Managed Agents Move Responsibility

If You Only Read One Thing

The easiest agent to deploy may leave the hardest decision untouched. OpenAI Takes Over the Loop transfers execution machinery to a managed service; KDDI Makes Acceptance Explicit shows why judging the result still requires local knowledge. The Agents API documentation reveals the dividing line: renting orchestration changes who runs the system, without settling what counts as success.

OpenAI Takes Over the Loop

OpenAI has made the machinery behind a coding agent available as a managed service. The consequential change is that an application can buy continuity across hours of work instead of maintaining the entire execution loop itself.

The September 10 Agents API public beta uses the Codex harness: the software that coordinates model calls, tools, and context. OpenAI operates sessions, compaction, and recovery; applications supply tools and choose an execution environment. The usage bill includes model tokens, tools, and standard container charges for OpenAI-hosted sandboxes. That changes the build-versus-buy calculation for long-running research and analysis, not just coding. The launch announcement includes an early customer result: Ciridae reports its evaluation score rising from 0.71 to 0.85 and latency falling fourfold. The test set and controls are not published.

Think of a managed session as a job whose supervisor survives when the original request ends. The supervisor keeps enough working history to continue, finds tools, and coordinates separate workers. That is continuity as a service. It removes a class of application machinery, while leaving the application responsible for whether the job was worth doing and whether its output is acceptable.

The defaults make that responsibility concrete. Delegation is opt-in, but enabling it without a limit allows six concurrent subagents, excluding the coordinator. That is capacity, not proof of six useful assignments. For work with sequential dependencies, extra workers can add duplicated investigation and integration effort. A concurrency cap therefore belongs beside the task’s acceptance criteria, rather than being treated as a universal speed setting.

The strongest argument for keeping a custom harness is control over those decisions. A team with mature worktrees, recovery, and review gates may save little by migrating. The hosted alternative becomes compelling when maintaining session machinery is consuming time that could improve the actual task. Open code makes the underlying logic inspectable; it does not make the managed service’s operational contract identical to a local run.

That distinction reaches data custody. The overview specifies US-only data residency and no Zero Data Retention support, including with a self-hosted sandbox. Hosting execution locally does not relocate the retained session state.

The decisive test is recovery: after an interrupted multi-hour job, does continuation preserve the same acceptance-critical evidence without repeating completed side effects?

KDDI Makes Acceptance Explicit

A managed supervisor still needs a definition of good work. KDDI’s Buffmee case shows a useful way to establish one when outputs are grounded answers rather than code with executable tests.

The Japanese telecom’s September 8 production account, coauthored with Google Cloud, reports 38% lower response latency. Its evaluation changes included binary scoring for critical criteria, representative sampling by file format and media composition, and product-owner calibration against real answers. Sampling reduced evaluation workload by 75%. The team also changed prompt loading and subagent routing; the latency gain cannot be attributed to binary grading alone.

The useful concept is a calibrated acceptance boundary. Imagine an assistant answering a question from a magazine chart. “Four out of five” leaves room for one reviewer to reward fluency while another penalizes a misread axis. “Does every numerical claim match the cited chart?” makes the disagreement inspectable. A product owner can then examine borderline answers and decide which failures must block release. The score becomes an operational decision instead of a general impression.

This extends the familiar practice of writing acceptance tests before agent coding. A research or knowledge assistant lacks a compiler that rejects the wrong interpretation. Its test design must separately specify the evidence required and the kinds of source material likely to break extraction. Otherwise, a highly repeatable grader can approve the same mistake thousands of times.

Sampling is where that distinction becomes economical. A random sample can be dominated by easy text documents even when chart-heavy PDFs cause the expensive failures. A grid of content types reserves attention for each failure surface. The practical payoff is a smaller evaluation set whose composition has a reason, rather than a larger set whose size merely looks reassuring.

The boundary is equally important: binary grading does not make a subjective criterion objective. A test asking whether an answer is “helpful” can conceal the same disagreement as a five-point scale. And a content grid becomes stale when new formats or user questions arrive. Some fresh, randomly selected production examples must remain outside the familiar test set, or the system gradually learns to satisfy its own exam.

I read this as evidence for an evaluation design, not a guaranteed performance multiplier. The adoption test is whether a smaller, stratified set catches the failures found in a fresh human-reviewed sample without increasing false acceptance.

The Contrarian Take

Everyone says: Managed agents remove orchestration work, so a more capable model plus a hosted harness should steadily reduce the amount of engineering around AI.

Here’s why that’s incomplete: They reduce the work required to keep an agent running. They also make it easier to run more jobs before anyone has agreed on the failure budget. A six-worker limit is an execution policy; an answer-quality threshold is a product policy. Neither follows automatically from buying the model. The engineering effort can move from restarting processes toward defining and testing those policies. That is a valuable trade, but a team that deletes its acceptance work along with its orchestration code has outsourced the wrong responsibility.

Under the Radar

Field cost is not the subscription bill. Cadence’s Beyond Benchmarks dashboard, updated September 10, converts observed coding sessions into API-equivalent consumption value. Its active-hour denominator excludes idle gaps longer than ten minutes. Those definitions are useful for comparing resource intensity, but they do not measure what a subscriber paid. A model can look expensive per active hour while finishing sooner; neither number establishes cost per accepted change. The measurement default matters before the ranking does.
Astra now has an independent cost comparison. Artificial Analysis’s September 9 evaluation puts Astra level with Fable 5.1 on its Coding Agent Index at roughly 60% of the cost per task. This adds independent economic evidence to yesterday’s rollout coverage. The tested systems remain Codex and Claude Code, so the result supports a deployment comparison, not an isolated claim about model weights. It also does not price human review after a benchmark passes.

Quick Takes

SWE-2 narrows the affordable coding gap. Cognition’s September 10 model ships in Devin Desktop and CLI. Its own FrontierCode coding evaluation puts SWE-2 at 50.0% against Fable 5.1’s 50.9%, at 64% lower cost. Yet on Terminal-Bench 4, which tests command-line tasks, it scores 27.3%, versus Fable’s 55.8%. The Kimi-K3-derived model is a serious cost candidate, with a workload boundary that the headline parity claim obscures. (Source)
Data agents inherit business definitions. OpenAI’s September 10 Data agent announcement describes using semantic layers: stored definitions of metrics and relationships that help translate questions into queries. Connected-account permissions include table, row, and column restrictions. The practical change is that answer quality depends on the organization’s existing definition of “revenue,” not just its model’s SQL ability. Conflicting definitions can produce a perfectly authorized, misleading answer. (Source)
Discount model access can conceal persistent credential theft. Anthropic’s September threat report describes resellers routing supposed Claude traffic to another model while installing credential harvesters. Those harvesters captured replacement sessions after compromised credentials were reset. This is a distribution-chain failure distinct from yesterday’s evaluation-environment incidents: token rotation alone cannot recover trust while the installed client continues stealing the replacement. (Source)

The Thread

The next build-versus-buy decision concerns which defaults can safely be inherited. September 5’s issue examined hidden choices becoming durable architecture; today those choices arrive inside services a team can adopt immediately. OpenAI supplies an execution policy, while KDDI supplies evidence for keeping acceptance policy close to product judgment. The same division reaches the supporting stories: Data agents inherit metric definitions, and Cadence’s dashboard inherits a pricing and idle-time convention. Each default saves effort until it silently answers a question the application needed to decide itself. The new procurement question is how cheaply a team can inspect, change, and test those inherited decisions after adoption.

Predictions

New predictions:

I predict: By October 11, the Agents API will still require retained session state and remain ineligible for Zero Data Retention, even for self-hosted execution. Its documented architecture separates sandbox location from session custody; relaxing the latter would require a different operating contract. (Confidence: medium; Check by: 2026-10-11)

Coming Next Week

Next week’s deeper question is how to evaluate research agents when several answers are defensible. Binary checks can reject a fabricated number; comparing two well-supported but incompatible interpretations requires a more explicit account of judgment.

September 11, 2026 · 03:32 ET