OpenAI Agents API vs OpenHands

OpenAI Agents API 60

Read as a hosted API. status.openai.com has an Agents component under APIs (20). Since release on 10 September (57 days, not 90), the feed names the Agents API in a degraded-performance incident on 14 September, the elevated errors across ChatGPT, Codex and the API on 29 September (the openai-api listing reads that one as a major, 17:52 to 23:14 UTC), computer use issues and degraded workspace agents on 6 and 7 October, degraded performance across the APIs for 22 minutes on 21 October, and overbilling for hosted containers on 19 September. One major, the rest minor (10). Rate limits come from the shared guide, published per tier and model with headers, and the errors page adds a Files API allowance on session creation (15). 429 and 503 guidance with Retry-After, capped backoff and a check-then-retry procedure for turns (15). The Scale Tier SLA in the openai-api listing isn't shown to cover a beta API (0). Public beta behind the agents=v1 header (0). 20 + 10 + 15 + 15 + 0 + 0 = 60.

OpenHands 90

Read as a local package. Official npm package @openhands/agent-canvas (Node 24 or later, plus uv), a Docker image on GHCR and openhands-sdk on PyPI (Python 3.12 or later) (20). A CI workflow (ci.yml) runs on main beside desktop, Docker and end-to-end workflows; the runs passed on every load on 1 October, and GitHub's pages refused us on 1 November, so the award rests on that check (25). 456 open issues and 395 open pull requests with priority labels and a high-priority Cloud resume bug (#17664), per the 1 October check, not re-read on 1 November (18). Dated release notes for every Canvas version and a written SDK rule of at least five minor releases before a public API or REST contract is removed, which the SDK followed on 28 October when it dropped the ACP curated model lists at their stated 1.59.0 deadline, but the Canvas CHANGELOG.md still stops at 1.0.0-alpha.2 (12). Canvas is 1.34.0 and the SDK 1.59.0, and the README's beta badge was removed on 23 October 2026 (commit 4d1c4d1, noted in the 1.33.0 release notes), so the product is no longer labelled beta. Only the Apps extension API keeps a beta label (15).

OpenAI Agents API 30

No machine payment protocol (0). Model, tool and container prices published without a login, and no fee for the API itself (20). The Free tier reading of the openai-api listing, half (10). Sign-up in a browser (0). 0 + 20 + 10 + 0 = 30.

OpenHands 60

No payment protocol (0). Scored on the paid options and the OpenHands LLM provider. The docs publish per-token prices for the OpenHands LLM provider at provider rates with no markup, and the pricing page now lists Agent Canvas free, Teams at $500 a month for up to 10 users (plus $50 a seat, 30-day trial) and Enterprise by sales (20). The MIT stack is free to self-host, and two DeepSeek models are free on app.all-hands.dev (20). It runs any model through LiteLLM, local ones included, so an agent can install and run it with no signup (20). The provider price table still lists 2025 models, so it may be stale.

OpenAI Agents API 87

Project keys with restricted per-endpoint permissions, service accounts and workload identity, per the openai-api listing; we didn't confirm a key can be limited to /v1/agents (27 of 30). Automatic review for approvals, a sandbox network restricted to a host allowlist, vaults for secrets and a sandbox security guide (17 of 20). The agent reads web pages, MCP results and browser content; the sandbox security guide and approval flow are the mitigations, with no prompt-injection guide of its own found (8 of 15). Tracing, observability and usage per session and admin audit logs (15). SOC 2 Type 2, ISO 27001 family, Bugcrowd bounty and a disclosure policy, per the openai-api listing (20). Not ZDR-eligible and US residency only, recorded under transparency. 27 + 17 + 8 + 15 + 20 = 87.

OpenHands 64

Harness reading of the framework checklist, as for goose and the other agent harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. Agent Canvas still sends a canvas_install event to PostHog through z.openhands.dev on first use "regardless of consent" (telemetry.ts header, re-read on 1 November), and the consent banner's box is still defaultChecked. AGENT_CANVAS_DISABLE_TELEMETRY=1, --disable-telemetry, VITE_DO_NOT_TRACK=1 or the browser's Do Not Track setting stops all of it, the last since 1.26.0 (15). Confirmation policies (always, never, at or above a risk level) and a Docker sandbox per conversation exist, but Canvas still starts with confirmation_mode: false and the npm install runs on the host with full filesystem access. No network egress controls found. Local listeners bind to 127.0.0.1 with an injected session key, and since SDK 1.52.0 (5 October) DockerWorkspace publishes its ports on loopback (12). LLM, Invariant and GraySwan risk analysers and a policy-rail module, documented, all advisory (11). Conversation event logs, completion logs and OpenTelemetry tracing through Laminar, with hosted Laminar setup documented on 16 October (13). Security programme. openhands.dev's security.txt expired on 28 October 2026 (re-read on 1 November), though the responsible-disclosure policy it names still loads. A Vanta-hosted trust page per the 1 October check, and the git diff injection published as an OpenHands advisory with a CVE. CVE-2026-112346, the SDK's unauthenticated sandbox server, was published by VulnCheck on 26 October with no OpenHands advisory found. No bug bounty found. 13, down from 15 for the expired file, read as shopware's and tokeneconomizer's expired files are (still credited for the policy behind them, less than a valid file).

OpenAI Agents API 85

Closed service with clear terms, Apache-2.0 SDKs (15). Session state retained until deleted, deletable sessions and artifacts, not ZDR-eligible, US residency only, and the data-controls guide agrees; no retention period for artifacts after a sandbox expires (25 of 30). Dated deprecation notices with minimum periods for GA models; a beta API can change faster (15 of 20). Subprocessors and processing countries listed, per the openai-api listing (20). 15 + 25 + 15 + 20 = 75.

OpenHands 67

MIT across Canvas, SDK, tools and Agent Server (30). The privacy policy (effective 3 September 2025, re-read on 1 November) doesn't separate the open-source stack from the Cloud service, keeps data as long as reasonably necessary, allows training on content from the Services and has no subprocessor list (12). A written SDK deprecation runway of five minor releases, kept on 28 October when the ACP model lists were removed at their 1.59.0 deadline, and the CLI's unmaintained notice in its README without a date on the page (15). The consent prompt calls the data anonymous and the Docker page documents AGENT_CANVAS_DISABLE_TELEMETRY, but no user-facing page mentions the install event sent before consent (10).