CowAgent vs nanobot

CowAgent

MIT software with seven releases in 90 days, memory kept as plain files in the owner's workspace and three per-session permission modes. Source and Docker installs default to full-access, no action asks for approval, and an open report of 31 July 2026 says group members could reach the owner's files through the bot.

nanobot

nanobot runs on the owner's machine under the MIT licence, with no telemetry found in its source and memory kept as files the owner can read and restore. No per-action approval step was found, and the shell sandbox and workspace restriction are off by default. Five security advisories were published between March and September 2026, all with fixes.

CowAgent

1. Set agent_permission_mode to workspace-write or read-only before connecting any channel. Source and Docker installs default to full-access
2. Keep the bot out of group chats that include other people. Any member who mentions it reaches the same tools as the owner
3. Set web_password before changing web_host to 0.0.0.0. The password is empty by default
4. Set external_api_token to enable POST /v1/chat/completions, and send conversation_id to keep one session. The model field does not select a model
5. Run it in a container for a hard boundary. The docs and the source both say the permission modes are not isolation

nanobot

1. Set tools.restrictToWorkspace to true and tools.exec.sandbox to bwrap or seatbelt before giving it real accounts. Both are off by default
2. Run 0.3.0 or later. Earlier versions carry the published SSRF flaw in web fetch (GHSA-vc5v-6vwm-wf9m)
3. Keep allowFrom narrow on every channel and never set ["*"] on Email, which has no pairing
4. Write secrets as ${VAR} references in ~/.nanobot/config.json. Plain values are stored in clear text
5. Use nanobot -m "..." for a one-shot run, and keep nanobot gateway running for channels, schedules and heartbeat