CowAgent vs PicoClaw

CowAgent

MIT software with seven releases in 90 days, memory kept as plain files in the owner's workspace and three per-session permission modes. Source and Docker installs default to full-access, no action asks for approval, and an open report of 31 July 2026 says group members could reach the owner's files through the bot.

PicoClaw

Self-hosted under the MIT licence, with 19 documented chat channels, scheduled and heartbeat tasks, and local file memory. The repository has had no commit since 19 August 2026 and no release since 3 July, and 15 CVEs are listed against it with no advisory or security policy from the project.

CowAgent

1. Set agent_permission_mode to workspace-write or read-only before connecting any channel. Source and Docker installs default to full-access
2. Keep the bot out of group chats that include other people. Any member who mentions it reaches the same tools as the owner
3. Set web_password before changing web_host to 0.0.0.0. The password is empty by default
4. Set external_api_token to enable POST /v1/chat/completions, and send conversation_id to keep one session. The model field does not select a model
5. Run it in a container for a hard boundary. The docs and the source both say the permission modes are not isolation

PicoClaw

1. Set allow_from to the owner's user ID on every channel before starting the gateway. An empty list accepts messages from anyone
2. Set tools.exec.allow_remote to false unless chats must run shell commands. The shipped default is true, whatever docs/guides/configuration.md says
3. Set isolation.enabled to true on Linux (needs bwrap) or run in a container. The deny patterns do not inspect child processes
4. Use PICOCLAW_KEY_PASSPHRASE for credential encryption. One docs page names PICOCLAW_CREDENTIAL_PASSPHRASE, which the source does not read
5. Treat the README's ClawdChat line (read a remote skill file and follow it) as untrusted third-party instructions