OpenHands
0.9.0 (commit fc5f026)Autonomous software engineering agent capable of shell execution and pull request authoring.
This evaluation reflects architectural observation and engineering analysis conducted strictly against OpenHands 0.9.0 (commit fc5f026) based on its default framework mechanics. It does not represent an ongoing certification of current upstream releases or an empirical benchmark of your specific deployment. Operational safety in production depends strictly on your implementation of external sandboxes, network egress boundaries, and state constraints.
Review protocol v1.1; revalidate by December 30, 2026. Disclosure status: not applicable — no private vulnerability report opened for these public architecture observations.
Evidence levels: A = reproducible observation; B = version-linked documentation or source; C = insufficient or out-of-scope evidence.
Deployment Evidence & Observation Scope
The default Docker runtime and iteration ceiling bound part of execution, but writable workspace, command, network, and credential controls remain deployment responsibilities.
5-Dimension Architecture & Control Boundaries
The reviewed default runtime executes commands in Docker with a read-write workspace mount; credential scope and host exposure depend on operator configuration.
A configurable maximum iteration count can stop a run, but the reviewed version does not establish diff-size ceilings or default-deny network egress.
Repository files and issue text enter the agent context. This source review did not run an injection fixture, so resistance is unverified rather than an observed exploit result.
The mounted workspace is writable, and shell side effects are not transactionally reversed. Recovery depends on an isolated branch, workspace snapshot, or disposable runtime.
The controller emits structured actions and observations through an event stream; durable retention, export, and access controls depend on deployment configuration.
Recommended Enterprise Guardrails & Pre-Deployment Controls
- Run within ephemeral single-task MicroVMs destroyed upon completion
- Provide read-only git clone tokens with external proxy gatekeeping for writes
- Enforce hard semantic diff limits (cap at 5 files and 200 lines per task)
- Require mandatory human review and CI verification before PR merge
Overview
OpenHands (formerly OpenDevin) is an autonomous coding agent that uses an event-driven loop to inspect source trees, modify files, and run terminal commands. This profile reviews the local Docker runtime in version 0.9.0, not hosted services or current releases.
Scope of Review & Version Baseline
- Repository: OpenHands/OpenHands (MIT License).
- Reviewed Version:
0.9.0(Commitfc5f026). - Target Execution Model: Local event-stream controller with the default Docker runtime and a mounted task workspace.
- Primary Evidence Sources: Tagged source for
EventStreamRuntime, the iteration controller, and configuration template. - Out of Scope: Hosted OpenHands services, later SDK/agent-server architecture, and runtime prompt-injection testing.
Architecture & Attack Surface
The reviewed runtime starts a Docker container and can mount the selected workspace read-write. That boundary reduces direct host execution, but it does not by itself establish default-deny egress, least-privilege credentials, or transactional rollback. Repository content should therefore be treated as untrusted, while this source-only review makes no claim that a specific injection exploit was reproduced.
Read the Full Architecture Review
For a detailed look at documented boundaries, synthetic failure scenarios, and controls to verify in your deployment, read our full article: OpenHands in Production: Tool Blast Radius, Sandbox Boundaries, and Release Readiness.
Notice: This evidence profile reflects source-based architecture observations of OpenHands 0.9.0. It does not establish current upstream behavior, reproduce a prompt-injection exploit, or approve a production deployment.
Deploying OpenHands in your enterprise stack?
Generic evaluations can only evaluate default configurations. BartsAI provides custom Launch Gate reviews assessing your specific tool permissions, private database connections, and corporate release thresholds.