OpenAI Made the Agent Harness Free. Here Is What It Actually Takes to Build Your Own AI SDR

The orchestration layer under every AI SDR just became free

On 10 September 2026, OpenAI put the Agents API into public beta. The pricing line is the part every GTM engineer should read twice: there is no additional fee for the Agents API itself. You pay for the tokens your agents burn, the tools they call, and any hosted sandbox compute. The harness — the loop that most teams spent six months rebuilding badly — costs nothing.

If you have been quoted five figures a year for an AI SDR and quietly wondered how hard it would be to build your own AI SDR internally, that question just got a much more interesting answer. It is not "very hard" any more. It is "the hard part was never the part you were looking at."

This post is the honest version of that answer. What genuinely became a weekend project, what did not, and the four walls that decide whether your home-built agent books meetings or quietly torches your domain and your LinkedIn account.

What actually shipped

Three releases landed inside 72 hours, and together they change the build calculus for outbound:

• The Agents API (public beta, 10 September). OpenAI exposed the same managed harness that runs its Codex-style agents. It handles session orchestration, automatic context compaction across long tasks, sub-agent coordination, tool loading and crash recovery. You connect your own tools and Model Context Protocol servers so the agent can reach your data and systems.
• Environments. You choose where the agent actually runs: OpenAI-hosted sandboxes, your own infrastructure, or third-party sandbox partners including Cloudflare, DigitalOcean, E2B, Modal, Oracle and Vercel. Data residency stops being a blocker for a lot of teams.
• GPT-Live-1 (10 September). A full-duplex voice model at $0.05 per minute, with telephony support and custom voices. It listens while it speaks, so an interruption reshapes the reply instead of getting queued behind it. OpenAI reports a 30-percentage-point improvement on Full Duplex Bench over the previous realtime model.

Put plainly: the plumbing for a multi-step research-and-outreach agent, and the plumbing for an agent that can hold a phone conversation, both shipped as commodity infrastructure in the same week.

The part that got cheap, and the part that did not

Here is the uncomfortable thing about the AI SDR category as it has been sold since 2024. A large share of the product surface was orchestration: keep a task alive across many steps, compact context so the model does not forget what it learned on step four, retry when a tool call fails, coordinate a research sub-task with a writing sub-task. That is real engineering. It is also now a managed API with no margin in it.

What did not get cheap:

• Knowing who to contact and when. A model with a perfect memory and infinite patience still needs a reason to reach out today rather than in four months.
• Being allowed to send. Inbox providers and LinkedIn both operate permission systems that do not care how elegant your agent is.
• Knowing whether it worked. Attribution, reply classification, and the feedback loop that tells the system which signals actually convert.

Those three are not model problems. They are data, infrastructure and distribution problems, and they are exactly where a home-built agent runs out of road.

Orchestration was never the bottleneck

Consider the numbers on the other side of the equation. Salesforce's 2026 State of Sales research found reps spend roughly 60% of their time on non-selling work. Benchmark data compiled across 2026 outbound campaigns puts the average cold email reply rate at 3.43%, with top campaigns clearing 10% through micro-segmentation and signal-based targeting rather than volume.

Nothing in that picture is fixed by a better loop. A 3.43% reply rate is a targeting and relevance problem. If your agent sends the same undifferentiated message with a more reliable retry mechanism, you get the same 3.43% with better uptime.

What you can genuinely build in a weekend

Being fair to the build case: quite a lot, and more than was true a month ago. A competent engineer with the Agents API can assemble a working prospect-research-and-draft pipeline in a couple of days. A realistic reference architecture looks like this:

• A trigger source. A cron job or webhook that watches something: your CRM for closed-lost deals hitting a re-engagement window, a job board for target-role postings, your own website visitor log.
• An enrichment step. MCP servers or direct APIs that resolve a name to a company, a company to firmographics, a person to a current role.
• A research sub-agent. Reads the company site, recent posts, funding news, and produces a structured brief rather than a paragraph of prose.
• A drafting step. Turns the brief plus your positioning into a first-touch message, constrained by a style guide you supply.
• A human review queue. Slack or a simple web app where a rep approves, edits or kills each draft.
• A send step. Your existing sequencer's API, so you inherit whatever deliverability posture you already have.

That is a genuinely useful internal tool. It removes a large chunk of the manual research tax, and because a human approves every message, the blast radius of a bad output is one awkward draft rather than four hundred sent emails. If your team is technical and your volume is modest, build it. Seriously.

The trouble starts when someone asks the obvious follow-up: can we take the human out and turn the volume up?

The four walls you will hit

1. Deliverability is a permission system, not a code problem

Google, Yahoo and Microsoft have all moved sender requirements from recommended to enforced. SPF, DKIM and DMARC must pass and align. One-click unsubscribe is mandatory for bulk senders. Microsoft extended similar requirements to Outlook.com mailboxes, moving non-compliant senders to junk and then rejecting traffic outright. A sustained spam complaint rate above 0.30% triggers Gmail enforcement at the domain level; experienced operators run well under 0.10%.

Your agent does not know any of this. It will happily generate ten thousand technically excellent messages and hand them to a sending path that has never been warmed, on a domain with no reputation, and the failure mode is not a bad reply rate — it is mail that does not arrive anywhere. Domain warming, inbox rotation, complaint monitoring, and list hygiene are operational disciplines with a calendar attached, not features you ship.

This is also the single most common way a home-built AI SDR destroys something expensive. A burned primary domain costs weeks and sometimes a rebrand of your sending identity. We wrote about the full deliverability picture for 2026 here.

2. LinkedIn enforces behaviour, not volume

If your plan routes around email by going to LinkedIn, the wall is different but harder. Through 2026 LinkedIn shifted from volume thresholds to behavioural scoring: sessions originating from data-centre IPs, connection requests fired at mechanically identical intervals, and high ignored-invitation ratios all read as automation regardless of how many you send. Enforcement moved up the chain too — in March 2026 LinkedIn removed a well-known automation vendor's company page and restricted executive profiles, which put vendor-level risk on the table for the first time.

An agent built on the Agents API has no native LinkedIn access. To get one you either use an official API path, which is narrow, or you drive a browser, which is exactly the pattern the behavioural scoring is tuned to catch. Human-like pacing, session fingerprinting, residential routing, per-account daily caps and warm-up curves are not things you bolt on at the end. They are the product. Our guide to automating LinkedIn outreach safely covers the operating limits in detail.

3. Signal quality is the entire ceiling

This is the wall that matters most and gets discussed least. An agent that can research sixty data points about a prospect still produces cold outreach if the reason for contact is "they match the ICP filter." Matching an ICP is not a reason to email someone this week. It is a reason they might be relevant at some point.

Warm outbound works because the timing carries the relevance. Someone viewed your profile. Someone commented on a competitor's post about the exact pain you solve. A company posted a role that implies the initiative you sell into. Someone complained on Reddit about the tool you replace. Those are events with a decay curve, and acting inside the window is most of the performance difference between a 3% reply rate and a double-digit one.

Sourcing those events is a data-acquisition problem: continuous monitoring across LinkedIn, Reddit, X, job boards and your own properties, with deduplication, identity resolution and scoring against your ICP. You can build a thin version of this. Building a version that runs continuously, stays inside each platform's access terms, and does not silently break when a page structure changes is a full-time engineering commitment. The platforms have also been closing the open-web door, which we covered in what contract-gated signal data does to outbound.

This is the gap Updately was built to close: capture the warm signal, enrich and score the person behind it, research the account properly, write in your voice, and send inside safe limits — rather than handing you a very capable agent and an empty list.

4. Long runs fail quietly, and confidence outpaces control

Agentic reliability degrades with run length. That is not a vendor problem, it is a property of multi-step systems where each step carries a small error probability. Salesforce's own long-horizon outbound agent shipped in pilot rather than general availability for exactly this reason while six of its sibling agents went GA.

The governance picture is worse than most teams think. A survey-backed report published on 11 September by Harness found a wide confidence gap in enterprise agent deployments: 77% of organizations said they had a complete inventory of their agents, but only 44% ran active discovery tooling to verify it; 74% trusted their testing to catch failures, while just 19% had an automated gate that could block a bad release.

Apply that to outbound and the stakes are concrete. An agent that drifts on a customer-service ticket produces a bad answer. An agent that drifts on outbound produces four hundred bad first impressions with your logo on them, at machine speed, to the exact accounts you most wanted.

Build, buy, or assemble: the honest comparison

The pattern is consistent. Build what is model-bound or specific to your business. Buy what is infrastructure, data, or a standing operational obligation. The Agents API moved exactly one row from the buy column to the build column — an important one, but one.

The voice question deserves its own answer

GPT-Live-1 at $0.05 per minute with telephony support is the release most likely to be misread. A full-duplex model that handles interruption gracefully removes the single most obvious tell of a robot call. Sixty-four percent of sales leaders in 2026 research still name the phone as the most effective pipeline channel, which makes the temptation obvious.

Two cautions before anyone points this at a list.

First, the regulatory surface for automated outbound calling is significantly heavier than for email, varies by jurisdiction, and in many places requires disclosure and prior consent. Model quality does not change your obligations, and "the vendor said it was fine" is not a defence. Get this in front of counsel before a pilot, not after.

Second, the economics are more interesting inbound than outbound. A voice agent that answers an inbound enquiry in ninety seconds addresses a measurable, well-documented failure — Salesforce's research found inbound leads sitting unanswered for an average of 29 hours, with 63% never getting a response at all. That is real money left on the table, with no consent problem, no list, and a caller who chose to contact you. If you are going to build one voice agent this quarter, build that one. Our take on where calling still fits in signal-led outbound goes deeper.

A 30-day pilot that will actually teach you something

If you want to test the build path properly rather than argue about it, run this:

1. Week 1 — pick one signal, not a segment. Choose a single trigger with a clear decay window: inbound demo requests that went cold, or people who engaged with a specific competitor post. Volume target: 40 to 60 people, no more.
2. Week 1 — instrument before you build. Define what counts as a qualified reply, and log every draft, edit and outcome from day one. If you cannot measure edit rate, you cannot tell whether the agent improved.
3. Week 2 — build the research and drafting agent only. Human approves every message. Track the percentage of drafts sent unedited. Under 40% unedited means the agent is not ready for more autonomy, regardless of how good the prose reads.
4. Week 3 — send through existing infrastructure. Use the sequencer and domains you already warmed. Do not introduce a new sending path and a new agent in the same experiment.
5. Week 4 — compare against a human control group. Same signal, same week, reps working it manually. Reply rate and meeting rate, not open rate.

The result you are looking for is not "the agent works." It is the edit rate and the delta against the control. If the agent's drafts need heavy editing, your problem is signal quality or positioning, and no amount of orchestration fixes that. If they go out clean and still underperform the control, the reason for contact is wrong.

Takeaways

• The harness is a commodity. OpenAI's Agents API removed the orchestration fee and most of the orchestration engineering. Any vendor whose differentiation was the agent loop has a pricing problem, and you should ask them about it directly.
• Build the model-bound layers. Research, brief generation, drafting, reply routing and your own attribution logic are now genuinely reasonable in-house projects.
• Buy the infrastructure layers. Deliverability reputation, LinkedIn sending safety, enrichment and continuous signal capture are standing operational obligations with real downside, not features.
• Signal quality is the ceiling on everything. A perfect agent on a cold ICP list produces cold outreach. The reason for contact, and the timing of it, decide the reply rate.
• Autonomy should be earned with data. Hold the human approval step until unedited-send rate clears a threshold you set in advance. Harness's finding that 74% trust their testing while 19% can actually block a bad release is the failure mode to design against.
• Point voice at inbound first. The 29-hour average response delay is a bigger, cleaner, lower-risk prize than automated cold calling, and it does not put you in front of a regulator.

The right question for the next quarter is not whether to build your own AI SDR. It is which layer you are building, and whether you have a reason to contact anyone worth putting an agent behind.