OpenAI's Agents API Has No Zero Data Retention: What That Means for Where Enterprises Should Run Their Agents

On September 10, 2026, OpenAI stopped selling you a model for agent-building and started selling you the infrastructure underneath it. The Agents API entered public beta, giving any developer direct access to the same managed harness — session orchestration, context compaction, tool discovery, sandboxed execution — that has been running Codex and ChatGPT for Work internally. InfoWorld reported it as OpenAI’s answer to a real engineering problem: building a reliable, long-running agent from raw model calls means hand-assembling a job queue, a state database, a sandbox fleet, retry policies, and compaction routines before you’ve written a line of business logic.

That’s a genuinely useful thing to abstract away. It’s also a bigger strategic move than the framing suggests, because it comes with a gap that matters more to enterprise buyers than to individual developers: the Agents API does not support Zero Data Retention, even when you run it inside your own sandbox. This post covers what OpenAI actually shipped, why that ZDR gap is a bigger deal than one missing checkbox, and what it means that Amazon Bedrock has quietly been offering the same OpenAI models with a very different data promise since April. The choice enterprises now face isn’t “which model” — it’s “whose infrastructure holds the agent loop, and what does that decide for you.”

What OpenAI Actually Shipped

The Agents API organizes around four concepts, laid out in OpenAI’s own developer documentation: an Agent (the model, instructions, tools, and MCP servers it can use), an Environment (an optional sandbox where it reads files, loads skills, and runs commands), a Session (state that persists across turns, including automatic context compaction so long-running work doesn’t blow the context window), and the Tools themselves, which can be Model Context Protocol servers or custom functions the agent discovers and calls in parallel rather than one at a time.

Deployment Options and Pricing

Enterprises get real flexibility on where the agent actually runs: an OpenAI-managed sandbox, an enterprise’s own VPC, or one of nine partner sandbox providers — Blaxel, Cloudflare, Daytona, DigitalOcean, E2B, Modal, Oracle, Runloop, and Vercel — according to InfoWorld’s coverage. Pricing is straightforward: no separate API fee, just standard token costs plus whatever paid tools the agent calls, per OpenAI.

Analysts see the appeal clearly. Pareekh Jain of Pareekh Consulting told InfoWorld the API “significantly reduces” engineering overhead, letting teams focus on the business application instead of agent plumbing, and Amit Kumar Jena of Kanerika pointed out that everything long-running agents typically need by hand — job queues, state databases, sandbox fleets, compaction routines, retry policies — is now something OpenAI manages for you.

The Zero Data Retention Gap

Here’s the catch. OpenAI has offered Zero Data Retention as a standard enterprise privacy commitment for years: prompts and outputs aren’t retained after a request is processed, and customer content isn’t available for employee review. It’s the option that lets regulated organizations — healthcare, financial services, anything governed by strict data-handling rules — use OpenAI’s models at all.

The Agents API doesn’t offer it. Not on OpenAI’s managed sandbox, and not even when an enterprise runs the agent inside its own infrastructure. HFS Research’s Phil Fersht flagged this to InfoWorld as his primary concern with the release: adoption in regulated sectors like healthcare and BFSI (banking, financial services, and insurance) is directly at risk because of it. That’s not a minor omission — those are exactly the industries where “we can’t tell you what happens to this data after the request” is a disqualifying answer, not a caveat you note and move past.

Why This Is Worse for Agents Than for Chat

A single ZDR-less chat completion is a bounded exposure: one prompt, one response, done. An agent session running for hours across a sandbox, calling tools, reading files, and coordinating subagents accumulates a much larger, longer-lived footprint of exactly the kind of data a compliance team wants accounted for. The Non-Human Identity Crisis already covered how agents are proliferating inside enterprises faster than anyone can track them; an agent platform that can’t commit to zero retention makes that tracking problem a data-governance problem too, not just an access-control one.

Same Model, Different Rules: The AWS Alternative

Here’s the part that turns this from “one vendor’s gap” into a genuine procurement decision. Since April 28, 2026, Amazon Bedrock has offered Managed Agents powered by OpenAI — the same OpenAI frontier models and the same OpenAI agent harness, running as a managed service inside AWS instead of OpenAI’s own infrastructure. AWS’s announcement is explicit about the difference: every agent gets its own identity, logs every action, and runs inside the customer’s environment, with “all inference on Amazon Bedrock” — meaning the data never leaves AWS. The same announcement says OpenAI models on Bedrock inherit AWS’s existing enterprise controls: IAM, PrivateLink, guardrails, encryption, and CloudTrail logging.

Bedrock Managed Agents runs on top of Bedrock AgentCore, the serverless agent runtime AWS built after retiring its older Bedrock Agents Classic product. We covered that transition’s lock-in lesson back in August: platform-level agent infrastructure changes underneath you on the vendor’s timeline, not yours, so it pays to understand what you’re actually depending on before you build on it.

The Real Comparison Isn’t Model Quality

The practical result: an enterprise evaluating “should we build our long-running agent on OpenAI’s own new Agents API, or on Bedrock’s OpenAI-powered Managed Agents” isn’t comparing model capability at all — GPT is GPT either way. It’s comparing two different infrastructure providers’ data-handling guarantees, identity models, and audit trails wrapped around the identical underlying model. That’s a fundamentally different evaluation than the one most AI procurement checklists were built for, which is still organized around “which model” as the primary axis.

This is the same pattern we flagged when GitHub’s HydraFusion started routing coding tasks across multiple model providers at runtime: the vendor relationship on your contract (“we use OpenAI”) is increasingly disconnected from the infrastructure relationship that actually determines your compliance exposure (“whose sandbox is this agent actually running in, and what does that sandbox provider promise about your data”).

The Bigger Pattern: Infrastructure Is the New Lock-In

Enterprises have spent the last two years working through a build-vs-buy decision on agentic tools framed mostly around cost and speed to deployment. The Agents API launch adds a third dimension to that decision: even when you “buy,” you’re now choosing between multiple infrastructure providers who can run the identical model with materially different data, identity, and governance postures. Skipping that evaluation because “it’s the same model either way” is precisely the mistake that shows up later as an audit finding.

It also raises the stakes on the governance bottleneck we described in the Agent Fleet Era: a fleet of long-running agents spread across an OpenAI-managed sandbox, a self-hosted VPC, and third-party sandbox partners like Daytona or Modal is a fleet with several different data-retention regimes to track simultaneously, not one.

What Enterprises Should Do Now

None of this means avoid the Agents API — the engineering case for it is real, and for non-regulated use cases the tradeoff may be entirely reasonable. It means treating “where does this agent actually run, and what happens to the data after” as a question you answer before you build, not one you discover during a security review.

Concretely: if your organization is in a regulated industry, confirm in writing whether your use case requires Zero Data Retention, and if it does, evaluate Bedrock’s Managed Agents (or another provider with an equivalent commitment) alongside OpenAI’s own Agents API rather than defaulting to whichever one your engineering team already has API keys for. Ask any agent platform vendor — OpenAI included — for their retention policy per deployment option, since “OpenAI-managed sandbox,” “your own VPC,” and “third-party sandbox partner” can each carry different answers. And build agent procurement checklists that separate “which model” from “which infrastructure,” because as this launch shows, those are no longer the same decision.

The model layer is converging fast — GPT, Claude, and Gemini are all credible choices for most agent workloads now. The infrastructure layer underneath them is where the real differentiation, and the real risk, currently lives.

Frequently Asked Questions

What is OpenAI’s Agents API?

It’s a managed service, launched in public beta on September 10, 2026, that gives developers direct access to the same agent harness that runs Codex and ChatGPT for Work — handling session orchestration, context compaction, sandboxed execution, and tool coordination through a single API call instead of custom-built infrastructure.

Does the Agents API support Zero Data Retention?

No. OpenAI’s Agents API does not support Zero Data Retention in any deployment configuration, including when an enterprise runs the agent inside its own infrastructure, which analysts flag as a significant barrier for regulated industries like healthcare and financial services.

How much does the Agents API cost?

There’s no separate fee for the API itself. Enterprises pay standard token costs for the underlying model plus the cost of any paid tools the agent calls during a session.

Is Amazon Bedrock’s Managed Agents the same as OpenAI’s Agents API?

They use the same OpenAI models and the same OpenAI agent harness, but they’re different infrastructure. Bedrock Managed Agents, available since April 2026, runs inference inside AWS with AWS’s own identity, encryption, and audit controls, and AWS states the data never leaves its environment — a different data-handling promise than OpenAI’s own direct Agents API currently offers.

Should regulated industries avoid OpenAI’s Agents API entirely?

Not necessarily, but they should confirm their specific compliance requirements before adopting it directly. Where Zero Data Retention is a hard requirement, evaluating alternatives like Bedrock’s Managed Agents, which offer the same underlying models with different data-handling guarantees, is a reasonable first step.

What deployment options does the Agents API offer?

Three: an OpenAI-managed sandbox, an enterprise’s own infrastructure, or one of nine third-party sandbox partners, including Cloudflare, DigitalOcean, Modal, Oracle, and Vercel — each of which can carry its own data-handling terms.

Sources

• Introducing the Agents API - OpenAI - OpenAI’s official announcement of the Agents API public beta.
• Agents API overview - OpenAI Developer Docs - Technical documentation on the Agent, Environment, and Session concepts.
• OpenAI launches managed Agents API to simplify enterprise AI agent development - InfoWorld - Coverage of features, deployment options, and the Zero Data Retention gap with analyst commentary.
• OpenAI Opens Agents API In Public Beta, Ships Codex Harness As Managed Service - The Robotics Media - Confirmation of the September 10, 2026 launch date and Codex harness details.
• OpenAI’s Zero Data Retention Changes Enterprise AI Privacy - Enterprise DNA - Background on OpenAI’s broader Zero Data Retention commitment for regulated industries.
• Amazon Bedrock now offers OpenAI models, Codex, and Managed Agents - AWS - AWS’s April 2026 announcement of Managed Agents powered by OpenAI, including data-residency and governance details.
• Amazon Bedrock Managed Agents - AWS - Product page detailing identity, logging, and inference-location guarantees for Bedrock Managed Agents.
• OpenAI Just Opened Its Agents API to Everyone - DEV Community - Independent developer analysis of context compaction and tool-discovery features.