OpenHands

The agent runs with whatever authority the person or process that launched it has. Every shell command the agent runs inherits the full environment of the host process, minus two agent-server session keys, so any cloud, GitHub, or LLM API credentials exported in that environment are available to the model's commands. There is no scoped identity and no authorization check between the model and its tools. A hijacked agent therefore holds the user's entire local account.

OpenHands has a real per-action approval gate: with AlwaysConfirm or ConfirmRisky set, every batch of tool calls stops in a waiting state with the exact pending actions, and the caller can run or reject them. It is off by default: both the SDK conversation state and the agent server default to NeverConfirm, so the README setup runs shell commands and file edits with no human in the loop. When it is on, it covers every tool in the main loop including MCP tools, but it does not cover every sub-agent path. Little is reversible beyond the file editor's per-file undo.

The default tools are general-purpose: the terminal tool takes an arbitrary shell string, and the file editor accepts any absolute path on the host with no workspace containment. The only argument check in the editor is that the path is absolute and exists (or does not, for create); an optional allowed_edits_files list exists but is not used by default. Tools are chosen by the developer, but the README and the default preset both include the shell and the editor. A misused tool can therefore reach the whole machine.

In the default local setup there is no isolation: the terminal tool runs a tmux or bash process directly on the host as the user, and model-invoked skills can run shell snippets the same way. A Docker workspace is available on request, which runs the whole agent server and every tool inside a throwaway container with no host mounts by default, and fails if Docker cannot start. That container is a stock one, though: default capabilities, the image grants its user passwordless sudo, and the network is unrestricted. It is opt-in, so the criterion is capped.

Nothing in code limits what a hijacked agent can do. Tool output from files, commands, MCP servers and the web enters the model's context as ordinary tool messages, with no provenance tracking; the only defence is a prompt notice that repository instruction files are untrusted. Optional security analyzers (pattern rules, an LLM judge, third-party guardrails) can escalate risky-looking actions to approval, but they are detection-based and off by default. In the default setup a prompt injection in a repository file can make the agent read secrets from the environment and send them anywhere, or delete and push, with no human involved.

The default setup keeps conversation history in memory only and auto-loads no instruction files, memory, or project skills, so poisoned context normally dies with the session. One workspace path is on by default, though: agent definition files in the project's .agents/agents and .openhands/agents folders are registered at startup, and they are not integrity-protected, which matters once a delegation tool is enabled. When the optional persistent memory or project skills are switched on, the agent writes memory freely and repository instruction files load silently, labelled untrusted only in the prompt.

Nothing third-party is loaded by default: MCP servers, plugins and public skills all start empty or disabled. When a developer adds them, sources are whatever they name: plugin refs are optional, public skills track the main branch of OpenHands' extensions repository, and MCP launch commands are taken as written, with no hash or signature checks. Plugin hooks run as shell commands on the host with nearly the full environment.

Credentials the developer registers as conversation secrets get good treatment: they are injected into commands only when referenced by name, masked out of command and MCP output before it reaches the model, and redacted when state is serialized. LLM keys are held as SecretStr and command logs are redacted. But anything already in the process environment, including the LLM key the README reads from LLM_API_KEY, is passed to every shell command and is not masked, so the model can simply print it. Telemetry and completion logging are off unless configured.

Every action, observation, rejection and message is a structured event with a source (agent, user, environment, hook) and timestamp, and with a persistence directory these are written to disk one file per event and can be resumed. By default, though, the SDK keeps events only in memory and prints them to the console, so nothing survives the process. The record does not name an approver or link sub-agent conversations, and it sits wherever the developer points it, with no tamper protection.

Runs stop after 500 iterations by default and stuck-loop detection is on. A dollar budget exists but defaults to unlimited and is only exposed on LocalConversation, not the public Conversation factory. There is no wall-clock limit, and shell commands have only a 30-second no-output soft timeout that hands control back while the command keeps running. Pausing takes effect between steps; interrupt cancels an async run, but processes started in the terminal keep running, and sub-agents each get their own iteration and budget counters.