OpenAI’s Agents Python SDK 0.24.0, released October 15, closes a route through which commands in its local Mac sandbox could open host applications. Developers using that backend should also check custom error handlers and saved agent runs before upgrading.
Where the Mac restriction applies
The change targets explicitly configured UnixLocal sandbox workflows. RunConfig.sandbox defaults to None; installing or updating the SDK does not automatically sandbox every tool. SandboxAgent runs use SandboxRunConfig with a selected client or an existing session.
On macOS, the UnixLocal backend sends ordinary and PTY commands through sandbox-exec. Version 0.24.0 adds a denial for lsopen to their shared profile. Once that backend is selected, the restriction needs no additional switch.
PR #5335 explains why: Launch Services can start an application outside the calling process’s sandbox, bypassing workspace filesystem restrictions. Opening apps, documents or URLs through Launch Services is now intentionally denied. Workflows that use those openings from sandboxed commands will need adjustment. Linux behavior is unchanged.
Local execution still has limits
OpenAI’s backend guidance reserves UnixLocal for trusted local development or execution with external isolation. Its Mac filesystem restrictions provide no network isolation, and the client inherits the host environment by default. For untrusted commands, the documentation points to appropriately configured Docker or hosted backends, or external isolation.
The tagged implementation also requires sandbox-exec to be available on the Mac. If it cannot be found, execution raises a transport error instead of falling back to an unconfined command.
Two checks before upgrading
First, review custom tool-error formatters. They can now receive kind="tool_exception" for eligible function-tool failures. Account for this new category in the callback; returning None delegates its message to the SDK. Explicit per-tool handlers take priority, including an explicitly supplied None or default handler. Applications without a custom formatter keep their default behavior.
Second, inventory saved RunState checkpoints. New snapshots use schema 1.21, and some older graphs with same-name non-root agents whose saved identities could have depended on hook attributes are rejected. Complete those runs on the SDK version, agent definitions and hook order used to create them. Give agents distinct names when creating future persistent workflows. Renaming agents in an existing checkpoint does not convert it. Schema 1.21 snapshots cannot be loaded with earlier SDK releases. Both precautions appear in the release guidance.
Core requirements remain Python 3.10 or later and OpenAI’s Python package from 3.0.0 to below 4. MacDigest has not independently tested this release or the sandbox change.
