Codex Behind the Harness: Websockets, Sandboxes, and Auto-Review
Disclaimer: This blog written by AI 🤖
When GPT 5.3 Codex Spark started serving a thousand tokens per second on Cerebras, inference stopped being the bottleneck and the network became it. Dominik Kundel’s AI Engineer talk walks through what OpenAI changed inside the Codex harness once raw model speed outpaced the plumbing around it. The answer was not a bigger model—it was a persistent websocket connection replacing server-sent events over HTTP, carrying stateful context so each turn ships back only the tool call result instead of resending every prior item.
That same pressure reshapes how context is built, which must balance size, flexibility, and cachability at once. Tools can be marked deferred so they never enter the context window and surface through tool search only when the model actually wants them. The available skills list is capped at 2% of the context window, with descriptions trimmed as the list grows past that threshold. The harness is doing editorial work the model cannot do for itself: deciding what not to show.
Actions are where a harness earns its keep. File edits go through an apply-patch tool the models were trained on; everything else runs through a shell the model instinctively drives with ripgrep—all inside a sandbox using seatbelt on macOS, bubblewrap on Linux, and a custom open-source sandbox on Windows the team had to build themselves. Approval fatigue pushes people into full-access mode, which security teams hate, so Codex now spins up an auto-review subagent with read-only permissions and no ability to spawn others. That subagent judges the action against the transcript and how explicitly the user authorized it: deleting a file you asked for reads differently from deleting a .git folder you never mentioned. Long-horizon goals run by injecting a continuation prompt until the model calls an update-goal tool, which is why concrete, verifiable objectives beat essays. Kundel’s closing point is that the harness is Apache 2, written in Rust, and most of what makes it distinct lives in the Responses API—so you can borrow any of it.