OpenHands

OpenHands is the open-source answer to Devin: an autonomous agent that takes a task, opens a development environment, writes code, runs it, reads the errors, and keeps going until it thinks it’s done. It has been around for a while and has been genuinely popular — tens of thousands of GitHub stars, hundreds of contributors — but for most of that time the honest advice was “great demo, don’t run it on anything you care about.” The agent could execute arbitrary shell commands with whatever access you’d given it, and the isolation was best-effort.

That changed this week.

New in September 2026: 1.0 ships the security layer

OpenHands hit 1.0 on September 8, and the headline is not a new capability. It’s the hardening that makes the existing capabilities safe to point at real work.

Three things matter. First, a Docker sandbox with configurable CPU and memory limits per container and non-root execution by default, so a runaway agent burns a container rather than your machine. Second, a built-in security analyzer that rates every action the agent wants to take as low, medium, or high risk and pauses on the high ones — destructive shell commands, anything touching credentials — until a human says go. Third, a plugin system for extending the runtime, plus CLI tooling split into its own repository.

Before 1.0, getting that behaviour meant writing your own safety wrapper. Now it’s the default. If the reason you hadn’t self-hosted an autonomous agent was that the security story wasn’t there, that reason is gone.

Sources: byteiota, DEV Community.

What it actually does

You point OpenHands at a repository and describe a task. It plans, edits files, runs commands and tests, reads what broke, and iterates. Same loop as Devin or Claude Code — the difference is where it runs and who holds the keys.

OpenHands routes through LiteLLM, so it talks to essentially any model provider: Claude, GPT, Gemini, or a local model served by Ollama on your own hardware. That last option is the interesting one. Point it at a local endpoint and your code, your context and your API keys never leave the building. For anyone working on client code they’ve signed an NDA over, or regulated data, that’s not a feature — it’s the entire reason to consider this over a hosted tool.

The benchmark number, honestly

OpenHands paired with an open-weight model completes roughly 68% of SWE-bench Verified tasks; paired with a frontier model it climbs to around 72%. The top of the leaderboard sits near 75–80%.

Treat all of these loosely. The harness alone can move a score 15–20 points, and vendor-reported figures on their own models carry obvious contamination risk. The comparison that actually holds up is cost per completed task, and there OpenHands on an open-weight model is roughly an order of magnitude cheaper than a per-seat autonomous agent. If your work is volume work — dependency upgrades, test coverage, boilerplate, internal tooling — that gap is the argument.

Pricing

The core framework is MIT licensed and free to self-host. OpenHands Cloud adds a hosted option with a free bring-your-own-key tier and pay-as-you-go credits if you’d rather use their model provider than your own. There’s an enterprise tier with Kubernetes VPC deployment for teams that want managed self-hosting.

So the sticker price is zero and the real price is your model tokens plus your time. The second one is the larger number.

Who this is not for

The non-coder rating is 2 and it’s generous. Getting started means Docker, a terminal, an API key and a config file, and the first thing you have to do after that is judge whether the agent’s output is correct. Nothing about OpenHands produces a visual result you can look at and assess. If you’re a non-technical founder trying to get a product built, start with Lovable or Bolt and come back to this category later, if ever.

The other group this isn’t for: teams who want zero infrastructure overhead. A managed service wins on setup, and it isn’t close.

Verdict

OpenHands 1.0 is the first version where “is this production-ready?” gets a yes without a list of conditions attached. It has real institutional backing — a Series A, contributors from large engineering organisations, an enterprise tier — so the two-year bet is reasonable.

For technical teams that are cost-sensitive or can’t send code to a third party, it’s now the obvious first thing to try. For everyone else on this site, it’s a useful thing to know exists and not a tool you should be opening this month.