The open-source coding agent that began life as a weekend rebuttal to a proprietary demo shipped its 1.0 release on Tuesday — and it arrived with the two things skeptics kept citing as reasons not to self-host: a hardened Docker sandbox and a benchmark score in the same neighborhood as the commercial competition.
OpenHands 1.0 landed with production-ready container isolation, built-in security policies, per-run resource limits and a plugin system, alongside benchmark results showing the agent autonomously resolving roughly 68% of SWE-bench Verified tasks — the 500-issue benchmark drawn from real GitHub repositories. For a project distributed under the MIT license and installable with a single `uv tool install`, that is a materially different proposition than it was a year ago.
The release is not a version bump. It is a ground-up rebuild around the OpenHands Software Agent SDK, the architecture the team documented in an arXiv paper authored by Xingyao Wang, Graham Neubig, Robert Brennan and a dozen colleagues. The old codebase was a monolith in which agent logic, evaluation harness and web application shared one repository. The new one splits into four packages with hard boundaries: `openhands.sdk` for core abstractions, `openhands.tools` for tool implementations, `openhands.workspace` for execution environments including the Docker sandbox, and `openhands.agent_server` for REST and WebSocket APIs. The paper's claim is pointed: compared with the agent SDKs shipped by OpenAI, Anthropic and Google, OpenHands "uniquely integrates native sandboxed execution, lifecycle control, model-agnostic multi-LLM routing, and built-in security analysis."
What Actually Shipped
Three architectural decisions carry the release. First, everything is an event — every prompt, bash invocation, file write and compiler error is an immutable entry in an append-only log, which buys deterministic replay and session recovery. When an unattended agent does something inexplicable overnight, operators can replay the exact trajectory rather than reconstruct it from a chat transcript.
Second, agents, tools and LLM configurations are frozen Pydantic models validated at construction. Only conversation state mutates. That closes off a whole class of silent config drift mid-run.
Third, and most consequential for the security argument: a `SecurityAnalyzer` rates every tool call as low, medium or high risk, and a `ConfirmationPolicy` decides whether the agent must halt for human approval. Under the `ConfirmRisky` policy, the agent parks in a `WAITING_FOR_CONFIRMATION` state until a person signs off. Operators get further knobs — `SANDBOX_VOLUMES` scopes exactly which host paths the agent can touch, `SANDBOX_NETWORK_DISABLED=true` severs internet access entirely, and secrets auto-masking is built into the SDK. The paper's own limitations section is candid that the LLM-based risk classifier is probabilistic rather than a guarantee, which is the right disclosure to make.
On raw capability, the numbers depend heavily on the model behind the harness. The SDK paper reports a 72% resolution rate on SWE-bench Verified using Claude Sonnet 4.5 with extended thinking, and 67.9% on the GAIA validation set. The widely cited ~68% figure reflects a frontier-model configuration; paired with Devstral 24B, an open-weight model, OpenHands scores roughly 46.8% — a number that edges past the ~45.8% Devin 2.0 publicly reported. An open harness running an open model now matches a funded commercial product, at a fraction of the per-task cost.
Why It Matters
The origin story is the analysis. OpenHands launched in March 2024 as OpenDevin, a community response to Cognition's closed Devin demo — an "anything you can do we can do in public" project. Two and a half years later it has more than 86,000 GitHub stars, over 9 million downloads and contributions from hundreds of developers, and it is commercially backed: an $18.8M Series A led by Madrona closed in November 2025, with Menlo Ventures, Obvious Ventures, Fujitsu Ventures and Alumni Ventures participating, following a $5M seed in 2024.
"Software development is changing," said Robert Brennan, co-founder and CEO of OpenHands, announcing that round. "But a lot of that change is happening behind closed doors. The software engineering community is increasingly aligning behind OpenHands as the open source standard for doing agentic software development at scale."
The 1.0 release is that argument made concrete. Closed agents have long held two structural advantages: better raw scores, and a security story enterprises could point at during review. The first advantage has compressed to within a few points. The second has now been at least partially answered in the open — sandboxed runtimes, RBAC, audit trails and quotas, deployable into a customer's own VPC or an air-gapped environment.
What open source adds is leverage. By mid-2026 Continue.dev had been acquired by Cursor and Roo Code was archived, stranding teams that had standardized on them. An MIT-licensed, model-agnostic core spanning 100-plus providers means a pricing change or a roadmap pivot at one lab is an inconvenience rather than a migration.
"Autonomous agents are transforming from side-projects into core members of the engineering team," said Soma Somasegar, managing director at Madrona, "and OpenHands' open, model-agnostic approach ensures this transformation happens safely, transparently, and at enterprise scale."
What To Watch
Two gaps remain. The 1.0 core is built around single-agent conversations; delegation exists as a blocking parallel tool, but genuine multi-agent orchestration is explicitly filed as future work — territory where commercial rivals are further along today. And the security analyzer is a probabilistic reviewer, not a firewall, which means the sandbox configuration still does the real containment work.
The number worth tracking is not the SWE-bench score but the open-weight one. If the Devstral-class gap keeps closing, the calculus for routine engineering toil — dependency bumps, test coverage, vulnerability sweeps — stops being about capability and starts being about who holds the keys.
“Software development is changing. But a lot of that change is happening behind closed doors. The software engineering community is increasingly aligning behind OpenHands as the open source standard for doing agentic software development at scale.”— Robert Brennan, Co-founder and CEO, OpenHands