Avalerion Intelligence Edition 015: OpenAI now sells the whole agent harness

Avalerion Intelligence · Edition 015

Tuesday 15 September 2026 · AI, Data & Enterprise Transformation for the Nordics, UK & Ireland

OpenAI now sells the whole agent harness

The One Thing. Last week the agent stopped being something you assemble and became something vendors want to run for you. On 10 September OpenAI put its agent harness, sandbox and orchestration behind a single API. On 11 September the biggest CRM vendor launched a control plane to govern every agent in your estate, including other vendors' agents. The model is now the least contested layer of an agent. The fight is over who runs it and who governs it, and your answer this quarter decides how easily you can leave later.
Move Who Why it matters to you
Agents API in public beta: harness, sandbox and subagents behind one call, no extra fee, data US only OpenAI (10 September) Building your own agent infrastructure is now a choice, not a necessity
Seven job ready agents plus a control plane for its own and third party agents The biggest CRM vendor (11 September) Your CRM supplier wants to govern agents it did not build
Threat report: compromised API keys and session tokens are now an end in themselves Anthropic (10 September) Agent credentials belong in your privileged access programme
Best coding agent resolves 38.8 percent of tasks on licensed private codebases Specific Labs, Real-SWE (September) Public benchmark scores do not describe your estate
Stockholm's Stilla acquired to accelerate an agent that sells inside WhatsApp, Messenger and Instagram Meta (9 September) Customer conversations are moving onto platforms your CRM does not own
13 billion euro for four Finnish data centre projects, and up to half of Loviisa's nuclear output from 2030 to 2049 Google and Fortum (9 September) Nordic clean power is being contracted decades ahead

1. Top AI News

OpenAI now sells the whole agent harness.
What happened. On 10 September OpenAI released its Agents API in public beta. It packages the harness behind its Codex product: long running sessions, subagents, context compaction and MCP tools. Agents run in an OpenAI sandbox, on your own infrastructure or with one of nine sandbox partners. There is no fee for the API itself; you pay for tokens, tools and container time. Data stays in the United States, and Zero Data Retention is not supported.
Why it matters. The engineering most enterprises were funding to run agents safely is now a product line. One analyst's verdict: "Lock-in is the biggest concern."
What to do. Before your next agent build, cost the managed option honestly. Then list what you would lose by leaving it in two years.

The biggest CRM vendor offered to govern everyone's agents.
What happened. On 11 September it launched seven named, job ready agents covering service, IT and HR, commerce, inbound and outbound sales, supply chain and customer experience. Most are generally available; the outbound sales agent stays in pilot until November. Alongside them came an AI Control Plane that registers agents, sets identity and policy, evaluates performance and tracks cost across its own and third party AI. The unified experience is planned to begin rolling out in early fiscal 2028, with pricing still to come.
Why it matters. Whoever holds the register of your agents holds the leverage at renewal.
What to do. Decide who owns your agent register before a supplier volunteers to.

Your API keys are now the prize.
What happened. On 10 September Anthropic published a threat report covering operations it disrupted between December 2025 and August 2026. A majority were enabled by AI through direct execution or orchestration. It says compromised API keys, session tokens and devices have become the sole objective of several criminal groups. A group linked to Midnight Blizzard used AI to run phishing against more than 20 ministries and other public bodies across Ukraine and Europe.
Why it matters. An agent credential is a spending account and an access path at once.
What to do. Inventory every AI API key and token this month, with an owner, a rotation date and a spend limit.

2. Enterprise AI Trend: three layers, three landlords

An agent now has three commercial layers: the model, the harness that runs it, and the plane that governs it. Last week each found a different bidder. That moves lock-in. Swapping a model is a configuration change. Leaving a harness that holds your sessions and tools is a rebuild, and leaving a control plane that holds your policies and audit trail is a governance migration. At the weekend Anthropic's chief executive argued that AI is advancing faster than researchers can keep it safe, and President Trump rejected a slowdown on Sunday. When the rules are this unsettled, an agent register you control is worth more, not less.

3. Data & AI Readiness: your estate is not the benchmark

Specific Labs published Real-SWE, which tests coding agents on private production codebases licensed from real companies. The best combination, Fable 5.1 inside Claude Code, resolved 38.8 percent of tasks; GPT-6 Astra inside Codex reached 33.8 percent. Longer runs barely helped, and the most common failure was missed requirements. Two lessons follow. Public scores overstate what agents do on code and data nobody outside your firm has seen. And the failures are specification failures, a readiness problem in your tickets and documentation rather than in the model. Build a small evaluation set from your own resolved tickets before you sign an agent contract.

4. Business Process Spotlight: the conversation is leaving the CRM

On 9 September Meta acquired Stilla, a Stockholm agent start-up founded in 2024, to accelerate Meta Business Agent, which answers customers and completes transactions inside WhatsApp, Messenger and Instagram. Terms were not disclosed. For sales and service leaders the process question is simple: when the enquiry, the recommendation and the purchase all happen inside a messaging app, what reaches your CRM, and when? If the answer is a summary after the fact, you have lost the record of why a customer bought. Require any messaging agent to write the full interaction back to your system of record.

5. Nordic Technology: Google buys Finland's power for a generation

On 9 September Google committed at least 13 billion euro over 2027 and 2028 to expand its Hamina data centre and build new sites in Kajaani, Muhos and Vaala, its largest single investment in Europe. The same morning Fortum announced a 22 year agreement under which Google buys up to 50 percent of the Loviisa nuclear plant's capacity from 2030 to 2049. Loviisa supplies about 10 percent of Finland's electricity. The lesson for Nordic buyers is that the region's firm clean power is being contracted for decades by the largest buyers, which leaves less for everyone else. In Sweden, Hybridity raised 20 million kronor for an AI compliance platform, a sign that governance is becoming a product category.

Avalerion's Take. The agent market just asked who your landlord will be, and most organisations have not noticed the question. For two years the debate was which model to choose. Last week showed that the model is the part vendors will let you swap, because lasting control sits elsewhere: in the harness that runs your agents, the plane that records what they may do, and the credentials that let them spend. OpenAI wants the first, the biggest CRM vendor wants the second, and criminal groups want the third. Several of these offers are genuinely useful. Each is easier to accept than to leave, and none will be renegotiated in your favour once your policies and audit trail live inside it. Decide what you keep, write it down, and buy the rest with the exit priced in. Architecture before acceleration.

Do this next. Three questions, thirty minutes with us: which layer of your agent stack you intend to own, who holds your agent register today, and how many AI credentials run without a named owner. We will map all three with you. No pitch, no deck.

Book an AI Readiness Session

Recommended reading: What AI readiness actually means for Nordic companies and Why most enterprise AI projects still fail, at avalerions.com/insights

Frequently asked questions

What is the OpenAI Agents API?
OpenAI released the Agents API in public beta on 10 September 2026. It lets developers build and run agents on OpenAI's Codex harness through one API, with long running sessions, subagents, context compaction and MCP tools. Agents can run in an OpenAI sandbox, on customer infrastructure or with nine sandbox partners. There is no separate API fee; customers pay for tokens, tools and container time. Data stays in the United States and Zero Data Retention is not supported.

What is an AI control plane for agents?
An AI control plane is a management layer that sits above individual agent platforms. The version announced by the biggest CRM vendor on 11 September 2026 registers agents, applies identity and access policy, manages lifecycle, evaluates performance, observes behaviour and tracks cost across its own and third party AI. Its unified experience is planned to begin rolling out in early fiscal 2028, and pricing has not yet been announced.

What did Anthropic's September 2026 threat report find?
Published on 10 September 2026, the report covers AI misuse Anthropic disrupted between December 2025 and August 2026. It found that a majority of the operations were enabled by AI through direct execution or orchestration, that compromised API keys, session tokens and devices have become the sole objective of several criminal groups, and that a group linked to Midnight Blizzard targeted more than 20 public bodies across Ukraine and Europe.

How much is Google investing in Finland?
Google announced on 9 September 2026 that it will invest at least 13 billion euro in 2027 and 2028, expanding its Hamina data centre and building new sites in Kajaani, Muhos and Vaala. It is Google's largest single investment in Europe. Fortum announced a 22 year agreement under which Google buys up to 50 percent of the Loviisa nuclear plant's capacity from 2030 to 2049, plus 629 megawatts of new wind agreements.

Sources

  • MarkTechPost, OpenAI launches the Agents API in public beta, 10 September 2026: marktechpost.com
  • InfoWorld, OpenAI launches managed Agents API, 11 September 2026: infoworld.com
  • Newsroom of the biggest CRM vendor, job ready AI agents, 11 September 2026: newsroom
  • Anthropic, "Countering misuse of AI: September 2026", 10 September 2026: anthropic.com
  • NPR Up First, AI leaders on the pace of development, 14 September 2026: npr.org
  • Specific Labs, Real-SWE benchmark: withspecific.com
  • Axios, Meta acquires Swedish AI startup Stilla.ai, 9 September 2026: axios.com
  • Google Cloud Press Corner, two year 13 billion euro investment in Finland, 9 September 2026: googlecloudpresscorner.com
  • Fortum, nuclear power purchase agreement with Google, 9 September 2026: fortum.com
  • Swedish Tech Weekly #371, 14 September 2026: swedishtechnews.com

You are reading Avalerion Intelligence, AI, Data & Enterprise Transformation for the Nordics, UK and Ireland. Published by Avalerion Consulting AB, Malmö and Stockholm. Subscribe by email