Skip to content
AppDuo
ReviewsComparisonsBest ofCollections

goose vs OpenHands: an agent on your machine or an agent platform for teams?

By Official AppDuo editorial team · Updated

goose logogoose7.3/10Open source · FreeOpenHands logoOpenHands6.9/10Open source · Free

Quick verdict

Both are open-source AI agents, free at the base level, with model costs paid by you. The difference is where the agent runs, who shares it and which security risks you accept.

goose: a desktop app (macOS, Linux, Windows), CLI and API that run on your machine and connect to 15+ model providers, local models included. There is no paid plan or official support. Block published an internal red-team exercise in which a poisoned recipe ran an infostealer.

OpenHands: a self-hosted platform built around Agent Canvas, a Python SDK and an Agent Server, able to drive other agents such as Claude Code and Codex. It sells a $500/month Teams plan and an Enterprise tier for businesses. It has had a patched high-severity CVE and a reported prompt-injection token leak with no confirmed fix, and its privacy policy allows content that reaches its services to be used for model training.

Head-to-head

goose leads on 2, OpenHands on 1, 6 even

FeaturegooseOpenHands
Where the agent runs and how you use it[1],[2],[11],[13],[21]Runs on your machine: desktop app for macOS, Linux and Windows, plus a CLI and an API. For the native Windows CLI the install page recommends Git Bash.Agent Canvas is an open-source web client that connects to local, self-hosted, Cloud or Enterprise backends. The legacy CLI is no longer actively maintained and the openhands serve GUI is deprecated.
→ An individual who wants an agent on their own computer should look at goose; a team that wants agents on shared infrastructure should look at OpenHands. Users of the old OpenHands CLI or GUI need to move to Agent Canvas.
Model providers[2],[3],[21]15+ providers (Anthropic, OpenAI, Google, Ollama, OpenRouter, Azure, Bedrock and more), local models via Ollama or LM Studio, and existing Claude, ChatGPT or Gemini subscriptions through ACP.Per the README, any LLM through your own key; Agent Canvas can also run third-party agents such as Claude Code, Codex, Gemini CLI and OpenCode.
→ goose's docs spell out local options and which providers have free tiers; OpenHands fits better when you want to orchestrate several existing agents from one place.
Cost for an individual[3],[12]Free (Apache 2.0). Costs sit with the model provider: Groq and Google Gemini have free tiers, local models carry no service fee, OpenRouter is pay-per-use.Agent Canvas is free (MIT) and self-hosted, for a single user or shared identity; you pay for your own LLM usage and infrastructure. No paid plan for individuals.
→ Neither charges for the software itself; real cost depends on the model you pick, plus the infrastructure that runs agents in OpenHands' case.
Team plans and support[1],[2],[12]No paid plan or official support; help comes from docs, Discord and GitHub (400+ open issues at check time).Teams is $500/month per the official pricing page, up to 10 users, $50/month per extra seat, capped at 5,000 sessions a month; SSO/SAML, RBAC, budgeting, best-effort email support and a 30-day trial. Enterprise is custom-priced with SLA support.
→ Of the two, only OpenHands offers SSO, roles, budget controls and vendor support, with an SLA only on Enterprise. goose sells no plan.
Documented security issues[8],[9],[16],[17],[18],[19]Confirmed: per Block (2026-01-15) and The Register, the internal Operation Pale Fire red-team exercise used a poisoned recipe to run an infostealer on an employee's machine. Block added recipe-instruction display and invisible-character filtering; the sources report no harm to outside users.CVE-2026-33718 (CVSS 7.6): an authenticated user could inject commands via the git diff endpoint; fixed in 1.5.0. Separately, researcher Johann Rehberger published (2025-08-09) a prompt-injection route to leak GITHUB_TOKEN; the post does not confirm a fix.
→ Both show prompt injection is a real risk for coding agents. Block states that goose and other LLM coding tools 'can not effectively isolate untrusted context', and OpenHands acknowledges its sandbox does not stop exfiltration of secrets in the agent's environment.
Built-in safeguards[2],[5],[6],[19]Tool permissions, prompt-injection detection, adversary mode and sandbox mode. The docs say detection is a safeguard, not a guarantee, and approved commands run with your full permissions.Each conversation runs in a Docker container; the vendor suggests confirmation mode, a security analyzer built with Invariant Labs and network policies for self-hosted setups.
→ goose runs with your own permissions on your machine, so vet extensions and recipes carefully; OpenHands isolates agents in containers but you still need to keep secrets out of the agent's environment.
Data and privacy[4],[6],[14]Anonymous usage metrics are opt-in and exclude conversations, code and tool arguments. Your content still reaches the LLM provider you choose, and optional ML prompt-injection detection sends tool-call content and recent messages to the endpoint you configure.All Hands AI's policy allows submitted content to be used for model training, with no stated opt-out. Self-hosted, agents run on your infrastructure; data passes through the vendor only if you connect to its Cloud backend.
→ If you do not want your code covered by a developer's model-training terms, goose avoids that; with OpenHands you need to stay fully self-hosted and off the Cloud backend.
Interface languages[10],[13]Per the source code, the desktop app ships 16 interface languages, including English, Vietnamese, Japanese and Korean.The official site and docs are English-only; the vendor publishes no list of interface languages.
→ People who are not comfortable in English will find goose easier to navigate.
Automation and extensibility[1],[2],[13],[20],[21]Recipes (portable YAML workflows), parallel subagents, MCP Apps, 70+ MCP extensions and ACP for Zed, JetBrains and VS Code. Also usable for non-coding work.Python SDK, Agent Server (REST/WebSocket), scheduled or webhook-triggered agents, and integrations with GitHub, GitLab, Bitbucket, Slack and Jira.
→ goose extends the tools of one agent on your machine; OpenHands fits when you want agents wired into the team's repos, tickets and shared workflows.

Choose goose if…

  • Developers who want a free agent running on their own machine, as a desktop app or CLI
  • People who want to pick their own model, including local models via Ollama or LM Studio
  • People who want to automate non-coding work with MCP extensions and recipes

Choose OpenHands if…

  • Engineering teams that want to self-host coding agents on shared infrastructure with their own LLM
  • Organisations that need SSO, roles and budget controls and can justify the $500/month Teams plan
  • Developers who want to build agents with the Python SDK or orchestrate Claude Code and Codex from one place

A local agent versus a team platform

goose is a general-purpose agent that runs on your machine: a desktop app for macOS, Linux and Windows, a CLI and an API. Block released it in early 2025 and contributed it to the Linux Foundation's Agentic AI Foundation when that foundation launched on 2025-12-09. Its README describes uses beyond coding, such as research, writing and automation.

OpenHands, formerly OpenDevin, is developed by All Hands AI and aims at running coding agents across an organisation. Its centre is Agent Canvas, a web client that connects to self-hosted, Cloud or Enterprise backends, alongside a Python SDK and an Agent Server. Per the docs, the legacy CLI is no longer actively maintained and the openhands serve GUI is deprecated.

Models and what you actually pay

The software is free on both sides: goose under Apache 2.0 and OpenHands' Agent Canvas under MIT. The cost is the model. goose's docs list 15+ providers, with free tiers at Groq and Google Gemini and no service fee for local models via Ollama or LM Studio; some connections need a separate subscription such as ChatGPT Plus/Pro or Claude Code. OpenHands uses your own LLM key, and you pay for the infrastructure that runs agents.

For teams, only OpenHands sells a plan: Teams at $500/month for up to 10 users ($50/month per extra seat, 5,000 sessions a month), and custom-priced Enterprise. goose sells no plan and has no official support. The OpenHands pricing page does not list Cloud prices.

Security: what has been documented

For goose, the risk was disclosed by Block itself. Per its engineering post of 2026-01-15 and The Register, its internal red team hid instructions in calendar invites and recipes using invisible Unicode characters; in the third campaign an employee ran a poisoned recipe and an infostealer ran on their machine. Block's detection and response team identified and contained the simulated threat. It was an internal exercise, and the sources report no harm to outside users. goose then added recipe-instruction display, invisible-character filtering and prompt-injection detection, though the docs say this is not a guarantee.

For OpenHands, a GitHub advisory of 2026-03-23 disclosed CVE-2026-33718 (CVSS 7.6): an authenticated user could run arbitrary commands in the sandbox via the git diff endpoint; it was fixed in 1.5.0. Johann Rehberger's report (2025-08-09) of leaking GITHUB_TOKEN through prompt injection remains a researcher's claim: he says he reported it privately on 2025-03-13 and got a vendor response only 148 days later, and his post does not confirm a fix. On 2025-08-14 OpenHands published a post on mitigating prompt injection, said it had seen proof-of-concept attacks but no real-world attack, and acknowledged its sandbox does not stop exfiltration of secrets in the agent's environment. That post does not address Rehberger's report specifically.

Data handling and interface language

goose sends anonymous usage metrics only if you opt in, excluding conversations, code and tool arguments; your working content still goes to the LLM provider under its own policy. All Hands AI's privacy policy (effective 2025-09-03) lets the company use content and feedback to train its models and describes no opt-out; self-hosted, data passes through the vendor only if you connect to the Cloud backend.

On interface language, goose's desktop source ships 16 languages, Vietnamese among them. The OpenHands site and docs are English-only, and the vendor publishes no list of interface languages.

Frequently asked questions

Are goose and OpenHands free?

The software is: goose under Apache 2.0, OpenHands' Agent Canvas under MIT. You still pay the model provider unless you use a free tier or a local model, and self-hosted OpenHands also needs your own infrastructure.

What does a 10-person team pay?

goose has no team plan; you pay only for each person's model usage. OpenHands Teams is $500/month for up to 10 users, with SSO, roles and budget controls; LLM costs are separate.

Which is safer against prompt injection?

The sources do not support calling either one safer. Block published a red-team exercise that ran malware through a goose recipe; OpenHands has a patched CVE and a token-leak report with no confirmed fix. Both vendors say their current safeguards do not stop every case.

Can they run local models?

goose's docs list Ollama, LM Studio and several other local options; models without tool calling can only chat. The OpenHands README says only that any LLM works with your own key; the sources cited here do not cover local models specifically.

Is there a Vietnamese interface?

goose does: per its source code, the desktop app ships a Vietnamese interface alongside 15 other languages. The OpenHands site and docs are English-only.

Sources

Numbers in the table refer to these sources, read on the dates shown.

  1. 1.Official site · Vendor-provided · Nov 11, 2026
  2. 2.GitHub README · Vendor-provided · Nov 11, 2026
  3. 3.Official docs: providers and costs · Vendor-provided · Nov 11, 2026
  4. 4.Official docs: usage data · Vendor-provided · Nov 11, 2026
  5. 5.Official docs: staying safe · Vendor-provided · Nov 11, 2026
  6. 6.Official docs: prompt injection detection · Vendor-provided · Nov 11, 2026
  7. 7.Linux Foundation: Agentic AI Foundation announcement (2025-12-09) · press · Nov 11, 2026
  8. 8.Block Engineering: how we red teamed our own AI agent (2026-01-15) · Vendor-provided · Nov 11, 2026
  9. 9.The Register (2026-01-12) · press · Nov 11, 2026
  10. 10.Desktop app locale list (source code) · Vendor-provided · Nov 11, 2026
  11. 11.Official docs: installation · Vendor-provided · Nov 11, 2026
  12. 12.Official pricing page · Vendor-provided · Nov 11, 2026
  13. 13.Official documentation · Vendor-provided · Nov 11, 2026
  14. 14.All Hands AI privacy policy · Vendor-provided · Nov 11, 2026
  15. 15.GitHub repository · Vendor-provided · Nov 11, 2026
  16. 16.GitHub Security Advisory GHSA-7h8w-hj9j-8rjw · Vendor-provided · Nov 11, 2026
  17. 17.OSV: CVE-2026-33718 · Community-reported · Nov 11, 2026
  18. 18.Embrace The Red: OpenHands and the Lethal Trifecta (2025-08-09) · press · Nov 11, 2026
  19. 19.OpenHands blog: Mitigating prompt injection attacks in software agents · Vendor-provided · Nov 11, 2026
  20. 20.OpenHands Cloud documentation · Vendor-provided · Nov 11, 2026
  21. 21.GitHub README (Agent Canvas) · Vendor-provided · Nov 11, 2026

Prepared by the AppDuo Editorial Team from the sources cited in this article. AI assists with organising and cross-checking data; editorial responsibility remains with AppDuo.

Comments

No comments yet. Be the first to share your experience.

Comments are readers’ opinions, not content from the AppDuo Editorial Team.