The renamed Gitpod sells cloud sandboxes with hash based executable detection, credential zone isolation, and outbound connection blocking. Terms of the deal were not disclosed.
When the developer's machine shuts down, the agent doesn't. That is the practical difference OpenAI is buying with its acquisition of Ona, the cloud-agent orchestration company formerly known as Gitpod, the company confirmed Wednesday.
OpenAI said it plans to acquire Ona to extend Codex into long-running tasks that can take hours or days, with humans able to check in and steer the agent mid-flight. The financial terms were not disclosed. Ona CEO Johannes Landgraf published a post on Wednesday confirming the deal and saying his team will join the Codex group.
The substance is in the runtime, not the press release. Ona sells cloud-based sandboxes that keep an agent executing after the developer's laptop is closed, with the OS-level isolation that implies. In an April post positioning the company as the build-versus-buy answer for background agents, Ona cited Ramp and Stripe as reference architectures for that pattern. The company's newsletter claims a reach of more than 440,000 engineers.
What makes the Ona stack distinctive is the security scaffolding wrapped around those long-lived sandboxes. SiliconANGLE, which detailed the deal on Wednesday, catalogs three layers: hash-based blocking of executables that survives renaming or relocation, filesystem access controls that wall off credential-bearing directories, and outbound-connection filtering to keep an agent from phoning home to suspect servers. Sandboxes are auto-deleted when no longer in use. For always-on agents, that combination is the safety case, not a footnote.
The deal is OpenAI's second agent-infrastructure acquisition in roughly three months, following the March purchase of Promptfoo for agent-platform cybersecurity on the OpenAI Frontier enterprise product. The pattern is consistent: a model lab buying the plumbing that turns a chat-shaped tool into a piece of infrastructure. Ona is officially Gitpod GmbH, so the engineering lineage is in developer environments, not a stealth wrapper. That lineage is the part that should reset a developer's priors on what the acquisition actually changes inside Codex.
That product now has scale. OpenAI says Codex has more than 5 million weekly users, a self-reported figure. This month the company also pushed Codex beyond code into non-technical work, including ad creative, a move that makes the runtime question more urgent: an agent writing ad copy that runs for 18 hours against a cloud filesystem is a different category of object than an agent pair-programming inside a terminal.
The unresolved questions are the ones that will decide whether this reads as an infrastructure upgrade or a lock-in move. Ona has existing customers, and OpenAI has not said what happens to them. It also has not said whether the cloud-sandbox capability will reach the broad Codex user base or stay gated to enterprise tiers. Both answers are likely to land in the closing weeks of integration.
What is on the record is the direction. OpenAI is treating agent execution as a runtime problem with a safety case, not a prompt problem. Buying the sandbox vendor is the simplest way to harden that runtime inside a product a developer already opens every day.