GAIA vs nanobot

GAIA

GAIA's source is public, so its approval gate, memory store and token handling can be read. Three approval modes and per-tool overrides exist, but the default mode in the source runs every action unasked, which the privacy policy and release notes do not say. Pro costs $30 a month and self-hosting is limited to noncommercial use.

nanobot

nanobot runs on the owner's machine under the MIT licence, with no telemetry found in its source and memory kept as files the owner can read and restore. No per-action approval step was found, and the shell sandbox and workspace restriction are off by default. Five security advisories were published between March and September 2026, all with fixes.

GAIA

1. Set Settings > Approvals to Always ask or Auto before connecting mail. The default in the source runs every action, including send and delete, without asking.
2. Expect no public API on the hosted service. The backend turns off its OpenAPI document in production, so reach GAIA through its apps, bots or CLI.
3. Check the plan before relying on the hosted service. The README and docs describe a Free plan, and the pricing page says GAIA is a paid product.
4. For self-hosting, prepare Docker, Node.js 20, a WorkOS account and a model key first, and confirm the use is noncommercial under the licence.
5. Add outside tools as MCP servers by URL on the Integrations page. GAIA asks before adding a server in every approval mode.

nanobot

1. Set tools.restrictToWorkspace to true and tools.exec.sandbox to bwrap or seatbelt before giving it real accounts. Both are off by default
2. Run 0.3.0 or later. Earlier versions carry the published SSRF flaw in web fetch (GHSA-vc5v-6vwm-wf9m)
3. Keep allowFrom narrow on every channel and never set ["*"] on Email, which has no pairing
4. Write secrets as ${VAR} references in ~/.nanobot/config.json. Plain values are stored in clear text
5. Use nanobot -m "..." for a one-shot run, and keep nanobot gateway running for channels, schedules and heartbeat