OpenRouter puts the code sandbox inside the API request: any model can run shell server-side, with network off by default
Synopsis
OpenRouter has released two server-side code execution tools, openrouter:shell and openrouter:bash, which let a model run commands inside a platform-hosted isolated container during the API request instead of the developer operating a sandbox. Previously OpenAI, Anthropic and Google each offered this only for their own models, while self-hosting meant choosing an image, provisioning compute and owning the security boundary. Both tools are in beta, outbound network is off by default, sandbox time is billed at $0.0001 per second, and a new or sleeping container carries a 30-second minimum.
Interpretation
Running code moves from a sandbox the developer builds to one entry in the request's tools array: the model decides when it needs to run something, and the provider executes the commands in its own isolated container and returns the output to the model inside the same request. Previously, running code meant a sandbox platform such as E2B or Modal or your own Docker container, plus isolating it from your database and the internet, capping runtime and patching the image; or relying on a model vendor's hosted tool, and the OpenAI, Anthropic and Google tools each serve only their own models. One request body was sent six times changing only the model field, asking each model to run python3 -c "print(sum(range(1, 101)))" in the sandbox; openai/gpt-5.4-mini, google/gemini-3.5-flash, anthropic/claude-haiku-4.5, deepseek/deepseek-v3.2, moonshotai/kimi-k2.6 and qwen/qwen3-coder each made one shell call and all returned 5050.
The sandbox is an isolated Linux container scoped to an account and workspace, where commands run in order and each command's standard output, standard error and exit code or timeout outcome go back to the model, which then decides whether to run more or answer. openrouter:shell mirrors the shape of OpenAI's hosted shell tool and works on both the Responses and Messages APIs, while openrouter:bash mirrors Anthropic's bash tool and works on the Messages API only; setting engine to openrouter runs commands in the platform sandbox, and the default auto keeps a provider's native hosted shell for shell where one exists. In a request sent on September 22, 2026, the model issued cat /etc/os-release and python3 --version in one shell call; the container reported Ubuntu 22.04.5 LTS and Python 3.11.14, and both commands returned exit code 0.
Perspective
The demonstrated scope is short commands and bounded tasks inside a single request, such as running a script, transforming a file or checking a result; work needing a specific base image, a GPU or a session running for hours still requires a sandbox platform you operate. The tools are in beta and available only on the global openrouter.ai endpoint; in-region endpoints do not offer the shell tool, and Chat Completions rejects both tools with a 400.
The latency figures come from a set of single requests sent on September 22, 2026: a request without the shell tool returned in about 2 seconds, while requests making one shell call returned in 8 to 21 seconds depending on the model, and the source states these are single samples from one session, not a benchmark. Prompt-injection detection checks only the user-supplied message content of each incoming request and does not inspect pages, files or command output the model later reads through a tool; the detection is not exhaustive and can produce false positives, so the source advises measuring the match rate in flag mode before enforcing redact or block. Both tools are in beta, so the API may change.