nanobot vs OpenClaw

nanobot

nanobot runs on the owner's machine under the MIT licence, with no telemetry found in its source and memory kept as files the owner can read and restore. No per-action approval step was found, and the shell sandbox and workspace restriction are off by default. Five security advisories were published between March and September 2026, all with fixes.

OpenClaw

Self-hosted under the MIT licence, with state, memory and credentials kept on the owner's machine and no paid tier. A fresh install runs tools on the host with full access, no approval prompt and no sandbox, and the project has published 722 security advisories since January 2026, 14 of them critical.

nanobot

1. Set tools.restrictToWorkspace to true and tools.exec.sandbox to bwrap or seatbelt before giving it real accounts. Both are off by default
2. Run 0.3.0 or later. Earlier versions carry the published SSRF flaw in web fetch (GHSA-vc5v-6vwm-wf9m)
3. Keep allowFrom narrow on every channel and never set ["*"] on Email, which has no pairing
4. Write secrets as ${VAR} references in ~/.nanobot/config.json. Plain values are stored in clear text
5. Use nanobot -m "..." for a one-shot run, and keep nanobot gateway running for channels, schedules and heartbeat

OpenClaw

1. Set a session permission mode of guarded or workspace, or tools.exec.mode, before connecting mail. The default runs host commands without approval
2. Turn on agents.defaults.sandbox for any agent that reads mail, web pages or attachments. Sandboxing is off by default
3. Set tools.message.crossContext.allowAcrossProviders and allowWithinProvider to false to confine sends to the current conversation
4. Route incoming mail to a restricted reader agent, as the IMAP and Gmail guides show, and deny gateway, cron, sessions_spawn and sessions_send for it
5. Run openclaw security audit after setup, and treat the Gateway token as an owner credential. POST /tools/invoke accepts it with full operator access