OpenAI Builds New Git Backend ‘Pando’ After Codex AI Agents Overwhelm Existing Infrastructure

OpenAI has built a new Git backend called Pando after Codex-driven development overwhelmed the systems behind its internal monorepo. OpenAI’s engineering post, published November 2, 2026, says Pando now powers all monorepo development. It cut median push latency by nearly 5x and delivers nearly a petabyte of Git data per day.

Codex lets engineers run far more work in parallel, which means more branches, pushes, merges, fetches, and clones from development environments, research jobs, and CI. OpenAI says the systems supporting its monorepo began struggling around the end of last year. Fetches and pushes were slow, and merge reliability at times fell below 90%.

OpenAI concluded the limit lay in how it served the monorepo, not in Git itself, so it kept the Git protocol and client. The same pressure is reshaping developer security. Agent-driven workflows have already exposed flaws such as the GitSpawn vulnerability class affecting AI coding agents.

How Pando Works

OpenAI evaluated two common scaling patterns, three-phase commit replication and a write-ahead log in blob storage. Both force pushes to unrelated branches to contend on one coordination point.

Pando takes a different route:

• Per-branch updates: It stores each pushed packfile as an immutable blob and records a “ref version” in a metadata store. Clients conflict only when pushing to the same ref.
• Causal consistency: Pando gives up repository-wide point-in-time snapshots. A reader looking at several branches may see them at different versions.
• Packfile reuse: The server serves stored packs instead of building a unique pack per client. It returns packfile URIs, and a caching service called Express delivers the files.
• Limited ref advertisement: By default, Pando advertises only a designated trunk branch on feature-branch pushes. This keeps advertisements small, because with millions of branches they can exceed 100 MiB. The median pack in the monorepo was under 20 KiB.
• Compaction: Background workers merge small “L0” packs into larger covers, up to L4 today. This lets Pando select packs in logarithmic time.

OpenAI reports that Pando served over 57 TB of Git packs in a single hour, with more than 99% of this data coming from the local disk cache. The cache hit rates on Express exceeded 99%, and clone and fetch operations fully utilized 10 Gbps links on standard cloud virtual machines. After the cutover, post-merge reliability reached 99.99%, and median push latency decreased by nearly 80%.

OpenAI states that Codex helped develop Pando from inception to production in just 10 weeks. One engineer designed the core system, while teams of agents implemented it, allowing it to begin serving production traffic in April. The Rust codebase was validated using a conformance test suite and deterministic simulation testing. Agents also created Lean and TLA+ specifications to identify bugs.

OpenAI operated Pando as a read- and write-through proxy to the old system, ensuring that traffic transitioned smoothly without downtime. Codex also helped developers migrate their own environments.

Agent-scale infrastructure widens the attack surface around source control. Researchers have already shown how Git hooks can turn AI agent actions into code execution.

Infostealers such as Aokigahara now target Codex and other AI coding tool credentials, including Git credential files and SSH keys.

OpenAI says it applied its secure software foundation principles to Pando and runs agents around the clock to red-team Git and Pando. Because Pando keeps the standard Git client, existing controls such as signed commits and branch protections still apply.

OpenAI says it has contributed fixes to upstream Git. They cover concurrent pack downloads, cleanup after interrupted transfers and resumed downloads. It also added tracing for packfile-uri downloads and an “explicit haves” concept that lets clients use –force-with-lease against trunk-only packs. Several changes are already upstream, and the rest are in OpenAI’s public Git fork.

OpenAI is exploring other uses for Pando, including workloads where many agents collaborate on one shared repository. It is also looking at ways to share the technology with users.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.