OpenAI agreed to get Ona, a German startup that keeps software agents working in a secure cloud after the developer who started the job logs off. The deal was announced Thursday and folds Ona into Codex, OpenAI’s coding agent. It points the company to a problem that only better models have not solved.
Codex now reaches more than 5 million people each week, OpenAI said, a 400% jump since the start of the year. The work he does stretches from minutes to hours and sometimes days. Tasks that have long required a runtime environment to run. For most businesses the most difficult issue is governance. Will a bank or hospital allow an autonomous agent to operate within its own network, access its data, and continue to work without anyone watching? Ona is OpenAI’s answer to this question.
Inside Ona
To appreciate what Ona adds, it helps to know where it came from. The company started as Gitpod, a developer tools company based in Kiel that moved coding from local machines and into the browser. It says it has served 2 million developers. At the end of 2025 renamed to Ona and rebuilt around agents.
The Ona platform is made of three building blocks. The first is environments: cloud workspaces with test environments defined in code that spin up the same way every time. The second is agents, workers in the past that accept a task and return a pull request, accessible from any device once the task is executed. The third is a set of guardrails, the controls manned by a security team. They include audit trails, role-based access, scope credentials, and deployment within a company’s virtual private cloud.
What connects them is a concept Ona calls customer-controlled execution. OpenAI provides the model and orchestration. The agent runs inside the customer’s cloud, where the company maintains its data, credentials, and audit trail. With this, a company can allow Codex to modernize a legacy codebase or patch a class of vulnerabilities during working days. The agent runs on company-controlled infrastructure, not on OpenAI’s servers.
Why OpenAI needs Ona
Codex started out as a tool for software developers, and OpenAI has far surpassed that base. Knowledge workers now represent about one in five Codex users and are growing faster than the core developer pool, the company said. Add-ons have expanded it into sales, investment banking and equity investing. As more of this work is performed unattended over large areas, the part performed ceases to be a detail and becomes what a business buyer must sign off on.
That’s where Ona earns her keep. Its existing clients include banks, pharmaceutical companies and sovereign wealth funds. These are organizations that care less about the leaderboard score and more about where the code is running and who can see it. By introducing this execution layer internally, OpenAI can tell a regulated buyer that a Codex agent will operate according to the buyer’s own security and governance rules.
The competitive image
The acquisition is a confidence proposition aimed squarely at wary IT departments, and the timing is no accident. OpenAI competes with Anthropic, whose Code Claude has grown rapidly within engineering teams over the past year. Both companies have filed confidential prospectuses with the Securities and Exchange Commission. OpenAI has a valuation of around $852 billion, so each is under pressure to convert the excitement of coders into production revenue.
Ona fits a pattern in the recent OpenAI market. The company acquired security testing startup Promptfoo in March and healthcare-tech company Torch in January. Both deals added plumbing capability rather than raw models.
The Limits
Nevertheless, the agreement does not close the case. It is still subject to regulatory approval. A US giant absorbing a German company that builds agent infrastructure could exert control on both sides of the Atlantic before the Ona team officially joins OpenAI.
A more pressing question hangs over the neutrality of the model. As an independent vendor, Ona allows enterprises to connect their own models through services such as Amazon Bedrock and Google Vertex AI. A customer could run Claude or Gemini inside an Ona environment. Under the ownership of OpenAI, this opening is worth watching, and any buyer who chose Ona for multi-model flexibility has reason to ask how long it will last.
The deepest limit lies beneath all this. Customer-controlled execution determines where an agent runs, not whether the agent remains correct in a two-day task. An autonomous factor that grinds for two days can also be wrong for two days. The tools for reviewing large untracked runs are much less mature than the environments that host them. Running these agents inside your own virtual private cloud also moves the actual operational work to your platform team, which now owns the infrastructure on which the agents live.
The road ahead
For a CIO weighing this, the questions are specific. Ask if Ona will remain model neutral under OpenAI or quietly favor Codex. Press which guardrails are actually Ona’s and which are thin wrappers around the AWS or Azure controls you’ve already paid for. And learn how review and rollback work when an agent runs for a day inside production systems.
The Ona acquisition shows that the competition between encoding agents shifts from the model to the execution level. This level decides whether a regulated business will let an agent touch its systems at all. OpenAI buys its way into this layer rather than building it. This is a calculated move given how far ahead Ona already is in corporate audits. Many companies wanted the productivity of autonomous agents, but were reluctant to commit their code to a vendor’s cloud. For them, customer-controlled execution opens a reliable path to production on their own terms.
