Tencent Releases WeKnora v0.8.0: Agentic RAG Shift with Sandbox Isolation and Memory

Tencent has released WeKnora v0.8.0, transforming its open-source LLM knowledge platform into an agentic RAG system with session sandboxing, cross-session memor

tau · September 11, 2026

#WeKnora #Tencent #RAG #AgenticRAG #OpenSource #DevTools #AIAgents

Tencent Releases WeKnora v0.8.0: Agentic RAG Shift with Sandbox Isolation and Memory

Tencent has officially rolled out WeKnora v0.8.0, marking a major architectural transition for its open-source LLM knowledge platform from standard document retrieval-augmented generation (RAG) into a fully capable autonomous agentic platform. Distributed under the MIT license and boasting over 22,000 GitHub stars, the platform now prioritizes enterprise-grade execution security and persistent user interaction mechanisms.

Architectural overview of Tencent WeKnora v0.8.0 open-source agentic RAG platform featuring session sandbox isolation and cross-session long-term memory systems

Image source: Tencent WeKnora / @TencentAI_News

While conventional RAG implementations remain confined to static document chunking and vector similarity retrieval, WeKnora v0.8.0 re-architects the system into an 'Agentic RAG' framework where language models autonomously invoke tools and specialized skills, retain context across multiple sessions, and systematically decompose multi-step reasoning tasks.

Session-Isolated Sandboxes and Outbound Network Egress Control

The most pivotal security advancement in WeKnora v0.8.0 is the complete isolation of code and script execution environments from the host system.

Legacy host process direct-execution backends have been entirely decommissioned in this release. In their place, WeKnora establishes dedicated session-isolated sandboxes as the default runtime environment, ensuring multi-tenant security when agents execute autonomous tasks.

  • Pluggable Sandbox Backends: The system natively supports local Docker daemon environments as well as specialized cloud sandbox infrastructure including E2B and Cube backends, allowing engineering teams to align with their specific hosting architecture.
  • Tenant Outbound Network Egress Control: To mitigate unauthorized data exfiltration during web browsing or third-party API integration, operators can configure fine-grained outbound egress network filtering policies at the tenant level.
  • Runtime Execution Containment: Every user and task session operates within an ephemeral or segregated container, preventing script injections and unintended host resource degradation.

Cross-Session Long-Term Memory and Tenant Skill Catalog Assets

To deliver continuous assistant capabilities across long-term engagements, WeKnora v0.8.0 introduces a dedicated cross-session long-term memory architecture.

Moving beyond simple transcript preservation, the system automatically extracts and categorizes salient information into five distinct domains: user profiles, preferences, verified facts, active tasks, and specific interests.

  • User Confirmation-Gated Persistence: To combat LLM hallucination and protect user privacy, extracted memory candidates require explicit user confirmation (confirm) before they are permanently stored in the knowledge base.
  • Contextual Retrieval via Search Memory: Persisted facts and preferences are dynamically retrieved during subsequent sessions using the search_memory interface, feeding relevant historical context into the prompt chain.
  • Assetized Tenant Skill Catalogs: Ad-hoc automation scripts are now formally elevated to first-class tenant skill catalog assets. Teams can version, validate, and preload custom skills sourced from ClawHub, SkillHub, external Git repositories, or packaged ZIP archives.

Production Upgrade Considerations and Deployment Requirements

For engineering teams upgrading existing WeKnora deployments to v0.8.0, several structural prerequisites require careful operational preparation.

Chief among these is the complete elimination of host-level script execution. Environments that previously relied on running Python or shell automation directly on the host machine must configure a Docker runtime or provision cloud sandbox credentials (such as E2B or Cube) prior to rolling out v0.8.0.

Furthermore, because the long-term memory pipeline enforces user confirmation by default to ensure privacy and factual integrity, frontend applications and workflow integrations should anticipate and incorporate this interactive confirmation step within their user experience.

Sources