Test

Status: PASS (Hetzner server, 2026-07-01)

Open Interpreter imports cleanly inside the dedicated venv on the Hetzner agent-runtime server. Local host testing remains blocked by arbitrary-code-execution risk (see original note below).

Hetzner (server)

Verify command:

ssh -o BatchMode=yes -o ConnectTimeout=15 agent-runtime-hetzner-1 \
  'source ~/browser-tools/venv-oi/bin/activate && python -c "import interpreter;print(\"open-interpreter ok\")"'

Real output (2026-07-01):

open-interpreter ok

Exit code: 0. The interpreter package imported without error inside ~/browser-tools/venv-oi/.

---

Why local host testing was not done

Open Interpreter can run shell commands, write files, and execute code on the host machine with no network boundary. Installing and running it against the host OS without an isolated sandbox (VM or container) is unsafe. The package (pip install open-interpreter) would install successfully, but executing any test command creates real risk of unintended side effects.

What is required before full local testing

• An isolated environment: a throwaway VM, a Docker container with no host mounts, or an E2B sandbox
• An LLM API key (OpenAI or compatible)
• The install step: pip install open-interpreter

Smoke test procedure (run inside an isolated environment only)

Step 1: Verify the binary is on PATH

which interpreter

Expected output (Linux/macOS):

/home/<user>/.local/bin/interpreter

Step 2: Version check

interpreter --version

Expected output: A version string such as interpreter 0.x.x.

Step 3: Non-interactive exec (safe pattern)

interpreter exec "Print the word READY and nothing else."

Expected output: READY printed to stdout, exit code 0.

Sandbox modes

Mode	Behavior
read-only	Can inspect allowed files but cannot write
workspace-write	File modifications permitted within designated directories; network off by default
danger-full-access	No sandbox boundary. Use only in a trusted, isolated environment

Approval policies

Policy	Behavior
untrusted	Pauses before all state-changing operations
on-request	Runs within sandbox, pauses only when escalation is requested
never	No prompts; sandbox alone provides guardrails

Do not use until

A dedicated isolated environment (VM or container) is provisioned and no sensitive credentials or host files are accessible from within it.