w3bs.AccountStart building
PACKAGES / Open Interpreter

Open Interpreter

Coding agent built for low-cost and open models, now a Rust fork of OpenAI Codex.

ThreatCrush · No malware found
INSTALLw3bs install openinterpreter.com/open-interpreter

No w3bs yet? curl -fsSL https://w3bs.org/install.sh | sh

Get started

What to type once it is installed.

  1. w3bs install openinterpreter.com/open-interpreterInstall Open Interpreter and track it for updates
  2. interpreterStart an interactive coding session (or just type i)
  3. interpreter exec "<task>"Run one task non-interactively
  4. interpreter acpRun as an Agent Client Protocol agent for editors

Every option: interpreter --help · docs ↗

Malware scan

ThreatCrush found no malware indicators in Open Interpreter 0.0.56. The other findings below are ordinary code-review notes, not malware.

Scanned
2026-11-02 23:00 UTC · threatcrush 0.13.30
Files
6940 (installer + github.com/openinterpreter/openinterpreter@79c297a088b1)
Findings
1 critical · 16 high · 3 medium · 167 low
100+ other findings (not malware)
  • critical
    Private Keysource/codex-rs/login/src/auth/auth_tests.rs:2826secret-private-key · CWE-798
  • high
    outbound request to a non-constant URLsource/.github/scripts/macos-signing/notarize_with_akv.py:260py-ssrf-outbound-request · CWE-918
  • high
    outbound request to a non-constant URLsource/.github/scripts/macos-signing/notarize_with_akv.py:373py-ssrf-outbound-request · CWE-918
  • high
    outbound request to a non-constant URLsource/.github/scripts/macos-signing/notarize_with_akv.py:405py-ssrf-outbound-request · CWE-918
  • high
    Sensitive filesource/codex-rs/http-client/tests/fixtures/test-ca-trusted.pem:1sensitive-file-committed · CWE-538
  • high
    Sensitive filesource/codex-rs/http-client/tests/fixtures/test-ca.pem:1sensitive-file-committed · CWE-538
  • high
    Sensitive filesource/codex-rs/http-client/tests/fixtures/test-intermediate.pem:1sensitive-file-committed · CWE-538
  • high
    Generic API Keysource/codex-rs/login/src/auth/bedrock_api_key_tests.rs:42secret-generic-api-key · CWE-798
  • high
    outbound request to a non-constant URLsource/codex-rs/scripts/write_model_compatibility_catalog.py:24py-ssrf-outbound-request · CWE-918
  • high
    outbound request to a non-constant URLsource/codex-rs/scripts/write_provider_catalog.py:30py-ssrf-outbound-request · CWE-918
  • high
    outbound request to a non-constant URLsource/codex-rs/scripts/write_provider_catalog.py:240py-ssrf-outbound-request · CWE-918
  • high
    network output piped into a shellsource/scripts/install/install-open-interpreter.sh:29sh-remote-script-execution · CWE-494
  • high
    network output piped into a shellsource/scripts/install/install-open-interpreter.sh:34sh-remote-script-execution · CWE-494
  • high
    outbound request to a non-constant URLsource/scripts/ollama_qwen_smoke.py:186py-ssrf-outbound-request · CWE-918
  • high
    outbound request to a non-constant URLsource/sdk/python/_runtime_setup.py:163py-ssrf-outbound-request · CWE-918
  • high
    outbound request to a non-constant URLsource/sdk/python/_runtime_setup.py:191py-ssrf-outbound-request · CWE-918
  • high
    outbound request to a non-constant URLsource/sdk/python/_runtime_setup.py:223py-ssrf-outbound-request · CWE-918
  • medium
    unquoted expansion in a destructive commandsource/scripts/test-remote-env.sh:88sh-unquoted-expansion-destructive · CWE-78
  • medium
    eval on an expanded stringsource/scripts/test-remote-env.sh:158sh-eval-expansion · CWE-78
  • medium
    dynamic code executionsource/scripts/test-streaming-web-chat.mjs:135js-dynamic-code-execution · CWE-95
  • low
    Private Keysource/codex-rs/agent-identity/src/lib.rs:832secret-private-key · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/app-server-client/src/lib.rs:1556secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/app-server-protocol/src/protocol/common.rs:3541secret-generic-credential · CWE-798
  • low
    OpenAI API Keysource/codex-rs/app-server-protocol/src/protocol/item_builders_tests.rs:13secret-openai-key · CWE-798
  • low
    Generic API Keysource/codex-rs/app-server-protocol/src/protocol/item_builders_tests.rs:13secret-generic-api-key · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/app-server-transport/src/transport/remote_control/tests.rs:121secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/app-server-transport/src/transport/remote_control/websocket.rs:2043secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/app-server/src/models_refresh_worker_tests.rs:202secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/app-server/tests/suite/v2/account.rs:1081secret-generic-credential · CWE-798
  • low
    Generic API Keysource/codex-rs/app-server/tests/suite/v2/account.rs:1243secret-generic-api-key · CWE-798
  • low
    Generic API Keysource/codex-rs/app-server/tests/suite/v2/account.rs:1473secret-generic-api-key · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/app-server/tests/suite/v2/connection_handling_websocket.rs:306secret-generic-credential · CWE-798
  • low
    High-entropy Hex Tokensource/codex-rs/app-server/tests/suite/v2/connection_handling_websocket.rs:306secret-hex-token · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/app-server/tests/suite/v2/connection_handling_websocket.rs:334secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/cli/src/doctor/desktop/windows_security_tests.rs:67secret-generic-credential · CWE-798
  • low
    AWS Access Keysource/codex-rs/cli/src/doctor/output.rs:1826secret-aws-access-key · CWE-798
  • low
    AWS Access Keysource/codex-rs/cli/src/doctor/output.rs:1827secret-aws-access-key · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/cloud-config/src/service_tests.rs:879secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/cloud-config/src/service_tests.rs:936secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/codex-mcp/src/connection_manager_tests.rs:6303secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/config/src/loader/tests.rs:217secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/config/src/loader/tests.rs:1007secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/config/src/loader/tests.rs:1015secret-generic-credential · CWE-798
  • low
    GitHub Tokensource/codex-rs/core/src/shell_snapshot_sandbox_tests.rs:75secret-github-token · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/core/src/shell_snapshot_tests.rs:656secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/core/src/shell_snapshot_tests.rs:658secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/core/src/shell_snapshot_tests.rs:660secret-generic-credential · CWE-798
  • low
    Generic API Keysource/codex-rs/core/src/shell_snapshot_tests.rs:662secret-generic-api-key · CWE-798
  • low
    Generic API Keysource/codex-rs/core/src/shell_snapshot_tests.rs:663secret-generic-api-key · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/core/src/shell_snapshot_tests.rs:666secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/core/src/shell_snapshot_tests.rs:669secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/core/src/shell_snapshot_tests.rs:866secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/core/src/shell_snapshot_tests.rs:1202secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/core/src/shell_snapshot_tests.rs:1255secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/core/src/shell_snapshot_tests.rs:1321secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/core/src/shell_snapshot_tests.rs:1323secret-generic-credential · CWE-798
  • low
    Generic API Keysource/codex-rs/core/src/shell_snapshot_tests.rs:1325secret-generic-api-key · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/core/src/shell_snapshot_tests.rs:1431secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/core/src/shell_snapshot_tests.rs:1449secret-generic-credential · CWE-798
  • low
    GitHub Tokensource/codex-rs/core/src/tools/runtimes/mod_tests.rs:818secret-github-token · CWE-798
  • low
    GitHub Tokensource/codex-rs/core/src/tools/runtimes/mod_tests.rs:822secret-github-token · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/core/src/tools/runtimes/mod_tests.rs:867secret-generic-credential · CWE-798
  • low
    OpenAI API Keysource/codex-rs/core/src/tools/runtimes/mod_tests.rs:877secret-openai-key · CWE-798
  • low
    OpenAI API Keysource/codex-rs/core/src/tools/runtimes/mod_tests.rs:881secret-openai-key · CWE-798
  • low
    Generic API Keysource/codex-rs/core/src/tools/runtimes/mod_tests.rs:1304secret-generic-api-key · CWE-798
  • low
    JSON Web Tokensource/codex-rs/exec/tests/suite/apply_patch.rs:200secret-jwt · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/feedback/src/lib.rs:1041secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/http-client/src/route_aware_client_pool_tests.rs:241secret-generic-credential · CWE-798
  • low
    Private Keysource/codex-rs/login/src/auth/agent_identity.rs:573secret-private-key · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/login/src/auth/auth_tests.rs:1065secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/login/src/auth/auth_tests.rs:1066secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/login/src/auth/auth_tests.rs:1210secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/login/src/auth/auth_tests.rs:1211secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/login/src/auth/personal_access_token_tests.rs:41secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/login/src/auth/personal_access_token_tests.rs:72secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/login/src/gateway_auth_tests.rs:402secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/login/src/gateway_auth_tests.rs:447secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/login/src/gateway_auth_tests.rs:858secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/login/src/gateway_auth_tests.rs:1053secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/login/src/kimi_code.rs:580secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/login/src/kimi_code.rs:600secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/login/src/kimi_code.rs:601secret-generic-credential · CWE-798
  • low
    OpenAI API Keysource/codex-rs/memories/write/src/phase1.rs:669secret-openai-key · CWE-798
  • low
    OpenAI API Keysource/codex-rs/memories/write/src/phase1.rs:679secret-openai-key · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/memories/write/src/startup_tests.rs:901secret-generic-credential · CWE-798
  • low
    Generic API Keysource/codex-rs/model-provider/src/amazon_bedrock/auth.rs:383secret-generic-api-key · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/model-provider/src/amazon_bedrock/auth.rs:486secret-generic-credential · CWE-798
  • low
    Generic API Keysource/codex-rs/model-provider/src/amazon_bedrock/mod.rs:490secret-generic-api-key · CWE-798
  • low
    Generic API Keysource/codex-rs/model-provider/src/amazon_bedrock/mod.rs:658secret-generic-api-key · CWE-798
  • low
    JSON Web Tokensource/codex-rs/model-provider/src/auth.rs:452secret-jwt · CWE-798
  • low
    Generic API Keysource/codex-rs/model-provider/src/auth.rs:607secret-generic-api-key · CWE-798
  • low
    Generic API Keysource/codex-rs/model-provider/src/auth.rs:624secret-generic-api-key · CWE-798
  • low
    Generic API Keysource/codex-rs/model-provider/src/auth.rs:709secret-generic-api-key · CWE-798
  • low
    Generic API Keysource/codex-rs/model-provider/src/provider.rs:782secret-generic-api-key · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/network-proxy/src/credential_broker_tests.rs:52secret-generic-credential · CWE-798
  • low
    OpenAI API Keysource/codex-rs/network-proxy/src/credential_broker_tests.rs:53secret-openai-key · CWE-798
  • low
    Generic API Keysource/codex-rs/network-proxy/src/credential_broker_tests.rs:53secret-generic-api-key · CWE-798
  • low
    Hardcoded Credentialsource/codex-rs/network-proxy/src/credential_broker_tests.rs:89secret-generic-credential · CWE-798
  • low
    OpenAI API Keysource/codex-rs/network-proxy/src/credential_broker_tests.rs:90secret-openai-key · CWE-798
  • low
    OpenAI API Keysource/codex-rs/network-proxy/src/credential_broker_tests.rs:98secret-openai-key · CWE-798

Showing the first 100 findings.

Badge for your README

ThreatCrush: No malware found

[![ThreatCrush scan](https://w3bs.org/api/packages/openinterpreter.com/open-interpreter/badge.svg)](https://w3bs.org/packages/openinterpreter.com/open-interpreter)