AgentNo sandbox by defaultTracked every 6 hours

Nanobot

Personal AI agent in Python (MIT) with a browser UI and chat apps. Native Anthropic, OpenAI and OpenRouter providers plus local servers; its shell sandbox is off until you switch it on.

By HKU Data Intelligence Lab (HKUDS)License MITLanguage PythonFirst release 2026-01-22
GitHub stars
49,755
GitHub, 2026-11-02
Last release
v0.4.0
2026-10-28
CVEs (30 days / total)
0 / 10
from NVD
Sandbox default
no
GitHub stars, last 12 snapshots: +76

Overview

Nanobot is a personal AI agent from the HKU Data Intelligence Lab that runs in a browser UI, a terminal or chat apps (Telegram, Discord, Slack, WeChat, email and others). Its February 2026 README spoke of about 4,000 lines of core code; at v0.3.5 its nanobot/ package holds about 160,000 lines of Python, by our count. It reaches Claude through a native Anthropic provider, and also works with OpenAI, OpenRouter, AWS Bedrock and local servers such as Ollama and vLLM. Shell commands pass a filter that blocks obvious destructive patterns; the OS sandbox (bubblewrap on Linux, Seatbelt on macOS) and the workspace guard are off until you set them, and its docs ask for both in production. Chat channels require pairing or an allowlist, except Slack and Mattermost direct messages, which are open by default.

Our take

Editorial opinion, not a test result.

Best for

  • A personal agent with a browser UI and chat apps on a small Linux, macOS or Windows machine
  • Linux ARM64 hosts such as a 64-bit Raspberry Pi (it ships Linux ARM64 wheels)
  • Builders who want a Python SDK and an OpenAI-compatible API around their agent

Not for

  • Teams that want one shared agent with per-user accounts: its README describes a personal agent
  • Setups that will not revisit the config: the shell sandbox and workspace guard stay off until you set them
  • Windows hosts that need OS-level isolation: Nanobot has no sandbox backend on Windows

Security posture

Sandbox by defaultno
Auth on dashboardno
Threat model documentedno
Multi-LLM supportyes
CVEs on NVD (total)10
CVEs in the last 30 days0

Off by default: a built-in filter blocks obvious destructive commands, and the OS sandbox for shell commands (bubblewrap on Linux, Seatbelt on macOS) and the workspace guard are opt-in. Its docs ask for both in production.

Sources

Sandbox default and model support read in the project's own documentation and repository on 2026-10-18.

Links

Run Nanobot on portable hardware

Verified working on these portable hosts (with the standard caveats: see the per-device pages for power, RAM headroom, browser-tool support):

Raspberry Pi 5
€80-110 · 5-12 W
Intel NUC 13 and Geekom IT13
€300-600 · 15-55 W
Mac Mini M4 / M4 Pro
€699-2200 · 4-65 W (M4), 5-140 W (M4 Pro), idle to maximum per Apple
Framework Laptop 13 / 16
€1100-2200 · 15-80 W
Old Android phone (Moto E2 et al.)
€15-30 used · 1-3 W
Orange Pi 5 Plus
€110-250 · 8-15 W
Mac Studio M3 Ultra
€4,500-7,000 · Up to 480 W (maximum continuous)
MacBook Air M3 / M4
€1,299-2,099 · 10-25 W
Lenovo ThinkCentre M75q (used)
€150-250 used · 15-35 W
Minisforum UM790 Pro
€700-900 · 25-65 W
Khadas Edge2 Pro
€220-280 · 8-15 W
Dell OptiPlex 3070 / 5070 Micro (used)
€100-180 used · 15-35 W
Geekom Mini Air 12
€280-340 · 6-15 W

Compare Nanobot with others

Nanobot vs OpenClaw
No sandbox by default
Nanobot vs Hermes Agent
No sandbox by default
Nanobot vs NanoClaw
Sandbox on by default

Nanobot CVEs (10 on NVD)

CVE-2026-90809high 7.3Nanobot: Argument injection in ExecToolA vulnerability was identified in HKUDS nanobot up to 0.2.1. The affected element is the function ExecTool._guard_command/ExecTool._spawn of the file…14 Sept 2026CVE-2026-90808medium 6.3Nanobot: Incomplete blacklist in ExecToolA vulnerability was determined in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool._guard_command/ExecTool._spawn of the file…14 Sept 2026CVE-2026-19246medium 6.3Nanobot: Server-side request forgery in the Provider-returned Image URL HandlerA vulnerability has been found in HKUDS nanobot up to 0.2.1. This affects the function _download_image_data_url of the file…7 Aug 2026CVE-2026-19245low 3.3Nanobot: Information disclosure in the Login-shell Environment HandlerA flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool._prepare_command of the file nanobot/agent/tools/shell.py of…7 Aug 2026CVE-2026-19244medium 4.7Nanobot: Improper access controls in the MCP enabledTools Scope HandlerA vulnerability was detected in HKUDS nanobot up to 0.2.1. The affected element is the function connect_mcp_servers of the file nanobot/agent/tools/mcp.py of…7 Aug 2026CVE-2026-19243medium 6.3Nanobot: Os command injection in the Shell Allowlist HandlerA security vulnerability has been detected in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool._guard_command/ExecTool._spawn of the file…7 Aug 2026

All CVEs

Stats refreshed every 6 hours from public sources (GitHub API, NVD CVE feed, CISA KEV). See our methodology for the full tracking pipeline.

See also: all AI agents, all AI CVEs, AI hardware, scan your AI stack, Pro alerts.