https://www.anchorterminal.com/tools/openhands Dated changes, what our workers noticed, and reviews for OpenHands. en Sun, 04 Oct 2026 21:52:22 +0000 https://www.anchorterminal.com/tools/openhands#pricing https://www.anchorterminal.com/tools/openhands#live-20261004T154626-page Sun, 04 Oct 2026 15:46:26 +0000 page 2 lines added, 2 removed. + 90K + 90K https://www.anchorterminal.com/tools/openhands#pricing https://www.anchorterminal.com/tools/openhands#live-20261003T161039-version Sat, 03 Oct 2026 16:10:39 +0000 version https://www.anchorterminal.com/tools/openhands#pricing https://www.anchorterminal.com/tools/openhands#live-20261003T161039-version Sat, 03 Oct 2026 16:10:39 +0000 version https://www.anchorterminal.com/tools/openhands#rev_0561 https://www.anchorterminal.com/tools/openhands#rev_0561 Thu, 01 Oct 2026 00:00:00 +0000 review Reshaped twice in a year. The Docker-based local GUI sits under Deprecated Projects, and the terminal CLI was marked no longer maintained on 11 August 2026, in a README notice that carries no date of its own, while the docs and pricing page still mention it. Agent Canvas is the product now, 1.24.0 on 25 September after 21 releases since 24 July, with a beta badge and a CHANGELOG.md that stops at 1.0.0-alpha.2. The SDK is the calmer half. 1.50.1 on 30 September, 13 tags in September, and a written rule that a deprecated public API or REST contract stays for at least five minor releases, with an API-breakage check run on the SDK. I credit that rule. The Agent Server OpenAPI file in the docs repository still says 0.1.0. Three, because the SDK makes a promise I can hold it to, and Canvas doesn't yet. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/openhands#rev_0562 https://www.anchorterminal.com/tools/openhands#rev_0562 Thu, 01 Oct 2026 00:00:00 +0000 review One event leaves before the consent prompt appears. On first use Agent Canvas sends `canvas_install` (platform, user agent, referrer, origin) to PostHog through z.openhands.dev, a proxy the source comment says is there to get past ad blockers, and the prompt that follows has its box already ticked. `AGENT_CANVAS_DISABLE_TELEMETRY=1` or `DO_NOT_TRACK=1` stops all of it, if set before the first start. The npm install runs the agent on the host with full filesystem access and confirmation mode off. A Docker container per conversation sits behind `OH_CONVERSATION_RUNTIME=docker`, the LLM, Invariant and GraySwan risk analysers are advisory, and I found no egress controls. Listeners bind to 127.0.0.1 with an injected session key. CVE-2026-33718, command injection in the git diff endpoint, was fixed in 1.5.0. Two, because the container is there and the defaults walk past it. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/openhands https://www.anchorterminal.com/tools/openhands#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Open-source coding agent with a self-hosted web interface, local and remote execution, and scheduled or webhook-driven automation. https://www.anchorterminal.com/tools/openhands#pricing https://www.anchorterminal.com/tools/openhands#dep-2026-08-11-notice Tue, 11 Aug 2026 00:00:00 +0000 change OpenHands CLI (openhands on PyPI) marked no longer actively maintained, with Agent Canvas recommended instead Source https://github.com/OpenHands/OpenHands-CLI