Open Interpreter
- Category
- Simple analysis
- Type
- open-source (Apache-2.0)
- Scope
- local code-executing agent
- Source
- Repository
- Last reviewed
- 2026-10-18 (what this means)
Summary
Open Interpreter is an open-source agent that runs code on the user's computer from natural-language instructions. Its repository now tracks a rewrite built on Codex; the earlier Python version continues in a community fork. Independent security studies, mostly preprints and self-published projects, tested the earlier Python version; we found no independent evaluation of the current product, so no overall score is given. Insufficient evidence. Informational only; not a guarantee, endorsement, or certification.
Status: Insufficient evidence — no overall score is given (fewer than three independent performance sources). Independent performance sources: 0 for the current product.
Factor notes (no scores)
| Factor | Weight | Score | Note |
|---|---|---|---|
| Completion rate | 30% | — | No independent evaluation of Open Interpreter's own task success was found; one benchmark used it only as a fixed harness to compare models. |
| Disputes | 20% | — | No lawsuits or regulatory actions were found. No CVE (NVD) or reviewed GitHub Advisory Database entry was found. Public reports allege security issues in the earlier Python version; the maintainer closed them as concerning the legacy product. |
| Adherence to limits | 25% | — | Studies report high attack-success rates for the earlier Python version in risky-code and prompt-injection tests; a 2026 survey (GuardFall) found it applied no static command guard by default, relying on approval prompts. Documentation for that version describes confirmation before running code unless auto-run is enabled, and an experimental safe mode that is off by default. The current product's sandbox and approval modes have not been independently evaluated. |
| Evidence quality | 25% | — | No independent evaluation of the current product; studies of the earlier Python version are preprints or self-published, none peer-reviewed. |
See the methodology for the insufficient-evidence rule.
Uncertainties
- Evidence concerns the earlier Python version; the current product is a rewrite and may behave differently.
- Results in the studies depend heavily on the underlying model.
- None of the studies found is peer-reviewed.
- Fix status of the public security reports in the community fork was not checked.
- No reputable journalism with original testing was found.
- Terminal-Bench figures published by the maintainer for the current product are vendor-run and not used.
Sources
- CIBER (2026): security benchmark of code interpreter agents (arXiv preprint, not peer-reviewed; earlier Python version) [outside entry scope; not counted] — independent performance, accessed 2026-10-16
- RedCode extension evaluating Open Interpreter on risky code execution (self-published project; earlier Python version) [outside entry scope; not counted] — independent performance, accessed 2026-10-16
- ARPIbench: reflected prompt-injection benchmark (self-published repository; modified earlier Python version) [outside entry scope; not counted] — independent performance, accessed 2026-10-16
- GuardFall (Adversa AI, 30 June 2026): shell-injection guard survey of 11 agents selected as of May 2026; Open Interpreter (earlier Python version, default configuration) had no static command guard; optional safe_mode not tested [outside entry scope; not counted] — independent performance, accessed 2026-10-18
- IDA-Bench (2025): interactive guided data analysis (model benchmark using Open Interpreter as a harness; arXiv preprint; measures models, not Open Interpreter) — independent other, accessed 2026-10-16
- RedCode: risky code execution and generation benchmark (background benchmark; arXiv) — independent other, accessed 2026-10-16
- GitHub issue #1767: report concerning the /settings endpoint (public security report; closed by maintainer as concerning the legacy Python product) — independent other, accessed 2026-10-16
- GitHub PR #1691: proposed hardening of macOS hotkey handling (public security report / proposed fix; closed, not merged) — independent other, accessed 2026-10-16
- GitHub PR #1741: proposed changes to OS-mode auto-run and remote profiles (public security report / proposed fix; closed, not merged) — independent other, accessed 2026-10-16
- GitHub Security Advisories page for the repository (advisory registry; no published advisories found) — independent other, accessed 2026-10-16
- Open Interpreter repository (current product) — vendor or maintainer, accessed 2026-10-16
- Open Interpreter documentation (current product: sandbox and approval modes) (maintainer documentation) — vendor or maintainer, accessed 2026-10-16
- MrTechKing repository scan of the current Rust product (commit b171530, 27 September 2026): no malicious code found; installer and updater pipe a remote script to the shell; 101 dependency advisories, none critical — other (repository scan, no behaviour test), accessed 2026-10-18
- Community-maintained fork of the earlier Python version (community fork) — independent other, accessed 2026-10-16
- Safe mode documentation (states it is experimental and provides no guarantees) (maintainer documentation; earlier Python version) — vendor or maintainer, accessed 2026-10-16