OpenAI acquires Ona (Gitpod) to strengthen Codex coding agent for enterprise

The most revealing thing about OpenAI's June 11, 2026 agreement to acquire Ona ^[4]is what it is not buying: a smarter model. Codex already serves more than 5 million people a week, a 400% jump since the start of the year ^[1]. What it lacked was a place for those agents to actually live and work. Ona supplies that — persistent, secure cloud sandboxes where a Codex agent can run multi-step tasks over hours or days, continuing even after the developer closes their laptop ^[1]. The agents execute inside each company's own cloud while OpenAI provides the models and orchestration, so data, credentials and the audit trail stay with the customer ^[1]. IDC's Arnal Dayaratna put the gap plainly: 'This is outside of what OpenAI has now. These are secure environments where agents can have memory and operate securely' ^[2]. Conifers.ai CEO Tom Findling framed it as the missing 'plumbing' ^[2], and Ona CEO Johannes Landgraf distilled the thesis to a sentence: 'Agents need more than intelligence; they need a trusted workspace' ^[3]. For a tech press that spent two years measuring frontier labs by benchmark scores, the message is that the next phase of competition is about execution infrastructure, not raw reasoning. Coverage on YouTube extended the point, reading the deal as part of OpenAI's broader move to fold Codex into ChatGPT as a platform rather than a feature.

The timing is not coincidental. Anthropic's Claude Code is widely considered the leader for long-running coding tasks, and it began supporting self-hosted sandboxes in Claude Managed Agents in May 2026 ^[2]. One outlet titled its coverage bluntly: 'As Anthropic claims the enterprise, OpenAI fights back with Ona deal' ^[5]. Ona is OpenAI's second enterprise-infrastructure acquisition in three months. In March 2026 it bought AI-security platform Promptfoo — trusted by over a quarter of the Fortune 500 and 150,000-plus open-source users — and shipped Codex Security the same day ^[6]. The through-line is an acquisition-led platform build-out: rather than grow secure-execution and security tooling internally, OpenAI is buying startups with proven enterprise footholds to compress time-to-production ^[7]. Ona's existing customer roster — America's largest banks, European financial and pharmaceutical companies, and Asian sovereign wealth funds — is itself part of the asset, a credibility shortcut into exactly the risk-averse accounts where Anthropic has been gaining ground ^[8]. Both YouTube and finance-focused commentary on X framed the deal inside this OpenAI-versus-Anthropic rivalry, alongside a brewing API price war.

The economics underline that this is a talent-and-capability buy, not a revenue buy. IDC estimated Ona's 2025 revenue at roughly $7 million, with 2026 revenue projected at $10M to $15M; at a roughly 30x revenue multiple that implies an acquisition price near $450M to $500M ^[2]. That is a steep premium for a company whose top line is a rounding error against OpenAI's scale — which is precisely the point. Ona quadrupled its enterprise ARR year-over-year last quarter and landed a near-eight-figure contract ^[9], signals of product-market fit in the enterprise segment OpenAI most needs to win. The roughly 80-person team, the secure-execution platform, and the customer relationships are the asset; the revenue is almost incidental. It also fits a broader Codex demand curve: knowledge workers, not just developers, now make up about 20% of Codex's user base and are growing at triple the developer rate ^[10], expanding the population that will eventually need governed, long-running agent environments. Info-Tech's Jeremy Roberts described what that buys in operational terms — 'It is a bucket for the agents to operate in' ^[2].

The sharpest skepticism is not about strategy but about whether persistent agent workspaces are safe at scale. Ona's platform brings real enterprise-grade controls — cryptographic hash-based application blocking that catches a program even if it is renamed or moved, file-system path restrictions to protect credentials, and outbound connection filtering ^[5]. But developer-community discussion zeroed in on the harder problem underneath: a persistent cloud workspace only scales safely with governance around who can spawn an environment, which credentials mount, where logs go, and where data resides — otherwise it risks becoming, as one commenter put it, shadow AI in a nicer interface. A separate organic thread asked the obvious counterfactual: why buy rather than use Codex itself to build Ona's platform — a fair question that the disclosed rationale, proven security tooling, an enterprise customer base, and an 80-person team that already solved it, largely answers ^[1]. There are also concrete deal-level risks: terms were undisclosed, the acquisition is subject to regulatory approval, and integrating a German team and platform into the Codex group is still pending ^[11].