OpenHands Prova

coding-agentsdeveloper-aiopen-sourceautomationtrialdevmay-2026openhands

Overview

OpenHands (formerly OpenDevin) is an open source platform for autonomous software engineering agents with optional sandboxed execution and GitHub integration (OpenHands).

Trial in isolated environments with strict network and secret policies. Not a replacement for code review or production deploy gates. In 2026 the main repository became Agent Canvas, a self-hosted control centre that runs the OpenHands agent and other ACP-compatible agents on local, Docker, VM, or cloud backends; the agent itself now lives in a separate software-agent SDK (OpenHands GitHub).

Adoption Signals

  • Community scale and cadence: about 89,600 GitHub stars and 11,800 forks under the MIT licence, with v1.24.0 released on 25 September 2026 and several releases per week (OpenHands GitHub, OpenHands releases).
  • Company backing: the company behind OpenHands (formerly All Hands AI) raised an $18.8M Series A in November 2025 and in spring 2026 introduced an Agent Control Plane for LLM routing, MCP access, secrets, budgets, and audit trails (blog post April 2026, press announcement 6 May 2026) (OpenHands press, The Software Agent Control Plane).
  • Enterprise governance features: the September 2026 Enterprise release added organisation-scoped secrets, a budget dashboard for members, OAuth for MCP servers such as GitLab and Atlassian Rovo, organisation-wide automation visibility, and Git sync for automations (OpenHands Enterprise update).
  • Customer evidence: US Mobile used OpenHands to build an internal developer-platform feature asynchronously, with the engineer stating that the agent did about 80% of the work (US Mobile case study).
  • Security community involvement: OpenHands joined the NVIDIA-launched Open Secure AI Alliance in August 2026 (OpenHands blog).

Risks

  • Prompt injection to credential theft and RCE. Security researcher Johann Rehberger showed a prompt injection leaking the GITHUB_TOKEN from the OpenHands container via Markdown image rendering, and a second injection that made the agent download malware and join a command-and-control server (Lethal trifecta, ZombAI).
  • Unsandboxed defaults. The README warns that the default install "runs the agent-server directly on the machine" with full filesystem access; Docker sandboxes have to be chosen deliberately, and exposing the server beyond loopback requires API-key setup (OpenHands GitHub).
  • Always-on automations. Scheduled and webhook-triggered agents act under a stored identity without a human watching each run; without per-automation scopes and budgets they widen both the attack surface and the model bill.
  • Platform churn. The split into Agent Canvas, SDK, Agent Server, and automation repositories plus rapid releases means integrations and self-hosting guides need re-validation after upgrades (OpenHands releases).

Pros & Cons

Advantages

  • Large, permissively licensed open source base (MIT, about 89,600 GitHub stars) that can be self-hosted, so code and credentials can stay on company infrastructure while using any LLM.
  • Built for asynchronous, event-driven work: automations triggered by GitHub, Slack, or Linear events, webhooks, or schedules handle PR review, dependency upgrades, and breaking issues into tasks, and Agent Canvas can also drive Claude Code, Codex, or Gemini through the Agent Client Protocol.
  • Governance features are maturing: the Enterprise edition adds an agent control plane with LLM routing, MCP access rules, organisation secrets, budgets, and visibility into automations and the identity they run as.

Disadvantages

  • Prompt injection has been shown to exfiltrate the GITHUB_TOKEN via image rendering and to make the agent download and run malware (Embrace The Red, August 2025), so untrusted issues and web pages are a direct attack path.
  • The default local install runs the agent server without a sandbox and with full filesystem access; Docker isolation is an explicit opt-in.
  • Named production evidence is thin and vendor-published (one US Mobile case study), and the product surface changed substantially in 2026 (Agent Canvas, SDK split, control plane).

Recommendation

Trial OpenHands for well-bounded, asynchronous tasks such as dependency updates, first-pass PR review, and issue triage, where its automation model and self-hosting option are the main advantages over IDE-bound agents. Run it only with Docker or VM sandboxes, egress restrictions, and fine-grained, short-lived repository tokens; do not let it process public issues or arbitrary web content with tokens that can push to protected branches.

Before connecting automations to Slack, Linear, or GitHub webhooks, define which identity each automation runs as, a budget per automation, and a rule that all output lands as a pull request behind normal review and deploy gates. Compare results with the coding agents already in use (Claude Code, GitHub Copilot's coding agent, Devin) on the same backlog, and track the sandboxing guidance in the radar entry on sandboxed execution for coding agents.

Sources

Consulenza

Dal radar all'implementazione

Avete valutato le tecnologie — vi aiutiamo a portarle nei sistemi produttivi in modo sicuro e misurabile.

Formazione AI

Formazione AI

Rendiamo i vostri team pronti per l'IA. I nostri training trasformano i buzzword in competenze applicabili. Chiaro. Pratico. Per chi fa.

Scopri di più