Quirin Schlegel

Loading

The harness moved house — OpenAI's Agents API is US-only, and the sandbox you host does not move it

OpenAI put the Agents API into public beta on 10 September 2026 — the Codex harness behind one call, with durable sessions, automatic context compaction, recovery and subagents, and eleven ways to choose where code executes: nine named sandbox partners, OpenAI's own sandbox, or your own infrastructure. The obvious reading is that the sandbox choice is the control, and OpenAI's own documentation corrects it: the Agents API supports data residency only in the United States, is not eligible for Zero Data Retention, and "choosing a self-hosted sandbox does not make the Agents API ZDR-eligible" — because the sandbox is the execution plane while the session, the compacted context and the artifacts belong to the endpoint. The split runs inside one vendor at endpoint level: the data controls page puts /v1/responses on the ZDR-eligible list and /v1/agents beside /v1/assistants and /v1/threads on the list that retains application state regardless, and eu.api.openai.com processes in-region while the Agents API has no European region at all. So the change a team books as a refactor is a third-country transfer, and it cannot be undone by a setting: OpenAI states that European residency can only be configured for new Projects and that existing Projects cannot be updated after creation. The instrument underneath it is Commission Implementing Decision (EU) 2023/1795, still in force — while the Supreme Court decided Trump v. Slaughter on 29 June 2026, ending for-cause removal protection for FTC Commissioners, and the EDPB wrote to the Commission on 31 July 2026 asking it to assess the consequences. The practitioner move is an inventory of Projects rather than of keys: every Project with the region it was created in, and every agent key mapped to a Project.

16 September 20268 verified claims7 sources

OpenAI just made the agent harness a product. It ships in one region, and it is not this one.

On 10 September the Agents API went into public beta — the Codex harness behind a single call. Sessions, orchestration, automatic context compaction, recovery, subagents. No extra fee; you pay for tokens and tools. You choose where code executes from eleven options: nine sandbox partners (Blaxel, Cloudflare, Daytona, DigitalOcean, E2B, Modal, Oracle, Runloop, Vercel), OpenAI's own sandbox, or your own infrastructure.

What this changes for anyone shipping agents in the EU:

1. Read the docs, not the launch post. OpenAI's Agents API guide says the Agents API "currently supports data residency only in the United States", and that it is not eligible for Zero Data Retention.

2. Self-hosting the sandbox does not fix it. Same page: "Choosing a self-hosted sandbox does not make the Agents API ZDR-eligible." The sandbox is the execution plane. The session, the compacted context and the artifacts are the control plane — and the control plane is the endpoint you called.

3. The split is inside one vendor, at endpoint level. OpenAI's data controls page lists /v1/responses as ZDR-eligible and puts /v1/agents on the other list, beside /v1/assistants and /v1/threads: endpoints that hold application state regardless of the setting. eu.api.openai.com processes in-region. The Agents API has no European region at all.

4. So the change everyone will book as a refactor is a transfer. And residency is decided when a Project is created — OpenAI's words: existing Projects cannot be updated to have European data residency after creation. The Project your prototype was born in is the one you are stuck with.

5. The adequacy decision underneath it is 2023/1795. The US Supreme Court decided Trump v. Slaughter on 29 June 2026, ending for-cause removal protection for FTC commissioners; the EDPB wrote to the Commission on 31 July asking it to assess the consequences. The decision is still in force. "Still" is carrying weight there.

My Monday: list every Project in the API dashboard with the region it was created in, then map each agent key to a Project rather than to the org. Half a day. It tells you whether your next agent is a refactor or a transfer.

Which one is yours?

#DSGVO #AIAct #AgenticAI #EUTech #Compliance

Evidence

What this rests on

Every factual claim in the edition above, stated on its own and checked before publication. If one of these is wrong, the argument is wrong — so they are listed where you can check them.

OpenAI put the Agents API into public beta on 10 September 2026, exposing the Codex harness behind a single API call with durable sessions, orchestration, automatic context compaction, recovery and subagents, at no additional fee beyond tokens and tools.
Why it mattersIt is the event the edition turns on, and it fixes the date from the primary actor's own announcement rather than from coverage.
openai2026introduci
Code called through the Agents API executes in an OpenAI-hosted sandbox, on self-hosted infrastructure, or in one of nine named partner sandbox environments: Blaxel, Cloudflare, Daytona, DigitalOcean, E2B, Modal, Oracle, Runloop and Vercel.
Why it mattersEleven execution options is the number every engineer will read as the control surface, which is exactly why the residency position lands where it does.
openai2026introduci
OpenAI's Agents API guide states that the Agents API currently supports data residency only in the United States and does not support Zero Data Retention.
Why it mattersIt decides whether an EU team can move an agent onto the endpoint at all, and it appears only in the documentation - the launch announcement is silent on residency and retention.
openaidevel2026agents · openaidevel2026your
OpenAI's Agents API guide states that choosing a self-hosted sandbox does not make the Agents API ZDR-eligible.
Why it mattersIt closes the obvious workaround: the sandbox is the execution plane, and the session, compacted context and artifacts sit with the endpoint regardless of where the code runs.
openaidevel2026agents
OpenAI's data controls documentation lists /v1/responses and /v1/chat/completions among the Zero Data Retention eligible endpoints and lists /v1/agents, alongside /v1/assistants and /v1/threads, among endpoints that retain application state regardless of ZDR settings; the EU region eu.api.openai.com offers in-region storage and processing.
Why it mattersIt shows the split is endpoint-level inside one vendor, so a team can be compliant on one call and transferring on the next without changing provider, contract or key.
openaidevel2026your
OpenAI states that API requests initiated through European-region Projects are handled in-region with zero data retention, and that European residency can only be configured for new Projects because existing Projects cannot be updated after creation.
Why it mattersIt turns the finding into a migration rather than a setting: the Project a prototype was created in cannot be moved to Europe later.
openai2025introduci
The Supreme Court of the United States decided Trump v. Slaughter, No. 25-332, on 29 June 2026, holding 6-3 that statutory restrictions on the President's power to remove Commissioners of the Federal Trade Commission are unconstitutional.
Why it mattersThe FTC is the supervisory authority that enforces Data Privacy Framework commitments, so its independence is an input to the adequacy assessment a US-only endpoint relies on.
supremecour2026trump
The European Data Protection Board wrote to the European Commission on 31 July 2026 asking it to closely assess the impact of Trump v. Slaughter on the FTC's ability to uphold its Data Privacy Framework commitments; Commission Implementing Decision (EU) 2023/1795 remains in force, no repeal or annulment being recorded as at 16 September 2026.
Why it mattersIt is the difference between an adequacy decision that is safe and one that is merely still standing, which is the honest thing to tell someone deciding where to run an agent this quarter.
iapp2026edpb · publication2023commissio

Sources

OpenAI Developers Documentationprimary source
Agents API guide - overview
Original Archived PDFretrieved 16 September 2026 · published 10 September 2026
Publications Office of the European Unionprimary source
Commission Implementing Decision (EU) 2023-1795 - EU-US Data
Original Archived PDFretrieved 16 September 2026 · published 10 July 2023
IAPPsecondary
EDPB requests review of EU-US Data Privacy Framework followi
Original Archived PDFretrieved 16 September 2026 · published 3 August 2026
OpenAIprimary source
Introducing data residency in Europe
Original Archived PDFretrieved 16 September 2026 · published 5 February 2025
OpenAIprimary source
Introducing the Agents API
Original Archived PDFretrieved 16 September 2026 · published 10 September 2026
Supreme Court of the United Statesprimary source
Trump v. Slaughter, No. 25-332, slip opinion
Original Archived PDFretrieved 16 September 2026 · published 29 June 2026
OpenAI Developers Documentationprimary source
Your data - data controls in the OpenAI platform
Original Archived PDFretrieved 16 September 2026

Every source for this edition, as one PDF BibTeX — all editions

Corrections

What changed after publication

None.