How OpenAI Secures Persistent Agents Like OpenClaw

Posted on by
Contents show
persistent agents

Traditional software security assumes the code is deterministic and the threat comes from outside. Persistent agents break both assumptions at once. An agent that runs around the clock, writes its own code, and acts without waiting for user input can change its own configuration, and the attack that matters is not an external hacker but the agent taking a misaligned action from the inside. OpenAI now runs persistent agents across its entire company, including hundreds of OpenClaw agents, and has published the control set that makes that deployment survivable: trusted and untrusted execution split apart, hard sandbox boundaries, model based review, agent identity separated from user identity, and total observability. The details are specific enough to copy, down to the config file entries that block cloud metadata endpoints, and they amount to the first complete published playbook for securing persistent agents in production. This article walks through all five controls, what each one actually prevents, and what the new OpenClaw Enterprise control plane packages for everyone else. This article walks through all five controls, what each one actually prevents, and what the new OpenClaw Enterprise control plane packages for everyone else.

Why persistent agents break the old model

Security teams have spent decades building playbooks for a world where code is deterministic and threats come from outside, and persistent agents invalidate both premises at the same time. That is why the controls below look less like a firewall checklist and more like a redesign of how software is allowed to act.

A regular Codex session has a fixed goal and a human steering every step. A persistent agent runs 24/7 with broad scope and the ability to take proactive action with no user input in the loop. That difference is the entire security problem. When a human approves every action, the human is the security boundary. When persistent agents act on their own schedule, the boundary has to be built into the environment.

The threat model inverts too. Conventional infrastructure hardening defends against external attackers poking at a deterministic surface. An agent environment contains a component that generates arbitrary code at runtime with no hard guarantees on behavior, and the code it writes is treated as untrusted even though the agent itself is the thing being attacked or misused. Misalignment, prompt injection delivered through content the agent reads, and plain configuration drift all produce the same result: the persistent agent does something nobody intended, with real credentials.

Deployment reality has outrun the security playbook. OpenAI notes that real world deployment of persistent agents has been limited to date largely because no established best practices exist, which is exactly why the company published its internal control set rather than keeping it quiet. The scale is notable on its own: more than 500 agents now run proactively in the background at OpenAI, opening pull requests in response to product feedback and running continuous data experiments on new features. Securing persistent agents at that scale with conventional tooling would mean hundreds of shared accounts and unread logs, which is precisely the mess the five controls exist to prevent. Teams evaluating the space will find adjacent context in Sailboxes' approach to persistent agent compute, which tackles the infrastructure side of the same problem.

Separate trusted and untrusted execution

The first control is architectural. OpenAI splits the stack into trusted deterministic logic, meaning networking, identity, and sandboxing components that behave as configured outside of software bugs, and untrusted execution, meaning the agent, the environment it runs in, and every line of code it writes. For persistent agents, this split is the foundation everything else stands on. The split is not conceptual; it is physical. OpenAI implemented remote harness execution in the open source OpenClaw project, which lets the OpenClaw Gateway run in a separate container, and in OpenAI's case a separate cluster, from the agent harness.

The gateway is the component that configures the agent, and by moving it into the trusted zone, the security team can concentrate sandboxing effort on the workload where nothing can be trusted. The practical benefit shows up in blast radius. If a persistent agent is compromised or misbehaves, the gateway that holds its configuration, credentials, and network policy is not in the same process, container, or even network segment as the code the agent generated. An attacker or a runaway loop that owns the harness still has to defeat a separate boundary to reach the control plane.

For teams implementing this without OpenClaw, the pattern translates directly: configuration service, credential broker, and policy enforcement run as conventional infrastructure with code review and change control, while everything the model touches executes in disposable environments with no standing access to the configuration layer. Persistent agents deployed without this split end up governing themselves, which is the failure every other control assumes will not happen. The same separation logic appeared earlier in the Orca workspace model for coding agents, where agent worktrees were isolated from the systems that govern them.

Enforce hard security boundaries

Sandboxing does the enforcement work for persistent agents, and OpenAI's deployment applies four categories of limits to its persistent agents: network, workspace, process, and secrets. Network access runs through an organization managed allowlist with explicit denials for restricted endpoints. Workspace writes are confined to the agent's working directories. Process isolation comes from the Codex Linux sandbox. Secrets never appear in the agent's environment, because a credential broker manages them outside the agent's view.

The published config fragments are unusually concrete, and the details carry the lesson. In requirements.toml, the deployment excludes the unrestricted danger-full-access sandbox mode entirely, allowing only read-only and workspace-write modes. Web search is limited to cached mode, which routes search queries through OpenAI's own index rather than letting the agent fetch arbitrary live pages. The network proxy is mandatory, user level configuration cannot expand the domain allowlist, and the allowed domains list for this workload contains exactly three entries: github.com, api.github.com, and codeload.github.com. The denied list is where most deployments stop being serious: pastebin.com and its subdomains, webhook.site, the Google Cloud metadata endpoint metadata.google.internal, and the link local address 169.254.169.254 that every cloud uses for instance credentials. Blocking exfiltration channels and metadata endpoints explicitly is what stops a compromised persistent agent from turning its partial access into full credential theft.

In config.toml, the filesystem rules allow read on the minimal runtime paths, write only on the agent workspaces directory, read on managed read-only assets, and an explicit deny on the .ssh directory. The network section disables upstream proxy inheritance, the SOCKS5 listener, SOCKS5 UDP, non-loopback proxy listeners, and unrestricted Unix socket access. The shell environment policy strips GitHub tokens and OpenClaw basic auth variables from agent command environments. Apps are disabled by default, with destructive and open-world app operations separately disabled. Every one of those lines closes a specific escape hatch that agents have historically found, which is what makes this list worth copying rather than admiring, and together the two files define what persistent agents deployed on Codex presets are physically able to do.

Add model-based safeguards

Static controls share one weakness: they are written before the misaligned action exists. OpenAI's answer is Auto-review, a control built for persistent agents specifically, where a second agent monitors and approves the actions of the primary agent. For deployments of persistent agents, this is the control that adapts as fast as the threat does. The reasoning is grounded in human factors as much as security: constant human review creates review fatigue, and humans trained to blindly accept permission prompts become the weakest part of the pipeline. An LLM based reviewer as a filter reserves human attention for the high value approvals that genuinely need judgment.

The deployment enforces auto review on all agent actions, not a sampled subset, and the capability is natively supported in both OpenClaw and Codex. The reviewer model sees the proposed action in context and can block it before execution, which converts the security posture from detect and respond to prevent by default. In deployments of persistent agents at scale, that shift from sampling to full coverage is the difference between catching a slow data exfiltration and discovering it in a quarterly audit.

The deployment enforces auto review on all agent actions, not a sampled subset, and the capability is natively supported in both OpenClaw and Codex. The reviewer model sees the proposed action in context and can block it before execution, which converts the security posture from detect and respond to prevent by default. The economics work because model inference for review is cheap relative to the cost of a bad action reaching production, and the human escalation path stays available for the cases the reviewer flags as genuinely novel. For persistent agents that act dozens of times per hour, that filtering is not optional; no security team can review every action at that rate.

Model based defense scales with compute in a way static policy cannot, and OpenAI is explicit about the trajectory: as models get smarter, defenses that also use models are the ones that keep pace. A secondary model watching a primary model is the same pattern the security industry uses for insider threat analytics, applied to software that genuinely is an insider, and it is what lets persistent agents keep broad scope without broad risk.

Split agent identity from user identity

When an agent acts, three questions need answers: what did it do, what was it allowed to touch, and did the human or the agent initiate the action. Agent identity exists to answer all three, and OpenAI separates it rigorously from user identity. Every OpenClaw agent carries a unique identity associated with a ChatGPT Service Account, which gives the agent its own inference credential independent of any user, allows teams to connect custom plugins to the agent directly, and lets auditors distinguish agent initiated actions from human ones in the log. It also gives operations a precise kill switch: if an agent misbehaves, its inference can be turned off without touching any human's account. Without this separation, securing persistent agents is impossible, because the audit log cannot say who did what.

The emerging standards landscape matters for anyone building this now. WAG is a specification giving agents their own access to resources, while XAA lets agents act on behalf of a user through OAuth delegation. OpenAI draws a sharp distinction between agent identity and service accounts, which provide separate API access for bots: the two should be used together, with the agent acting under its own identity and reaching third party services through service accounts linked to that identity. The composite gives you attribution and scope at the same time, and the audit trail becomes an accurate record rather than a shared account mess that security teams routinely inherit. For teams deploying persistent agents in regulated environments, the identity layer is also what makes compliance review possible at all, because every action carries a verifiable actor. The proactive coding agent space is converging on the same requirement, as seen in DSH Superagent's design for proactive coding work, where scoped credentials and auditability are product features rather than afterthoughts.

Observe everything

The final control is comprehensiveness of logging across the full lifecycle of persistent agents, from how the agent was configured to every action it took. OpenAI's deployment logs every configuration change on the control plane and all turns from its persistent agents, because tracing and detecting misaligned actions after the fact requires the complete record. The privacy handling is deliberate: agent turns can contain sensitive information, so those logs are locked down and available only to a select few individuals on the security team.

Observability converts the other four controls from policies into measurable systems. Sandbox violations that were caught, auto-review blocks that fired, identity mismatches, and configuration drift all become queryable events. Without the log, a security team learns about a misaligned persistent agent from the damage; with it, the team can reconstruct intent, scope, and timeline, and tune the reviewer and the sandbox rules from real incidents rather than imagined ones.

The operational cost is real: full turn logging at hundreds of agents generates serious volume, and the access restriction means the security team carries a review burden. OpenAI treats that as the price of running persistent agents with broad scope, and the alternative, sampling or truncating logs, is what leaves post incident review with gaps exactly when they matter most.

What the five controls cost in practice

Adopting this control set is not free, and teams planning a deployment should budget for the overhead honestly. The execution split means running and monitoring two environments instead of one, plus the network discipline to keep them apart. The sandbox configuration is exacting work: every allowlist entry is a decision that gets revisited when a workflow changes, and the denylist needs maintenance as new exfiltration channels appear. Auto-review adds inference cost to every action and introduces its own failure modes when the reviewer is wrong in either direction. Identity separation requires an identity provider setup that most startups have not built yet, and full turn logging grows storage and review load linearly with agent count.

The return side of the ledger is what the OpenAI pilot numbers describe. More than 500 agents doing meaningful background work, adopted by technical and non-technical teams alike, is adoption that conventional permission prompt security would have strangled. The five controls buy the right to run persistent agents with broad scope at all, and the teams that skip them usually discover the gap through an incident rather than a review. The pragmatic starting point for most organizations is to implement the controls in order, beginning with the execution split and sandbox boundaries, adding identity and observability before scaling past a handful of agents, and turning on model based review once the volume of actions makes human review of everything impossible.

OpenClaw Enterprise packages the controls

At Dev Day, OpenAI announced OpenClaw Enterprise, an open source, vendor neutral agent control plane that bundles many of these safeguards for everyone else deploying persistent agents. Launching an agent with the standard Codex preset in OCE provides the sandbox modes, network policy, cached search restriction, and auto-review defaults drawn from the deployment described here. The project is in a pilot phase now, with a 1.0 release planned by the end of the year.

For teams that do not want to assemble the five controls themselves, OCE is the reference implementation path: the config semantics in this article are the same ones the control plane enforces. For teams that must build on different harnesses, the five controls form a checklist that transfers to any deployment of persistent agents: execution split, hard boundaries, model based review, identity separation, and full observability. OpenAI's closing assessment is that enterprise adoption of persistent agents is bottlenecked on the lack of established best practices, and publishing the control set is an attempt to unblock it. The company believes many of AI's biggest industry gains will come from persistent agents, which is why it is building the safety layer in the open rather than keeping the playbook internal. The internal pilot result, a large jump in productivity and adoption across technical and non-technical teams, is the argument that the controls do not strangle the capability.

Questions readers are asking

What makes persistent agents different from a normal coding agent? A normal Codex session has a fixed goal with a human steering each step, while a persistent agent runs continuously with broad scope and takes proactive actions without user input. The security consequence is that no human sits in the loop as the boundary, so the environment itself has to enforce policy, which is why OpenAI builds sandboxing, review, identity, and observability into the deployment rather than relying on approvals.

Why does OpenAI block cloud metadata endpoints for agents? Endpoints like metadata.google.internal and 169.254.169.254 serve instance credentials from the cloud provider. An agent that can reach them can potentially exchange partial access for full credentials of the host, which is the classic escalation path. Explicitly denying those endpoints, along with exfiltration friendly destinations such as pastebin and webhook services, closes the two highest value attack routes an agent compromise would take.

Why do persistent agents need model-based review? Auto-review is a second agent that monitors and approves the actions of the primary agent before they execute. It does not remove humans from the loop; it filters the volume. Constant human permission prompts train people to accept everything, so the LLM reviewer handles routine verification and escalates the genuinely novel or high risk cases to human attention, which keeps review quality from decaying into rubber stamping.

How is agent identity different from a service account? A service account provides separate API access for a bot, while agent identity is a full attribution layer that says who initiated each action, what the agent itself may access, and which user delegated what. OpenAI uses both together: each OpenClaw agent has a unique identity tied to a ChatGPT Service Account, so actions are auditable per agent and inference can be cut off per agent without affecting any human user.

Can the five controls be adopted outside OpenAI? Yes, in two ways. OpenClaw Enterprise, announced at Dev Day and currently in pilot with a 1.0 planned by year end, is an open source vendor neutral control plane that ships many of the safeguards in its standard Codex preset. Teams on other harnesses can implement the same five control categories directly, since the published config examples, allowlist and denylist patterns, and identity design are all described concretely enough to port.

Sources
[fluentform id="2"]