The report
OpenHands software-agent SDK addressed a high-impact sandbox control-plane exposure in release 1.52.0. Earlier configurations could expose an agent server listening beyond the local process while relying on empty or absent session API keys. The risk was not an AI model hallucinating a command: it was a reachable service with authority to carry out commands inside the agent workspace.
How the boundary failed
The upstream patch discussion describes changes that bind published container ports to the loopback address rather than all host interfaces. It also covers authenticated session handling. Those controls are complementary: network binding limits who can reach a listener, and an application session key limits who may invoke actions after reaching it. A stronger bind does not excuse missing authentication, and an API key does not make an unnecessarily public command listener desirable.
The affected executor ran in an agent sandbox, with potential access to files and secrets placed there. That must not be confused with a demonstrated escape into the physical Docker host. Deployment-specific port publishing and key configuration determine whether a remote actor could reach the exposed interface.
What operators should verify
Upgrading a package is not the complete test. Operators need to inspect effective Docker or Apptainer networking, listen addresses, published ports, session-key enforcement, and whether reverse proxies or development tunnels make the service externally accessible. An HTTP or WebSocket path that still accepts anonymous control commands would undermine the fix even if the model itself is well-behaved.
This case is also a warning about naming. An "agent server" is ordinary software with ordinary execution privileges; the runtime should authorize its callers independently of any prompt-level safety rules. The technical dossier separates the exposure, the supplied repairs, and the unverified production-victim question.
Status: a source patch and corrected SDK release are documented. The public record does not establish exploitation in the wild or an escape outside the isolated workspace.