Leon vs nanobot

Leon

Connected-app credentials are encrypted per profile and the Gmail connection is read-only. The 2.0 Developer Preview has no tagged release, runs tools and a 30-minute proactive pulse with no approval step, listens on every network interface with client authentication off, and sends telemetry by default.

nanobot

nanobot runs on the owner's machine under the MIT licence, with no telemetry found in its source and memory kept as files the owner can read and restore. No per-action approval step was found, and the shell sandbox and workspace restriction are off by default. Five security advisories were published between March and September 2026, all with fixes.

Leon

1. Clone the develop branch for 2.0. npm install --global @leon-ai/cli and docs.getleon.ai install and describe the legacy 1.0 betas
2. Set client_interface.auth.enabled: true and a LEON_PROFILE_TOKEN before the machine joins a shared network. The server binds 0.0.0.0
3. Set telemetry_enabled: false and runtime.pulse_enabled: false in the profile config.yml for an unattended or private run
4. Use availability.tools.allowed to limit tools. Shell, file writes, computer use and browser control are otherwise available to the agent with no approval prompt
5. Back up LEON_CONNECTIONS_ENCRYPTION_KEY from the profile .env. Without it the stored connections cannot be read

nanobot

1. Set tools.restrictToWorkspace to true and tools.exec.sandbox to bwrap or seatbelt before giving it real accounts. Both are off by default
2. Run 0.3.0 or later. Earlier versions carry the published SSRF flaw in web fetch (GHSA-vc5v-6vwm-wf9m)
3. Keep allowFrom narrow on every channel and never set ["*"] on Email, which has no pairing
4. Write secrets as ${VAR} references in ~/.nanobot/config.json. Plain values are stored in clear text
5. Use nanobot -m "..." for a one-shot run, and keep nanobot gateway running for channels, schedules and heartbeat