nanobot vs NanoClaw

nanobot

nanobot runs on the owner's machine under the MIT licence, with no telemetry found in its source and memory kept as files the owner can read and restore. No per-action approval step was found, and the shell sandbox and workspace restriction are off by default. Five security advisories were published between March and September 2026, all with fixes.

NanoClaw

Each session runs in an unprivileged Docker container and API keys stay in a credential gateway on the host, so a manipulated agent cannot read them. Inside the container the agent runs with permission prompts off, network egress is open by default, and it can message any chat it is wired to without approval.

nanobot

1. Set tools.restrictToWorkspace to true and tools.exec.sandbox to bwrap or seatbelt before giving it real accounts. Both are off by default
2. Run 0.3.0 or later. Earlier versions carry the published SSRF flaw in web fetch (GHSA-vc5v-6vwm-wf9m)
3. Keep allowFrom narrow on every channel and never set ["*"] on Email, which has no pairing
4. Write secrets as ${VAR} references in ~/.nanobot/config.json. Plain values are stored in clear text
5. Use nanobot -m "..." for a one-shot run, and keep nanobot gateway running for channels, schedules and heartbeat

NanoClaw

1. Install with git clone and bash nanoclaw.sh. There is no registry package, and setup needs Docker, Node 22 or later and a Claude or Codex credential
2. Set NANOCLAW_EGRESS_LOCKDOWN=true before giving an agent credentials or an audience of strangers. The default leaves egress open
3. Put chats with different audiences in separate agent groups. Every session of a group shares one read-write workspace and memory tree
4. Turn on per-request approval for a secret in the gateway when its use should wait for a person. It is off unless configured
5. On OneCLI installs, move the gateway to 1.42.0 by the upgrade guide before updating to 2026.10.0. The updater stops until that is done