OpenAI Agents API vs Qwen Code

OpenAI Agents API 87

Project keys with restricted per-endpoint permissions, service accounts and workload identity, per the openai-api listing; we didn't confirm a key can be limited to /v1/agents (27 of 30). Automatic review for approvals, a sandbox network restricted to a host allowlist, vaults for secrets and a sandbox security guide (17 of 20). The agent reads web pages, MCP results and browser content; the sandbox security guide and approval flow are the mitigations, with no prompt-injection guide of its own found (8 of 15). Tracing, observability and usage per session and admin audit logs (15). SOC 2 Type 2, ISO 27001 family, Bugcrowd bounty and a disclosure policy, per the openai-api listing (20). Not ZDR-eligible and US residency only, recorded under transparency. 27 + 17 + 8 + 15 + 20 = 87.

Qwen Code 53

Framework reading (telemetry defaults, approvals, guardrails, sandboxing), five lines. Usage statistics are on by default (privacy.usageStatisticsEnabled defaults to true in the settings schema at 0.26.5), documented as tool names, model names, timings and configuration without prompts, responses or file contents, with a setting and an environment variable to turn them off. Credentials are API keys in environment variables or settings.json (15). Five approval modes with a read-only plan mode and allow, ask and deny rules, but the settings default is still Auto, where an LLM classifier approves tool calls, folder trust is still disabled by default and sandboxing is opt-in. Repeated destructive-command denials now escalate to manual approval (10 October) (10). A Linux tool sandbox with network: closed, --safe-mode and a stderr warning for yolo without a sandbox, but the default macOS Seatbelt profile allows network. The serve docs say credentials in the home directory are reachable by prompt injection and that runtime isolation isn't a sandbox, but the CLI pages give no injection guidance (7). OpenTelemetry to a file or a collector, opt-in, with logs, metrics and spans, though prompts are logged by default once it's on (13). SECURITY.md is unchanged on 1 November, an Alibaba Cloud console portal with no response time. Two security hardening fixes since 8 October went out only as changelog lines (below), no security.txt was found, and CodeQL and a monthly scorecard run in CI. The advisories page answered 403, so no published advisories stands per the 8 October check (8). 15 + 10 + 7 + 13 + 8 = 53.

OpenAI Agents API 30

No machine payment protocol (0). Model, tool and container prices published without a login, and no fee for the API itself (20). The Free tier reading of the openai-api listing, half (10). Sign-up in a browser (0). 0 + 20 + 10 + 0 = 30.

Qwen Code 60

Self-hosted rule. No payment protocol (0). The CLI is free under Apache-2.0 with nothing to buy (20). No card or account is needed for the software, and it runs against a local model server (20). An agent can install and run it with no sign-up, given a model endpoint (20). Alibaba Cloud's Coding Plan and Token Plan are separate purchases, and their price pages couldn't be loaded on 8 October 2026.

OpenAI Agents API 85

Closed service with clear terms, Apache-2.0 SDKs (15). Session state retained until deleted, deletable sessions and artifacts, not ZDR-eligible, US residency only, and the data-controls guide agrees; no retention period for artifacts after a sandbox expires (25 of 30). Dated deprecation notices with minimum periods for GA models; a beta API can change faster (15 of 20). Subprocessors and processing countries listed, per the openai-api listing (20). 15 + 25 + 15 + 20 = 75.

Qwen Code 66

Apache-2.0 (30). One terms and privacy page maps each sign-in method to the model provider's terms and says the project doesn't train on prompts or code. Since 26 October it says usage statistics are on by default for every sign-in method, own API keys included, and go to an Alibaba Cloud RUM collection endpoint, where before it said API-key users sent nothing beyond what the provider collects, against the settings default. It still gives no retention period and names no legal entity (20, was 18). The end of the Qwen OAuth free tier is dated 15 April 2026 and tools.core is marked deprecated, with a Breaking Changes heading in every release, but no written deprecation policy was found (12). Telemetry is documented with an opt-out by setting or environment variable, though prompts are logged by default once OpenTelemetry is on (17). 30 + 20 + 12 + 17 = 79.

OpenAI Agents API 60

Read as a hosted API. status.openai.com has an Agents component under APIs (20). Since release on 10 September (57 days, not 90), the feed names the Agents API in a degraded-performance incident on 14 September, the elevated errors across ChatGPT, Codex and the API on 29 September (the openai-api listing reads that one as a major, 17:52 to 23:14 UTC), computer use issues and degraded workspace agents on 6 and 7 October, degraded performance across the APIs for 22 minutes on 21 October, and overbilling for hosted containers on 19 September. One major, the rest minor (10). Rate limits come from the shared guide, published per tier and model with headers, and the errors page adds a Files API allowance on session creation (15). 429 and 503 guidance with Retry-After, capped backoff and a check-then-retry procedure for turns (15). The Scale Tier SLA in the openai-api listing isn't shown to cover a beta API (0). Public beta behind the agents=v1 header (0). 20 + 10 + 15 + 15 + 0 + 0 = 60.

Qwen Code 69

Local-package reading. npm with engines node 22 or newer (re-read in package.json at 0.26.5), Homebrew at 0.26.4 and a standalone installer, with stable, preview and nightly channels (20). Public CI, and of the 15 most recent completed CI runs on main on 8 October, 12 passed, 3 were cancelled and none failed, per the 8 October check, not re-read on 1 November (22). 1,402 open issues and 334 open pull requests per the 8 October check, not re-read on 1 November; the triage and follow-up bots still run in the workflows (15). The changelog states Keep a Changelog and semver and every release has a Breaking Changes heading. Breaking changes shipped in patch releases 0.23.4 and 0.24.1, and again in 0.26.1 (24 October, QQ bot session isolation) and 0.26.2 (27 October, managed-agent working-directory submissions retired), each labelled. All are 0.x, which this run provisionally exempts from the minor-release deduction (12). 0.26.5, pre-1.0 (0). 20 + 22 + 15 + 12 + 0 = 69.

OpenAI Agents API 80

Read as an API an agent drives. Context is compacted automatically, and session budgets and streamed events keep output sized (20 of 25). Sessions can be listed, continued and steered, events streamed or sent by webhook, artifacts fetched (15 of 20). Actionable error codes with recovery steps (20). No idempotency key; a documented check-then-retry procedure (10 of 20). One session call with defaults (medium sandbox, network enabled), SDKs in five languages (15). 20 + 15 + 20 + 10 + 15 = 80.

Qwen Code 85

Framework reading, adapted to a harness driven by a pipeline. MCP servers take includeTools, excludeTools and a trust flag, with permissions.allow, ask and deny rules and --exclude-tools (20). Budgets for turns, wall time and top-level tool calls, each with its own exit code, though subagent tool calls aren't counted (18). Documented exit codes (18). --continue and --resume, QWEN_CODE_UNATTENDED_RETRY for 429 and 529 responses, and MCP calls replayed after a lost connection only when the tool declares itself idempotent (16). A TypeScript SDK on npm at 0.1.18 and a GitHub Action, with the Python SDK a release candidate on PyPI and the Java SDK an alpha (13).