Background AI agents in 2026: how they work and how to adopt them safely
Agents now run for hours, in the cloud, with their own credentials. What shipped in September and October 2026, how the architecture works, and the guardrails to put in place first.
By KINETECH10 min read
On this page
On 29 September 2026 OpenAI launched dots, persistent agents that pursue user-defined goals in the background, alongside cloud execution for Codex and a broader Agents API. In the same week Anthropic shipped new agent-orchestration features in Claude Code, DigitalOcean opened a public preview of managed agent runtimes, and IBM released a self-hosted, air-gappable version of its Bob coding agent.
The common thread: AI agents are moving from interactive assistants you watch to long-running workers with their own identities, credentials and compute. That changes the engineering questions. It is no longer only “which model?” but “what can this agent touch, who approves its output, and how do we stop it?”
Key takeaways
- Background agents run asynchronously in isolated cloud or on-premises environments, often for hours, and report back with a result to review.
- Treat every agent like a service account: its own identity, least-privilege credentials, audit logs and a kill switch.
- Isolation (microVMs or containers), default-deny network egress and per-task secrets are the baseline, not extras.
- Keep humans at the merge and deploy gates; agent output goes through the same tests, scans and review as human code.
- Your repository’s test coverage, CI speed and documentation decide whether these tools pay off.
What shipped in background agents in late September and early October 2026?
OpenAI shipped always-on agents (dots), cloud execution and code review in Codex, and an expanded Agents API. Anthropic’s Claude Code added teammate spawning, deeper plugin hooks and a provider allow-list. DigitalOcean previewed managed agent runtimes on microVMs, and IBM released a self-hosted Bob for air-gapped environments. The table lists what each one confirmed.
| Product | What is new | Where it runs | Source |
|---|---|---|---|
| OpenAI dots | Persistent agents powered by GPT-6 Astra that pursue goals continuously; can be provisioned with specific identities, credentials and tools | OpenAI-hosted; reachable from ChatGPT, Codex, Slack and Teams | TechCrunch, 29 Sep 2026 |
| OpenAI Codex | Cloud execution, tasks started from any device, CLI voice input, an /agents interface for delegating and monitoring tasks, PR and merge-request review | Local machine or OpenAI cloud | InfoQ, 2 Oct 2026; BGR |
| OpenAI Agents API | Computer use, multi-agent capabilities from Codex, tool search, context compaction | OpenAI-managed execution infrastructure | InfoQ, 2 Oct 2026 |
| Claude Code | agent.spawn for teammates, idle and waiting agent states, Claude Mods, allowedProviders managed setting | Developer machine or your own infrastructure | Claude Code changelog, v2.1.285–2.1.289 (dated 29 Sep–2 Oct 2026 by Releasebot) |
| DigitalOcean Managed Agents | Harness Runtime (persistent session state) and Action Gateway (central tool permissions, human approval) | Isolated microVMs, public preview | InfoQ, 2 Oct 2026 |
| IBM Bob (self-hosted) | Coding and modernisation agent that runs on-premises or fully air-gapped | Customer infrastructure; Nvidia Nemotron, Poolside Laguna or hybrid models | Startup Fortune, 2 Oct 2026 |
According to TechCrunch, dots are available to ChatGPT Pro and Business Premium users in eligible markets, and OpenAI is working with Microsoft to integrate them with Agent 365 security controls. BGR adds that the first dot is included in the subscription. Neither report describes approval or permission controls for dots in detail, so assume you will need your own.
How long do these agents really run?
Vendors are now marketing duration. On its Fable 5.1 launch page, Anthropic quotes Ramp describing a 38-hour run on a machine-learning problem; its Opus 5.5 page quotes Clio saying the model stayed on task for over 18 hours, and a tester completing a 680,000-line code migration in less than a day. These are vendor-curated testimonials, not benchmarks — but they show the operating model vendors are designing for.
How does a background agent actually work?
A background agent is a loop — plan, call a tool, observe, repeat — running in an isolated environment instead of your terminal. Around that loop sit five components: a trigger or goal, a sandboxed runtime, a tool gateway with permissions, persistent state so work survives pauses, and a review step where a human or pipeline accepts or rejects the result.
- Trigger. A person assigns a task (an issue, a chat message, a voice command from a phone), or a schedule or event starts one. Dots are designed to pursue standing goals rather than single requests.
- Runtime. A fresh, isolated environment with the repository and toolchain. DigitalOcean gives each session its own microVM; Codex can now run tasks in OpenAI’s cloud as well as locally.
- Tool gateway. Every external action — APIs, MCP servers, shell, browser — passes through a layer that decides what this agent may do. DigitalOcean’s Action Gateway centralises permissions per agent and adds rate limiting, retries, backoff and timeouts.
- State. Long runs need memory that outlives one context window: DigitalOcean’s Harness Runtime persists history and working state across sessions, and the Agents API now includes context compaction.
- Review. The output is a pull request, a report or a proposed action — not a silent change to production. Codex now reviews GitHub pull requests and GitLab merge requests, and Codex Security Cloud scans repositories and new commits and prepares fixes.
Orchestration: one agent or a team?
Multi-agent set-ups are becoming first-class. Claude Code 2.1.289 added agent.spawn for teammates and idle and waiting states in its agent list; the Codex CLI gained an /agents interface for delegating and monitoring several tasks. Our advice is unchanged from our agentic AI primer: start with one well-scoped agent and add more only when evaluation shows a clear gain, because every extra agent multiplies cost and failure modes.
How should you sandbox an AI coding agent?
Run each task in a disposable, isolated environment — a microVM or hardened container — with no standing access to production. Deny network egress by default and allow only the registries and APIs the task needs. Inject short-lived, task-scoped secrets at start-up, and destroy the environment, including any credentials, when the run ends.
| Control | Default | Why |
|---|---|---|
| Isolation | One microVM or container per task, destroyed afterwards | Contains mistakes and stops state leaking between tasks |
| Network egress | Deny by default; allow-list package registries, your Git host and named APIs | Limits data exfiltration if the agent is manipulated |
| Secrets | Short-lived, task-scoped tokens injected at start; never production credentials | A leaked token expires and only reaches one resource |
| Filesystem | Repository plus a scratch directory; no host mounts | Keeps the agent away from SSH keys and cloud configs |
| Time and spend | Hard caps on wall-clock time, steps and tokens per run | Stops runaway loops and surprise bills |
| Model providers | Allow-list which endpoints a machine may call | Keeps code and data with approved vendors |
Some of these now exist as product settings. Claude Code’s changelog lists time limits for background commands (30 minutes by default, 2 hours maximum) and the allowedProviders managed setting, which restricts which API providers a machine may use. For regulated teams that cannot send source code to a third-party cloud at all, self-hosted options such as IBM Bob, or open-weight models on your own hardware (see our self-hosting guide), are now realistic.
Who is the agent? Identities, credentials and permissions
An always-on agent is a principal, not a feature. Give each agent its own identity, its own narrowly scoped credentials and its own audit trail, exactly as you would a service account. Never let it borrow a developer’s personal token or an administrator login, and make sure one person can revoke everything it holds in one step.
OpenAI’s framing points the same way: individual dots can be provisioned with specific identities, credentials and tools through existing systems, and integration with Microsoft’s Agent 365 security controls is planned. DigitalOcean’s Action Gateway defines which tools and actions each agent may use and requires human approval for sensitive operations.
- Per-agent identity. A distinct bot account in Git, cloud and ticketing systems, so every commit and API call is attributable.
- Least privilege by task. Read access to the repository, write access only to branches it creates, and no rights to merge, deploy or change CI settings.
- Scoped tool access. Expose only the MCP servers and APIs the task needs; separate read tools from write tools.
- Approval on irreversible actions. Payments, data deletion, customer emails, production changes and permission grants always wait for a person.
- Kill switch and audit log. One control that halts the agent and revokes its tokens, and a log of every tool call with inputs and outputs.
Where do humans stay in the loop, and what goes wrong?
Humans belong at the gates where mistakes become expensive: merging code, deploying, and any action that touches customers or money. Agent output should pass the same automated tests, security scans and code review as human work. The main failure modes are prompt injection, runaway cost, silent quality drift and lock-in to one vendor’s runtime.
Prompt injection is the top risk
A background agent reads issues, web pages, documentation and tool output written by people you do not control, and any of it can carry instructions. Vendors are working on this — Anthropic says Opus 5.5 attempts to circumvent boundaries about 85% less often than Opus 5, is less likely to take hard-to-reverse actions and is more resistant to prompt injection — but those are vendor claims. Design as if the agent will eventually be fooled: limit what each tool can do and keep egress closed.
Other pitfalls
- Runaway cost. Multi-hour loops consume tokens continuously. Set budgets per run and per day, alert on outliers, and use the caching and routing patterns from our model-routing guide.
- Quality drift. Track change-failure rate and reverted commits for agent-authored work separately from human work.
- Lock-in. Keep instructions in portable formats. AGENTS.md and the Model Context Protocol are now both hosted by the Linux Foundation’s Agentic AI Foundation, which the A2A protocol joined on 17 August 2026.
- Plugin supply chain. Extension points are getting deeper — Claude Code’s new Mods let plugins modify deeper behaviour — so review third-party plugins and MCP servers like any other dependency.
What this means for teams building now
Start with low-risk, well-tested work and expand as the data supports it. The teams getting value from background agents are not the ones with the cleverest prompts; they are the ones with fast CI, good test coverage and clear task definitions, because those are what let an agent check its own work and let reviewers trust it.
- Audit agent readiness. Can a new engineer set up the repository with one command? Do tests run in minutes? Is there an AGENTS.md describing conventions? Fix these first.
- Pick bounded task types. Dependency upgrades, flaky-test fixes, small bugs with clear reproduction steps, documentation and test coverage are good first candidates.
- Stand up the sandbox. Per-task isolation, default-deny egress, scoped tokens, time and spend caps — before the first unattended run.
- Route everything through review. Agent PRs get automated tests, a security scan and a named human reviewer. No direct pushes, no auto-deploys.
- Measure. Track tasks completed, review time, change-failure rate and cost per merged PR, and compare with your baseline.
- Widen scope deliberately. Grant more autonomy only to task types with a strong track record, and revisit permissions every quarter.
If you want help designing this — sandboxes, permission models, evaluation and the CI that makes agents useful — our generative and agentic AI team does this work with clients.
Frequently asked questions
Dots are persistent agents OpenAI launched on 29 September 2026. Powered by GPT-6 Astra, they pursue user-defined goals continuously in the background rather than answering one prompt at a time. Each dot can be provisioned with its own identities, credentials and tools. According to TechCrunch they are available to ChatGPT Pro and Business Premium users in eligible markets, and can be messaged through Slack and Teams.
It can be, if the environment is designed for it. Run each task in an isolated sandbox with default-deny network egress, short-lived task-scoped credentials and hard time and spend limits. Never give the agent production access or merge rights. The agent’s output should be a pull request that passes tests, a security scan and human review before anything ships.
Use one disposable microVM or hardened container per task, mount only the repository and a scratch directory, block outbound network traffic except to approved registries and APIs, and inject short-lived secrets at start-up. Cap wall-clock time, steps and tokens, log every tool call, and destroy the environment when the run ends. Managed runtimes such as DigitalOcean’s microVM-based preview package much of this.
Yes, options now exist. On 1 October 2026 IBM released a self-hosted version of its Bob coding agent that can run on-premises or fully air-gapped, aimed at banks, governments and other regulated industries, using models such as Nvidia Nemotron or Poolside Laguna. Open-weight models served on your own hardware are another route if you build the agent harness yourself.
It depends on the plan and on token use. OpenAI says the first dot is included in eligible ChatGPT subscriptions, according to BGR; API-built agents are billed per token, and long loops add up quickly. Control cost with per-run budgets, prompt caching, routing routine steps to cheaper models, and measuring cost per merged pull request rather than per call.
A coding assistant works interactively in your editor or terminal while you watch and approve each step. A background agent takes a task, runs asynchronously in its own environment — often in the cloud — and returns a finished result, such as a pull request, for review. That autonomy is why identity, sandboxing and review gates matter much more.
Sources
- Coverage of the OpenAI dots launch — TechCrunch, 2026-09-29
- Coverage of OpenAI DevDay 2026 — InfoQ, 2026-10-02
- Coverage of OpenAI DevDay 2026 announcements — BGR
- Claude Code changelog — Anthropic (GitHub)
- Claude Code release notes tracker — Releasebot
- Claude Fable 5.1 and Claude Mythos 5.1 — Anthropic, 2026-09-01
- Claude Opus 5.5 — Anthropic, 2026-09-22
- Coverage of DigitalOcean Managed Agents — InfoQ, 2026-10-02
- Coverage of IBM’s self-hosted Bob coding agent — Startup Fortune, 2026-10-02
- A2A joins the Agentic AI Foundation (announcement) — Agentic AI Foundation, 2026-08-17
Published by KINETECH, a digital product and AI development company in Pune, India. More guides
Planning to put agents on your codebase?
We can assess your repository’s agent readiness and design the sandbox, permissions and review gates before the first unattended run.