nanobot vs Dots

nanobot

nanobot runs on the owner's machine under the MIT licence, with no telemetry found in its source and memory kept as files the owner can read and restore. No per-action approval step was found, and the shell sandbox and workspace restriction are off by default. Five security advisories were published between March and September 2026, all with fixes.

Dots

Actions that affect accounts or share information pass an automatic review, and custom rules can require approval or a hand-off. Dots is a beta on Pro plans from $100 a month, and no status page, terms, privacy policy or way to delete individual saved notes was found in the pages we could read.

nanobot

1. Set tools.restrictToWorkspace to true and tools.exec.sandbox to bwrap or seatbelt before giving it real accounts. Both are off by default
2. Run 0.3.0 or later. Earlier versions carry the published SSRF flaw in web fetch (GHSA-vc5v-6vwm-wf9m)
3. Keep allowFrom narrow on every channel and never set ["*"] on Email, which has no pairing
4. Write secrets as ${VAR} references in ~/.nanobot/config.json. Plain values are stored in clear text
5. Use nanobot -m "..." for a one-shot run, and keep nanobot gateway running for channels, schedules and heartbeat

Dots

1. Say what may be sent. Asking a dot to draft replies does not permit sending them, and an action outside a stated scope needs another decision
2. Stop three things separately. Pause stops the main task only, delegated tasks stop in Activity and recurring tasks in Scheduled, and completed actions are not undone
3. Connect each thing separately. A messaging channel grants no access to an inbox, an app or a computer
4. Sign out of websites and disconnect apps yourself when removing access. Revoking dots access or disconnecting an app does not delete information already obtained
5. Keep the connected computer online with the ChatGPT app open for local work. Only one personal computer can be connected at a time