nanobot vs PicoClaw

nanobot

nanobot runs on the owner's machine under the MIT licence, with no telemetry found in its source and memory kept as files the owner can read and restore. No per-action approval step was found, and the shell sandbox and workspace restriction are off by default. Five security advisories were published between March and September 2026, all with fixes.

PicoClaw

Self-hosted under the MIT licence, with 19 documented chat channels, scheduled and heartbeat tasks, and local file memory. The repository has had no commit since 19 August 2026 and no release since 3 July, and 15 CVEs are listed against it with no advisory or security policy from the project.

nanobot

1. Set tools.restrictToWorkspace to true and tools.exec.sandbox to bwrap or seatbelt before giving it real accounts. Both are off by default
2. Run 0.3.0 or later. Earlier versions carry the published SSRF flaw in web fetch (GHSA-vc5v-6vwm-wf9m)
3. Keep allowFrom narrow on every channel and never set ["*"] on Email, which has no pairing
4. Write secrets as ${VAR} references in ~/.nanobot/config.json. Plain values are stored in clear text
5. Use nanobot -m "..." for a one-shot run, and keep nanobot gateway running for channels, schedules and heartbeat

PicoClaw

1. Set allow_from to the owner's user ID on every channel before starting the gateway. An empty list accepts messages from anyone
2. Set tools.exec.allow_remote to false unless chats must run shell commands. The shipped default is true, whatever docs/guides/configuration.md says
3. Set isolation.enabled to true on Linux (needs bwrap) or run in a container. The deny patterns do not inspect child processes
4. Use PICOCLAW_KEY_PASSPHRASE for credential encryption. One docs page names PICOCLAW_CREDENTIAL_PASSPHRASE, which the source does not read
5. Treat the README's ClawdChat line (read a remote skill file and follow it) as untrusted third-party instructions