01
Overview
OpenRouter added a new execution layer to its model-routing platform on September 8, 2026: a hosted Shell tool, Bash tool, Files API and reusable Linux containers. The practical change is simple: a model can now inspect files, write scripts, execute commands, read stdout and stderr, fix failures, and return generated files without the developer standing up a separate sandbox service.
02
What launched
OpenRouter's beta release includes openrouter:shell, openrouter:bash, workspace file storage and containers. The Shell tool follows the OpenAI-compatible shell pattern and works through OpenRouter's Responses and Messages APIs. The Bash tool follows Anthropic's Bash pattern and is available through Messages. Setting engine: "openrouter" forces commands to run inside OpenRouter's hosted environment rather than in the calling application.
03
How the runtime works
When a model invokes Shell, it emits a batch of commands. OpenRouter executes them in a Linux container and sends stdout, stderr and exit codes back to the model. The model can then react to the result. That matters for agent loops: a failed parser can be fixed, a generated script can be rerun, and a file can be produced without another external execution service. Containers are scoped to the workspace. Outbound networking is disabled by default. Developers can supply an allowlist of domains, including a wildcard when unrestricted egress is intentionally required. OpenRouter says the network policy cannot be changed after a container starts, so the egress decision should be made at creation time.
04
Files API
The Files API provides workspace-level storage under /api/v1/files. Inputs can be uploaded, attached to a container by file ID and used by the model during execution. Container-generated files receive their own IDs and can be downloaded. A generated file can also be promoted into workspace storage for reuse in later runs. OpenRouter currently limits a container to 20 attached files. Files written in the container are captured from /workspace/home. Container files are retained for 30 days unless promoted into workspace storage.
05
Container reuse
A fresh conversation normally gets a fresh container. OpenRouter can reuse a container when the request includes a session ID or a prior shell result that identifies that container. Developers can also explicitly reference a container ID. Reuse can matter for multi-step jobs because state and files can survive across successive requests.
06
Pricing
OpenRouter bills Shell and Bash by active sandbox time at \$0.0001 per second. A request that starts a cold container has a minimum charge equivalent to 30 seconds of sandbox time. If several requests reuse the same active container in succession, only the first pays that cold-start minimum. Token charges for the selected model remain separate. Files API usage has no separate charge in the current beta, while total workspace storage is capped at 10 GiB. OpenRouter says idle time after a request is not billed.
07
What can you build with it?
The strongest use cases are tasks where a model needs both reasoning and an execution environment: analyzing CSVs, running Python, transforming media or documents, validating generated code, producing charts or artifacts, packaging files, and chaining web research into programmatic processing. The feature is model-agnostic at the routing layer. That means teams can switch between compatible tool-calling models while keeping the same execution primitive, instead of rebuilding their sandbox integration around one model vendor.
08
Important limitations
This is a beta. API details, limits and pricing can change. OpenRouter's isolation and networking behavior are documented by OpenRouter; they should not be interpreted as an independent security certification. Teams handling sensitive data should still apply their own security review, provider policy controls and least-privilege network rules.
09
FAQ
Is OpenRouter Shell available now?
Yes. OpenRouter announced Shell, Bash, Files API and containers as available in beta on September 8, 2026.
Does every model work with Shell?
OpenRouter says the server-side Shell tool can be used with models that support tool calling. Model behavior and reliability will still vary.
How much does OpenRouter Shell cost?
Current sandbox pricing is \$0.0001 per active second, with a 30-second minimum when a request starts a cold container. Model-token charges are additional.
Does the container have internet access?
Not by default. Outbound access starts disabled and can be enabled through an allowlist policy.
Can files persist between requests?
Yes. Container state can be reused across requests, and generated files can be promoted into workspace storage for longer-lived reuse.
10
Sources
Primary source: OpenRouter, “Give any model a terminal and files,” September 8, 2026. Supporting technical details come from OpenRouter's Shell, Containers and Files API documentation.
Sources
Primary and supporting sources
Facts were rechecked against the linked sources immediately before publication. Pricing, product availability and rollout status can change.