OpenHands' local terminal inherits a key that reaches excluded secrets
At Canvas 1.27.1 with SDK/agent-server 1.54.0, the default local runtime's terminal can inherit OPENHANDS_AUTOMATION_API_KEY, an alias of the stack session key. SDK sanitization misses the alias, and the authenticated raw-secret route lacks a conversation-profile check. Profile selection therefore does not establish a credential boundary on that path. This is a source-derived path across pinned releases, not a reproduced exploit.
What this changes for operators
- npm, desktop and Docker-image users running terminal-enabled local conversations: keep production/deploy secrets out of this shared store when agents read untrusted repositories. Inspect the terminal environment and whether its effective key can retrieve a saved-but-excluded test secret.
- Where secret selection must hold, trial OH_CONVERSATION_RUNTIME=docker with OH_CONVERSATION_IMAGE pinned to ghcr.io/openhands/agent-server:1.54.0-python and exclude the automation key from the profile. This construction does not copy the outer alias wholesale; withholding it removes this inherited-key route to automation creation.
- Require a released alias removal, sanitization repair or automation-only key and denied-secret tests on both runtimes before trusting the boundary. Container construction alone is insufficient. The review moves from the profile label to actual terminal credentials and protected-route behavior.
Primary sources
- tagged_commit_file 2026-10-13-openhands-profile-secret-scopes-do-not-bind-the-agent-s-own-terminal-the-stack-s-session-key-is-in OpenHands/OpenHands / scripts/dev-with-automation.mjs#L906-L915
- tagged_commit_file 2026-10-13-openhands-profile-secret-scopes-do-not-bind-the-agent-s-own-terminal-the-stack-s-session-key-is-in OpenHands/software-agent-sdk / openhands-sdk/openhands/sdk/utils/command.py#L16-L30
- tagged_commit_file 2026-10-13-openhands-profile-secret-scopes-do-not-bind-the-agent-s-own-terminal-the-stack-s-session-key-is-in OpenHands/software-agent-sdk / openhands-agent-server/openhands/agent_server/settings_router.py#L492-L522
- tagged_commit_file 2026-10-13-openhands-profile-secret-scopes-do-not-bind-the-agent-s-own-terminal-the-stack-s-session-key-is-in OpenHands/OpenHands / src/api/agent-server-adapter.ts#L274-L359
- merged_pr 2026-10-13-openhands-profile-secret-scopes-do-not-bind-the-agent-s-own-terminal-the-stack-s-session-key-is-in github.com/OpenHands/OpenHands/pull/17279
- official_docs 2026-10-13-openhands-profile-secret-scopes-do-not-bind-the-agent-s-own-terminal-the-stack-s-session-key-is-in github.com/OpenHands/OpenHands/issues/16492
- merged_pr 2026-10-13-openhands-per-conversation-docker-containers-ship-through-oh-conversation-runtime-the-execution-only github.com/OpenHands/OpenHands/pull/17177
- merged_pr 2026-10-13-openhands-per-conversation-docker-containers-ship-through-oh-conversation-runtime-the-execution-only github.com/OpenHands/software-agent-sdk/pull/4883
- merged_pr 2026-10-13-openhands-per-conversation-docker-containers-ship-through-oh-conversation-runtime-the-execution-only github.com/OpenHands/software-agent-sdk/pull/3403
- tagged_commit_file 2026-10-13-openhands-per-conversation-docker-containers-ship-through-oh-conversation-runtime-the-execution-only OpenHands/software-agent-sdk / openhands-agent-server/openhands/agent_server/docker_runtime/registry.py#L462-L490
- tagged_commit_file 2026-10-13-openhands-per-conversation-docker-containers-ship-through-oh-conversation-runtime-the-execution-only OpenHands/software-agent-sdk / openhands-agent-server/openhands/agent_server/config.py#L72
- tagged_commit_file 2026-10-13-openhands-per-conversation-docker-containers-ship-through-oh-conversation-runtime-the-execution-only OpenHands/docs / openhands/usage/agent-canvas/backend-setup/docker-execution.mdx#L8-L21
- commit 2026-10-13-openhands-per-conversation-docker-containers-ship-through-oh-conversation-runtime-the-execution-only github.com/OpenHands/docs/commit/f39a24e7ef6591c2eb9bc64160542f5724b0ed55
- tagged_commit_file 2026-10-13-openhands-per-conversation-docker-containers-ship-through-oh-conversation-runtime-the-execution-only OpenHands/OpenHands / README.md#L107-L122
- tagged_commit_file 2026-10-13-openhands-per-conversation-docker-containers-ship-through-oh-conversation-runtime-the-execution-only OpenHands/OpenHands / src/api/conversation-workspace.ts#L18-L22
Signal metadata
Source findings
- 2026-10-13-openhands-profile-secret-scopes-do-not-bind-the-agent-s-own-terminal-the-stack-s-session-key-is-in 2026-10-13-openhands-profile-secret-scopes-do-not-bind-the-agent-s-own-terminal-the-stack-s-session-key-is-in
- 2026-10-13-openhands-per-conversation-docker-containers-ship-through-oh-conversation-runtime-the-execution-only 2026-10-13-openhands-per-conversation-docker-containers-ship-through-oh-conversation-runtime-the-execution-only
Featured in
- The Handoff Has an API / 2026-10-13
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Schema: bitter.frontier_signals.v0 / ID: 2026-10-13-openhands-local-terminal-inherits-the-stack-key
Research evidence and publication history are open in the repository.