The best harnesses for a personal agent, by our grades

If you've tried to run a personal agent of your own this year you've probably met OpenClaw, or one of the projects that grew up around it with a claw somewhere in the name, and you've probably noticed that the model is the easy part. The model answers questions. Everything else, reading your WhatsApp or Telegram, remembering what you told it last Tuesday, holding the keys to your email and calendar, waking up at seven to send you a summary, is done by a program you run on your own computer or a small server, and that program is what people have started calling the harness. It's become popular enough that Minisforum now ships OpenClaw pre-installed on its AI NAS, and recommends it on its mini PCs ^{[1] [2]}.

We list eleven of these in our Personal assistants category, all open source, all graded on 12 October 2026 by the same checklist we use for every other tool ^[3]. Anchor Terminal's founder, Vlad Cealicu, builds LocalGhost, which keeps a personal archive and memory on the owner's machine and so does part of the same job. LocalGhost sits in the same category at C, 55.5, and we've left it out of everything below ^[4]. The eleven were each graded once under our normal procedure, not the two-grader procedure we use for listings that compete with LocalGhost head on, and seven of them land between 62 and 70, so a couple of points either way shouldn't decide anything for you ^[5].

The question we kept coming back to

Our checklist was written for tools an agent calls, so it scores a harness on its interfaces, its security record, how it's maintained and how well it's documented. Those things matter, but when the thing you're installing can send messages as you and run commands on your laptop, the question that matters more is simpler, and the checklist doesn't have a line for it yet. What does it do before it acts? Does it ask you, does it ask a second model, or does it just go? We read that out of each listing's evidence and put it next to the grade, because the grade alone hides it ^[5].

Grades and scores are from our listings on 18 October 2026, and the last column from the evidence behind each one ^{[3] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16]}.

Read down that last column and six of the eleven have no approval step at all by default, which is OpenClaw, nanobot, AstrBot, CowAgent, PicoClaw and Leon, and IronClaw has one that its own default turns off ^{[9] [10] [11] [13] [14] [15] [16]}. That's the setting to look for before you connect any of your accounts.

OpenClaw, since most people start there

It's the one with the community, about 391,800 GitHub stars, and a lot of what it does is sensible, like keeping memory as plain Markdown files you can open and read, and offering four permission modes from read-only up to full plus an optional Docker or Podman sandbox ^[9]. The catch is that none of that is on when you install it. A fresh install runs tools on the host with full access, and the project published 722 security advisories between 31 January and 11 September 2026, 14 of them critical, all 14 of which it says are fixed ^[9]. That's the version Minisforum puts on the box. It can be a fine harness, but only once you've gone into the settings and picked a mode and a sandbox yourself.

The three at the top, and why they're there

ZeroClaw, at the top, is one Rust binary, and its default is supervision, so anything outside a short read-only list waits for you to approve it, and if nobody answers within 120 seconds that counts as a no ^[6]. Your channel secrets and provider keys are encrypted in its config file. It isn't spotless, its own docs say the commands it runs aren't written to an audit log, web fetch and search run without asking, and the sandboxed tools still have full network access, so it's careful about permission and less careful about what leaves the machine ^[6].

NanoClaw goes the other way round. Instead of asking you, it assumes the agent might get manipulated and keeps it in a box, so each session runs in a non-root container with every capability dropped, and your API keys stay outside in a gateway on the host that adds them to outgoing requests, which means the container only ever holds placeholders ^[7]. Inside that box the agent runs with permission prompts off, and network access stays open unless you set NANOCLAW_EGRESS_LOCKDOWN=true ^[7].

Hermes Agent is the chat-first one, and the thing it gets right is strangers. Its messaging gateway ignores every sender until you set an allowlist or approve a pairing code, saved-card payments always ask, and its docs say it collects no telemetry ^[8]. Shell commands, though, run on your host by default, with a second model deciding which ones are low-risk enough to go ahead, and things written to memory are saved without asking you ^[8].

Two that we wouldn't start with today

PicoClaw hasn't had a commit since 19 August 2026 or a release since 3 July, and there are 15 CVEs listed against it with no advisory or security policy from the project itself ^[15]. Leon's last tagged release of its core was on 1 May 2023, and the 2.0 Developer Preview installs straight from a development branch ^[16]. Both may come back, projects do, but right now you'd be on your own with them.

The quieter stuff

Telemetry came up more than we expected. QwenPaw, AstrBot and Leon all send usage data by default, and in each case the docs say less than the source sends, and NanoClaw's setup sends events to PostHog unless you set NANOCLAW_NO_DIAGNOSTICS=1 ^{[7] [12] [13] [16]}. None of that is unusual for open-source projects that want to know how they're used, but for something that sits on top of your messages it's worth knowing before you install it rather than after.

These projects also move fast, Hermes Agent's release of 8 October listed six security fixes on its own, so treat any grade here as a reading on one date rather than a verdict ^[8]. Each listing page says when it was last checked, and we're adding coding harnesses this week as well, which is a different job with a lot of the same questions. Why personal agents get tried once and dropped is the other half of this, about what these agents are asked to do once they're running.

References

Read on 18 October 2026, from listings researched on 12 October 2026.

1. [1]Tom's Hardware, Minisforum launches local AI solutions at IFA 2026, 4 September 2026. Source for OpenClaw pre-installed on the N5 Max-P495 AI NAS. tomshardware.com
2. [2]Minisforum, Minisforum showcases upcoming AI PC models compatible with OpenClaw, 13 March 2026. Source for Minisforum recommending OpenClaw on the M2 Pro. minisforum.com
3. [3]Anchor Terminal, Personal assistants category, 18 October 2026. Source for the eleven open-source harnesses, their grades and scores, and the date they were graded. anchorterminal.com
4. [4]Anchor Terminal, LocalGhost listing, 18 October 2026. Source for LocalGhost's grade and score. anchorterminal.com
5. [5]Anchor Terminal, research notes for the personal assistants category, 12 October 2026, not published. Source for the eleven listings graded once without the competitor procedure, and for the checklist having no line for approvals, account scopes or memory deletion.
6. [6]Anchor Terminal, ZeroClaw listing, graded 12 October 2026. Source for the supervised default, the 120-second denial, encrypted secrets, the unaudited commands and the network access of sandboxed tools. anchorterminal.com
7. [7]Anchor Terminal, NanoClaw listing, graded 12 October 2026. Source for the per-session containers, the credential gateway, the prompts off inside the container, the open egress and the PostHog events. anchorterminal.com
8. [8]Anchor Terminal, Hermes Agent listing, graded 12 October 2026. Source for the sender allowlist, card payment approvals, no telemetry, host shell commands, unapproved memory writes and the six security fixes of 8 October. anchorterminal.com
9. [9]Anchor Terminal, OpenClaw listing, graded 12 October 2026. Source for the stars, Markdown memory, permission modes and sandbox, the full-access default and the 722 advisories. anchorterminal.com
10. [10]Anchor Terminal, IronClaw listing, graded 12 October 2026. Source for auto-approve being on by default. anchorterminal.com
11. [11]Anchor Terminal, nanobot listing, graded 12 October 2026. Source for no approval step and unknown senders being refused. anchorterminal.com
12. [12]Anchor Terminal, QwenPaw listing, graded 12 October 2026. Source for approval only on flagged calls and for mail, and usage data on by default. anchorterminal.com
13. [13]Anchor Terminal, AstrBot listing, graded 12 October 2026. Source for no approval step, shell and file tools off by default, and usage statistics on by default. anchorterminal.com
14. [14]Anchor Terminal, CowAgent listing, graded 12 October 2026. Source for the full-access default and no approval step. anchorterminal.com
15. [15]Anchor Terminal, PicoClaw listing, graded 12 October 2026. Source for no approval step, the last commit and release, and the 15 CVEs. anchorterminal.com
16. [16]Anchor Terminal, Leon listing, graded 12 October 2026. Source for no approval step, the 30-minute task, the last tagged release, the Developer Preview and telemetry on by default. anchorterminal.com