OpenAI acquires Ona to power long-running Codex agents

When OpenAI said on June 11, 2026 that it had agreed to acquire Ona, the startup formerly known as Gitpod, the most revealing detail was what it wasn't buying. This was not a model team or a pile of GPUs. It was plumbing: the secure, persistent cloud environments that let a coding agent keep working after a developer closes the laptop. Gartner's First Take called it the deal that gives Codex the essential scaling capability it lacked ^[1], and explicitly framed the move as OpenAI's response to Anthropic supporting self-hosted sandboxes in Claude Managed Agents, starting May 2026 ^[1].

The subtext is a shift in where the coding-agent war is actually fought. For two years the contest was about which model wrote better code. Ona signals that the new front line is runtime: who can run an agent safely, for hours or days, inside a company's own infrastructure. Tom Findling, CEO of Conifers.ai, read the deal less as OpenAI removing a small competitor and more as a move to keep pressure on Anthropic, especially as Claude Code gains traction ^[1]. Codex, by OpenAI's own numbers, now serves more than five million weekly users, up roughly 400% since early 2026 ^[2]— a scale that makes the gap between 'chat assistant' and 'production agent' commercially urgent.

Strip away the strategic framing and Ona does something concrete: it gives an agent a desk that stays open. Today a Codex task lives and dies with the session — close the laptop and the work stops. Ona provides secure, persistent environments where, as OpenAI put it, agents can access the tools, systems, and context they need to make progress over time ^[1], continuing tasks over hours or days even when the user's laptop is closed ^[2].

The architectural twist that makes this enterprise-grade is where the environment lives. Rather than running on OpenAI's infrastructure, the agent operates inside each customer's own cloud — OpenAI supplies the model and orchestration, while the customer keeps the data, credentials, and audit trail. Ona's own pitch, in CEO Johannes Landgraf's words, is trusted, customer-controlled cloud environments where work continues across devices, inside the systems where software actually lives ^[1]. In practice that means the customer, not OpenAI, defines the boundaries the agent operates within — the difference between a demo and something a bank will actually deploy.

The price tells its own story. IDC's Arnal Dayaratna pegged Ona's 2025 revenue at roughly $7 million ^[1]and, applying a standard software multiple of around 30 times revenue, estimated the deal could land near $450-500 million ^[1]— terms OpenAI declined to disclose ^[3]. Paying a nine-figure sum for a company with single-digit-million revenue only makes sense if you are buying time, not income.

That is the classic buy-versus-build calculus, and OpenAI has been resolving it with the checkbook all year. Ona is roughly OpenAI's sixth acquisition of 2026 — following deals such as Promptfoo and Torch — already approaching its full-2025 total by mid-June ^[4]. For a company assembling an enterprise stack against a fast-moving rival, buying the secure-execution layer is quicker than growing it. As Dayaratna framed the choice, that layer is outside of what OpenAI has now ^[1]— exactly the kind of capability that is faster to acquire than to build.

There is a quieter question underneath the announcement, and enterprise buyers are the ones asking it. Gartner warned that the deal forces software-engineering leaders to weigh the benefits of a vendor-specific integrated stack against the flexibility of staying vendor-agnostic ^[1]— a polite way of describing lock-in. Once your agents run on OpenAI's model inside OpenAI-owned execution tooling, switching costs climb.

Developer reaction has been more skeptical than the announcement's framing suggests. The sharpest community threads questioned the premise directly — why couldn't OpenAI simply use Codex to build what Ona provides? — while others stressed that persistent cloud workspaces only earn enterprise trust when wrapped in governance: who can spawn an environment, which credentials mount, where logs land, and how an agent's actions can be reconstructed afterward. That is the real test Ona has to pass. The same technology that lets an agent keep working unattended is, ungoverned, the thing a CISO fears most: an autonomous process holding live credentials with no one watching.