5 best OpenClaw alternatives in 2026, compared

TL;DR

If you only read one line: Hermes Agent is the safe default in 2026 for most self-hosters. Nanobot if you want a lighter personal agent with a browser UI and will switch on its sandbox yourself. NanoClaw if you want every agent in its own Docker container and Claude as the default model. IronClaw if you want untrusted tools in a WebAssembly sandbox and secrets kept out of their reach. ZeroClaw if you want one small Rust binary with approvals and an OS sandbox on from the start.

The full breakdown is below, read from each project's documentation and repository. Until October 2026 this paragraph said we had installed each one and graded them on five tasks; no such test was run (how we compare agents is on /methodology).

The contenders

We're skipping anything that hit GitHub after April 1. Too early to tell.

Every row was checked against the project's repository and documentation on 18 October 2026 (sources at the end of this guide).

1. Hermes Agent: the safe default

Hermes Agent comes from Nous Research, under the MIT licence, written in Python. Out of the box its terminal tool uses the local backend: shell commands run on your machine with no isolation, and the ones that match its list of dangerous patterns go through an approval step (tools docs, security docs). Until October 2026 this section said Hermes runs the agent in Docker by default. It never did: local is the default in its first GitHub release (v2026.3.12, March 2026) and still in v0.22.2 (config_defaults.py).

What's good:

• One-line install on Linux, macOS and WSL2: curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash, and a PowerShell one-liner on native Windows (README).
• Approvals are on from the first run. In the default smart mode a helper model approves low-risk commands, denies the clearly dangerous ones and asks you about the rest; a prompt nobody answers is denied after 300 seconds.
• Seven terminal backends: local, Docker, SSH, Singularity, Modal, Daytona and Vercel Sandbox. With Docker, every container drops all Linux capabilities but three file-ownership ones, blocks privilege escalation and is capped at 256 processes.
• The chat gateway (Telegram, Discord, Slack, WhatsApp, Signal, email) refuses everyone until you allowlist a user or approve a pairing code.
• Many model providers: Nous Portal, OpenRouter, Anthropic, OpenAI, Gemini, and local servers such as Ollama and vLLM (providers docs).

What's not:

• The default runs on the host. Its security policy is blunt about it: the approval gate is a heuristic, not a boundary, and only OS-level isolation counts. A container terminal backend confines the shell and file tools; for production, shared use or untrusted input (the open web, email, group chats) the policy asks for the whole agent inside its own Docker image or NVIDIA OpenShell (SECURITY.md).
• Inside a container backend the dangerous-command check is skipped: the container is the boundary, so what you mount and forward into it matters. docker_forward_env is empty unless you fill it.
• It is a single-tenant personal agent by its own policy, even though the gateway can let several allowlisted people talk to it.

Verdict. Hermes Agent is the agent we'd hand a colleague today, with one change before it reads anything you don't control: run it inside its official Docker image, or at least move its terminal to the Docker backend.

2. Nanobot: the light one with a browser UI

Nanobot, from the HKU Data Intelligence Lab (HKUDS), is an MIT-licensed personal agent you use from a browser UI, a terminal or chat apps. It launched in February 2026 with a README that spoke of about 4,000 lines of core code (README of February 2026). It has grown since: at v0.3.5 (15 September 2026) its nanobot/ package holds about 160,000 lines of Python, 23,000 of them in the agent core, by our count of the release archive. Until October 2026 this section called it a 4,000-line codebase with no sandbox and no Anthropic support; none of that holds for the current release.

What's good:

• pip install nanobot-ai on Python 3.11+, with wheels for macOS 13+, Linux ARM64 and x64, and Windows x64 (README).
• Wide model choice: a native Anthropic provider, OpenAI, OpenRouter, AWS Bedrock, and local servers such as Ollama, vLLM and LM Studio (providers docs). Anthropic has been a listed provider since the February 2026 README.
• An OS sandbox for shell commands: bubblewrap on Linux, Seatbelt on macOS, which confines commands to the workspace and hides the folder that holds its config (SECURITY.md).
• On Telegram, Discord and WeChat, unknown senders get nothing but a pairing code until you approve it or list them (pairing docs).

What's not:

• The sandbox and the workspace guard are off by default. Until you set tools.exec.sandbox and tools.restrictToWorkspace, shell commands run as your user, behind a filter that only blocks obvious destructive patterns (rm -rf, fork bombs, mkfs, raw disk writes). The docs ask for both settings in production (configuration, security section).
• Neither sandbox backend restricts network access, and Windows has no sandbox backend at all.
• Slack and Mattermost direct messages are open by default: set their DM policy to allowlist.
• It is built as a personal agent, not a shared one with user accounts.

Verdict. Nanobot is the right pick for a light personal agent with a browser UI and a wide choice of models, if you switch on its sandbox and workspace guard on day one. It's the wrong pick if you want safe settings without touching the config.

3. NanoClaw: every agent in its own container

NanoClaw, from the nanocoai project, is a small TypeScript assistant under the MIT licence. It is its own codebase, not an OpenClaw fork: its README pitches OpenClaw's core functionality in a codebase small enough to understand (README). Until October 2026 this section called it a macOS-only community fork, installed from a .pkg and sandboxed in Apple containers. Its repository says otherwise: Docker is the default runtime on macOS, Linux and Windows through WSL2, and its February 2026 README already said so, with Apple Container as an option on macOS (README of February 2026).

What's good:

• Each agent group runs in its own Linux container and only sees the folders mounted into it. The containers run as an unprivileged user, with every Linux capability dropped and privilege escalation blocked (security docs).
• Agents never hold raw API keys: outbound requests go through a credential gateway that adds them at request time.
• One script, bash nanoclaw.sh, installs Node, pnpm and Docker if they are missing, builds the agent container and pairs a first channel (Slack, Telegram, Discord, WhatsApp, iMessage or a local CLI).
• Claude runs through Anthropic's Claude Agent SDK by default. OpenAI Codex, OpenCode (OpenRouter, Google, DeepSeek and others) and local models through Ollama are skills you add, per agent group.

What's not:

• No configuration files, by design: changing what it does means changing the code with Claude Code, which the /add-<channel> skills also need.
• The network lockdown that cuts agent containers off from the internet is off by default. Its docs say to turn it on when agents face untrusted audiences or hold credentials worth stealing.
• Channels and other model providers live on separate branches and are copied into your own fork by skills, so every install is a fork you maintain.

Verdict. NanoClaw is the pick if you want container isolation from the first run and are happy with Claude as the default model and Claude Code as the way to change it. Skip it if you would rather edit a configuration file than code.

4. IronClaw: tools sandboxed, secrets out of reach

IronClaw comes from NEAR AI, is written in Rust and is dual-licensed MIT or Apache-2.0. Its README calls it a Rust reimplementation inspired by OpenClaw (README). Until October 2026 this section described a source-available enterprise product at $750 a seat, with gVisor, RBAC, SAML SSO, a hash-chained audit log and an air-gap mode. Its repository shows an open-source licence (Cargo.toml) and documents none of those features.

What's good:

• Untrusted tools run in WebAssembly sandboxes (wasmtime). Each one declares in a capabilities.json which hosts it may call, which paths it may read or write and which credentials it needs; anything else is refused (sandboxed tools).
• Secrets are encrypted with AES-256-GCM and injected into outgoing requests at the host boundary, so a tool never sees the raw key; a leak detector scans requests and responses.
• Jobs can run in Docker containers as a non-root user with dropped capabilities, and every tool execution is logged.
• Release installers for macOS, Linux (x86_64 and ARM64) and Windows, then ironclaw onboard. Providers include NEAR AI (the default), Anthropic, OpenAI, Ollama and OpenAI-compatible servers (.env.example).

What's not:

• The shell tool is off until you set ALLOW_LOCAL_TOOLS=true, and once on it runs on the host with your user's permissions; its docs send untrusted work to the Docker sandbox instead (shell docs).
• Its tools are its own: OpenClaw plugins don't carry over, and it tracks what it still lacks of OpenClaw's features in a parity file.
• Building from source needs Rust 1.96+ and Node.js 22+.

Verdict. IronClaw is the pick when tools will read input you don't control and must never see your keys. If you want a large plugin catalogue or a shell that can do anything on the host, start elsewhere.

5. ZeroClaw: one Rust binary, locked down by default

ZeroClaw is an agent runtime shipped as a single Rust binary, dual-licensed MIT or Apache-2.0. Its README says it is built and maintained by the community, and ZeroClaw Labs holds the name and logo (README, NOTICE). Until October 2026 this section described a local-only agent from a privacy collective, under AGPL-3.0, with network egress blocked at the iptables level, Llama 3.3 70B by default and a bundled offline RAG. Its documentation says otherwise on every point: it is provider-agnostic, its sandbox leaves network egress open by default, and its only RAG module covers hardware datasheets (sandboxing, RAG module).

What's good:

• Out of the box it is supervised: medium-risk actions ask you, high-risk ones are blocked, file tools stay inside the workspace, and tools run in the best OS sandbox the host offers (Landlock, Bubblewrap, Firejail or Docker on Linux, Seatbelt on macOS, AppContainer on Windows, experimental) (security model).
• Pluggable providers: Anthropic, OpenAI, Ollama, Bedrock, Gemini, Azure, OpenRouter and any OpenAI-compatible endpoint, with fallback chains (providers). With Ollama, no prompt leaves your machine.
• Small: prebuilt binaries run on any Raspberry Pi, the Zero 2 W included (Raspberry Pi setup).
• No telemetry, by its own policy.

What's not:

• Sandboxed tools keep full network egress by default, and the Landlock backend does not filter network at all. Limit it per tool or at the host.
• Its audit log covers certificate issuance only: by its own docs, command execution is not audited.
• Building from source on a small board needs swap; its docs point to the prebuilt binary instead.

Verdict. ZeroClaw is the pick for a small host or a hardware project that should start locked down. Point it at Ollama if your data must stay on the machine, and restrict its network yourself.

The summary table

What about LangChain agents, AutoGPT, BabyAGI…

The classic 2023-2024 agent frameworks still exist, but they're not in the same category. They're toolkits to build your own agent. The five above are products you install and run. Different problem.

If you have specific agent needs that none of these hit: multi-agent coordination, long-running research, very specific tool integrations: the toolkit route is probably where you want to be. We'll cover that separately.

Migration help

If you're on OpenClaw and ready to switch, we wrote a step-by-step migration guide for OpenClaw → Hermes Agent. Most of the same steps apply for the other targets, with notes on where they differ.

Sources

Read on 18 October 2026. Hermes Agent's latest release was then v0.22.2 (15 October 2026); Nanobot's was v0.3.5 (15 September 2026).

• Hermes Agent: repository and README, tools and terminal backends, security, security policy and trust model (SECURITY.md), AI providers, default terminal backend in v0.22.2 and in v2026.3.12, releases.
• Nanobot: README (v0.3.5), providers, configuration, security and pairing, SECURITY.md, README of February 2026 (v0.1.3.post4), line count: Python files under nanobot/ in the v0.3.5 release archive, blank lines and comments included.
• NanoClaw (read on 18 October 2026, latest release v2026.10.0 of 9 October 2026): README, security model, README of February 2026, LICENSE.
• IronClaw (read on 18 October 2026, latest release ironclaw-v1.4.1 of 29 September 2026): README, Cargo.toml licence field, sandboxed tools, shell tool, LLM backends (.env.example), releases.
• ZeroClaw (read on 18 October 2026, latest release v0.8.6 of the same day): README, NOTICE (licence), security model, sandboxing, providers, Raspberry Pi setup, RAG module.