistant is distribution. Converting any meaningful slice of that into enterprise annual contract value (ACV, the yearly revenue from a single customer contract) requires that the product be deployable inside customer-controlled environments. Ona is the unlock for that conversion.

The arms-race read

The other available frame is competitive: OpenAI is closing a gap with Anthropic's Claude Code, which has held the agentic-coding benchmark since early 2026 and which already operates with persistent context and deeper environment integration. On this read, Ona is reactive infrastructure — bought because the alternative was watching enterprise coding deals go to Anthropic while Codex agents kept losing state at the end of every session.

I think both frames are right and they don't contradict each other. Closing the persistence gap with Claude Code and unlocking enterprise procurement are the same project. The interesting question is which one OpenAI thinks is binding. The fact that they bought rather than built suggests the timeline matters more than the architecture — you build when you have time to get it right, you buy when a competitor is taking deals you can't afford to lose.

What the undisclosed price tells us

Windsurf-via-io closed at roughly $3bn for a product with users and market share. ³ Ona is undisclosed, team-integrated, no public ARR (annual recurring revenue — the run-rate of subscription revenue), no disclosed funding history. The shape of that disclosure pattern is acqui-hire: a team-and-architecture buy priced in low tens of millions, possibly less, where what OpenAI is paying for is the engineers who know how to wire agent runtimes to sandboxed cloud execution, plus a working implementation that saves nine months of internal build.

That is not a criticism. Acqui-hires of specialist infrastructure teams are often the highest-IRR (internal rate of return) deals a large platform can do, because the alternative is a year of internal recruiting and architectural debate to arrive at the same place. But it does say something about how OpenAI is valuing the sandbox layer itself: not as a defensible moat, but as table-stakes infrastructure that needs to exist under Codex and isn't worth waiting for.

Where the frame breaks

The contrarian read is that agent sandboxes are a commodity. E2B, Modal, Daytona and the hyperscalers themselves have been shipping isolated cloud execution for AI agents for eighteen months or more. AWS will sell you a sandboxed environment with audit logging this afternoon. If the layer is commodity, what OpenAI is buying is integration knowledge, how to make sandboxes feel native to an agent runtime, and that is a thinner moat than the announcement implies.

I think this read is partially right and partially misses the point. The sandbox primitive is commodity. The integration of sandbox-as-customer-controlled-execution-environment with a specific agent product, sold to a specific procurement function, is not. Palantir's whole business is built on the observation that the underlying compute is commodity but the deployment structure isn't. Ona is OpenAI buying the deployment structure for Codex.

What this is a case of

It is a case of large model labs realising, late, that the binding constraint on enterprise agent revenue is not model capability but execution environment. Anthropic has been further along here for product reasons. Google has it by default because GCP is the execution environment. OpenAI doesn't, and is buying its way to parity in two deals across two months.

It is also a case of the M&A-as-build-substitute pattern hardening. Windsurf-via-io for the IDE layer. Ona for the execution layer. Both absorbed into Codex, both undisclosed or partially disclosed on terms, both team-integrated rather than maintained as standalone products. That is a deliberate vertical-integration (a company owning multiple stages of its supply chain) move, executed through acquisition because the clock is the constraint.

What to watch

Three things. First, whether Codex's next enterprise pricing tier, if one materialises in the next two quarters, discloses seat counts or ACV, which would tell us whether the 5 million WAU figure is converting. Second, whether OpenAI announces a third coding-infrastructure deal before year-end, which would confirm the pattern. Third, whether European regulatory review on Ona slips the integration into 2027; Berlin base, agentic AI, OpenAI acquirer is exactly the file that gets opened.

Footnotes

¶