Agent Zero vs Qwen Code

Agent Zero

Self-hosted under the MIT licence, with nine releases in the 90 days to 12 October 2026 and breaking changes listed in the release notes. The agent runs shell commands in its container with no approval step, the web interface has no login by default, and five CVEs from the past year have no published GitHub advisory.

Qwen Code

Apache-2.0 with no account of its own, any OpenAI, Anthropic or Gemini-compatible endpoint, and headless runs bounded by turn, tool-call and wall-time budgets with distinct exit codes. Out of the box, Auto mode lets an LLM classifier approve tool calls, with the sandbox and folder trust both off. Usage statistics are on by default.

Agent Zero

1. Set a UI login and password in Settings before publishing the port or opening a tunnel. The default has none
2. Fill allowed_users, allowed_numbers or sender_whitelist before enabling a channel. An empty list accepts every sender
3. Enable the Infection Check plugin when the agent reads mail, web pages or MCP results. It ships disabled
4. Run v2.12 or later. It fixes a Telegram webhook authentication bypass and a WhatsApp media path traversal
5. Call POST /api_message with the X-API-KEY header. The token changes when the UI login or password changes

Qwen Code

1. Pass --approval-mode on every run. The settings default is auto, and one docs page says headless runs default to asking, so don't rely on either
2. Add --max-session-turns, --max-wall-time and --max-tool-calls. All three are unlimited by default. Exit 53 is the turn limit and 55 a budget
3. --yolo doesn't turn on a sandbox. Add --sandbox, or on Linux set tools.executionSandbox with network set to closed
4. Set QWEN_USAGE_STATISTICS_ENABLED=false to stop usage statistics
5. Authenticate with OPENAI_API_KEY, OPENAI_BASE_URL and OPENAI_MODEL in CI. The browser sign-in is discontinued