OpenAI Buys Ona to Run Codex Inside Your Own Cloud—and Why That Matters

What happened

On June 11, 2026, OpenAI announced it had agreed to acquire Ona—the German developer-tools company formerly known as Gitpod—and fold its secure cloud-execution technology into Codex, OpenAI's coding agent [1][2]. Terms were not disclosed, and the deal remains subject to regulatory approval [2][3].

The capability OpenAI is buying is what Ona calls "customer-controlled execution": the agent runs inside the customer's own cloud environment, while OpenAI supplies the model and orchestration [4][2][3]. The customer keeps its data, credentials, and audit trail, and controls where agents run, which systems they can touch, how credentials are scoped, what gets logged, and when work is routed to a human reviewer [4][3].

The stated motivation is that Codex's most valuable work is increasingly long-running—unfolding "over hours or days, rather than minutes"—and needs a persistent environment that survives after the developer who kicked off a task closes their laptop [1]. As OpenAI's Core Products Lead Thibault Sottiaux put it, "Enterprises want powerful agents that can do real work while meeting the security and control requirements of their environments" [2]. Ona CEO Johannes Landgraf added that "agents need more than intelligence; they need a trusted workspace" [3].

Who Ona is

Ona began as Gitpod, a Kiel-based company that pioneered browser-based, on-demand cloud development environments [4]. In late 2025 it rebranded to Ona, repositioning from IDEs toward being "mission control for your personal team of software engineering agents" [5][6]. The platform rests on three pillars: Ona Environments (API-first sandboxed dev environments), Ona Agents, and Ona Guardrails—audit trails, RBAC, SSO/OIDC, command-level controls, and deployment inside customer-defined VPCs [6][5]. It has served roughly 2 million developers, with several enterprise customers shared with OpenAI [1][3][4].

Why it matters

The clearest read on the deal is that the contest among coding agents is shifting from the model to the execution layer—"that layer decides whether a regulated enterprise will let an agent touch its systems at all," and OpenAI is buying its way in rather than building it [4]. For practitioners at banks, hospitals, and other regulated shops, this targets the central blocker: letting an autonomous agent operate inside the corporate network, reach sensitive data, and keep working unattended.

The pitch, in other words, is a trust pitch [4][3]. Teams that wanted agent productivity but balked at shipping code to a vendor's cloud now get an option where the agent runs on infrastructure they control, with their own logs and credential scoping [4].

It also makes the long-running agent the unit of work. This aligns with OpenAI's broader Codex direction—GPT-5-Codex was reported to work independently for seven-plus hours on large tasks [7]—supported by tooling like the open-source Symphony orchestration spec and emerging "harness engineering" practices [8][9]. Ona supplies the durable, secure place for that long-horizon work to live. Codex weekly usage has reportedly climbed to about 5 million people, described as a roughly 400% increase during 2026 [2][1].

Finally, the deal fits a pattern: OpenAI has been buying enterprise plumbing, including security-testing startup Promptfoo and healthcare-tech firm Torch, rather than raw model capability [4].

The competitive picture

The move is widely framed as a response to Anthropic's Claude Code [4][2]. Notably, Anthropic reached the same idea from a different direction—shipping Claude Managed Agents in April 2026 and self-hosted sandboxes plus MCP tunnels in May 2026, moving tool execution inside the customer perimeter while keeping orchestration vendor-hosted [10][11][12]. Both companies are converging on the same architecture: separate the "brain" (model and orchestration) from the "hands" (tool execution, customer-controlled). The difference is build versus buy—Anthropic shipped its own controls and an open-source sandbox runtime, while OpenAI acquired Ona [11][13].

Benchmark claims should be read as vendor-favorable: Forbes cited OpenAI's agent at 77.3% on Terminal-Bench 2.0 versus Claude's 65.4%, while noting Anthropic leads on SWE-bench and long-context reasoning [14]. On market share, Menlo Ventures data cited by Brookings put Anthropic at about 40% of the roughly $37B enterprise LLM market by end of 2025, ahead of OpenAI's 27% and Google's 21% [15].

Caveats

This move does not "solve" execution-layer security. Independent coverage of Anthropic's analogous self-hosted sandbox stresses it is "a platform step, not a finished enterprise security solution," still requiring patterns like human-in-the-loop approval gates and audit shipping on top [10]. The risk is concrete: CVE-2026-25725 documented a sandbox-escape flaw in Claude Code, patched in v2.1.2 [16]. Prompt-injection risk also persists, since agentic work typically requires broad read/write access to repositories [5].

The backdrop is commercial pressure—reporting from the same week described a brewing OpenAI–Anthropic price war and enterprise pushback on token costs [17][18]. Figures vary across sources, too: the "400% growth" baseline is dated inconsistently, and OpenAI's valuation is cited at about $852B by Forbes versus $782B elsewhere [4][19]. Treat the company quotes as promotional; the sharpest framing comes from independent analysis [4][2].