Self-hosted AI agents in 2026: the complete landscape report

Scope of this report

This is a landscape report on self-hosted AI agents: software you install on hardware you control, that calls one or more language models to do useful work autonomously. It covers the major projects (OpenClaw, Hermes Agent, Nanobot, NanoClaw, IronClaw, ZeroClaw, Moltworker), the architectural patterns they implement, the security posture of the ecosystem after the OpenClaw crisis of early 2026, the hosting economics, the model integration patterns, and the regulatory environment.

It does not cover hosted agent products (OpenAI Assistants, Anthropic Computer Use as a service, Google Gemini agentic features, etc.): those are a different category with a different threat model. It also does not cover agent frameworks (LangChain, smol-agents, BabyAGI, AutoGPT): those are libraries you build your own agent with, not products you install.

The version you are reading dates from April 28, 2026, with corrections on October 18 and 27, 2026: what it says about the defaults, licences and model support of Hermes Agent, Nanobot, NanoClaw, IronClaw and ZeroClaw, about OpenClaw's sandbox and about Moltworker's container, was checked against each project's repository and documentation that day, and rewritten where it was wrong (sources at the end). The rest is still our April reading. Subscribe to the newsletter if you want it in your inbox.

Section 1: Ecosystem map

The self-hosted AI agent ecosystem in April 2026 contains seven major projects, three architectural patterns, permissive licences across the board and one deeply contentious governance question. We will treat each in turn.

1.1 The seven major projects

A few observations about the table.

OpenClaw is the largest project by GitHub stars. No project publishes an install count; the one large public number is SecurityScorecard's count of more than 135,000 OpenClaw instances reachable from the internet in February 2026 (The Register), which counts exposed servers, not users.

Hermes Agent comes second by stars. Stars measure attention, not deployments; it is our default pick for new deployments for the reasons in section 2.2.

Nanobot is the surprise of the cohort. It comes from the Data Intelligence Lab at the University of Hong Kong, published its first GitHub release on February 4, 2026, and launched with a README that spoke of about 4,000 lines of core code. It has grown a lot since: at v0.3.5 (September 2026) its nanobot/ package holds about 160,000 lines of Python by our count, and the repository had about 49,000 stars in October 2026. Stars measure attention, not deployments.

NanoClaw, IronClaw and ZeroClaw all started in January or February 2026, each on its own codebase, and all three turn a sandbox on by default. NanoClaw puts every agent in its own Docker container. IronClaw runs untrusted tools in WebAssembly sandboxes and keeps secrets out of their reach. ZeroClaw runs tools in an OS sandbox it detects, behind approvals. Each has a clear use case.

Moltworker is interesting for what it represents more than what it is: it runs OpenClaw in a Cloudflare Sandbox container behind a Worker, shipped as a launch-blog example by Cloudflare. The point of Moltworker isn't the package itself (its README calls it an experimental proof of concept). The point is that “run your agent on Workers” is now a documented Cloudflare pattern with a worked example. That changes the hosting calculus across the ecosystem.

1.2 The three architectural patterns

The seven projects above implement, broadly, three architectures.

Pattern A: multi-LLM agents with an approval layer and an opt-in sandbox (Hermes Agent, OpenClaw, Moltworker). The agent talks to the major model providers and puts an approval step, a sandbox or both between the model and the host. The defaults vary more than the marketing suggests: Hermes Agent and OpenClaw both run tools on the host until you choose a sandbox backend, while Moltworker runs OpenClaw inside a Cloudflare Sandbox container. Until October 2026 this paragraph called the pattern “Docker-sandboxed” and said the agent runs in a container by default; for Hermes Agent and OpenClaw it does not. LLM-agnostic: Claude, GPT, Gemini, Llama through Ollama and others. This is where the broad middle of the ecosystem is consolidating, and where new entrants tend to start.

Pattern B: sandbox on by default (NanoClaw, IronClaw, ZeroClaw). The agent isolates tools before you configure anything: a container per agent (NanoClaw), WebAssembly tools with declared capabilities (IronClaw), or an OS sandbox it detects (ZeroClaw). All three still let you choose a cloud model or a local one. Until October 2026 this pattern was called “local-only / privacy-first” and pinned on ZeroClaw, which talks to cloud providers as readily as to Ollama.

Pattern C: small personal agents (Nanobot). A lighter agent for one owner, used from a browser UI, a terminal or chat apps, with its isolation left for you to switch on. Nanobot started at about 4,000 lines of core code; it is far larger at v0.3.5, so “read it all in an afternoon” no longer describes it. Its Python SDK and OpenAI-compatible API make it a base to build custom agents on.

A note on what isn't a pattern: “maximum capability,” “most plugins,” and “largest community” are not architectural patterns. They are popularity metrics that follow from patterns: an agent spreads when it hits the sweet spot of one of the three patterns above.

1.3 The licensing question

Every project in the table ships under a permissive open-source licence: MIT (OpenClaw, Hermes Agent, Nanobot, NanoClaw), Apache 2.0 (Moltworker), or MIT or Apache-2.0 at your option (IronClaw, ZeroClaw). None of them restricts hosting it as a service.

Until October 2026 this section described two licensing camps: ZeroClaw under AGPL-3.0, so that any hosted version would have to publish its source, and IronClaw under a source-available licence that forbids competing products and comes with a seat price. Both repositories say otherwise. ZeroClaw (NOTICE, Cargo.toml) and IronClaw (Cargo.toml, README) are dual-licensed MIT or Apache-2.0. ZeroClaw Labs does keep the ZeroClaw name and logo as trademarks.

1.4 The governance question

The deeply contentious governance question, in April 2026, is: who decides what an “OpenClaw alternative” means as a community label, and how should new entrants be assessed?

The community has no widely accepted test for whether a new project meets a safety bar before it calls itself an “OpenClaw alternative”.

Our editorial position is straightforward: a project should have to pass a baseline before we cover it as an “OpenClaw alternative.” The baseline:

• A documented threat model.
• Sandbox-on by default.
• Authenticated dashboard.
• Explicit network egress controls.
• A security disclosure policy with a working contact address.
• A patch SLA for critical vulnerabilities.

Read against the projects' own documentation in October 2026, the sandbox line is not met by Hermes Agent, Nanobot or OpenClaw: Hermes runs commands on the host and asks for approval on the dangerous ones, Nanobot and OpenClaw leave their sandboxes off until you set them. We still cover the three, because the sandbox is documented and one setting away, and we say so wherever it matters. Turn it on before you deploy.

Projects that don't meet this bar are perfectly welcome to exist; when one we cover misses a line, we say so explicitly, as above.

Section 2: Vendor breakdown

This section goes one layer deeper into the seven major projects: who they're for, what they ship, what they don't, and what we think.

2.1 OpenClaw

Since the crisis OpenClaw asks before connecting its Control UI to a new gateway (the fix of CVE-2026-25253), keeps its gateway on loopback on a host install, and has been governed by the OpenClaw Foundation, a US non-profit, since July 2026 (OpenClaw Foundation). Its sandbox is still opt-in: the README says tools run on the host for the main session unless you configure sandboxing, and the sandboxing docs say it is off by default (until October 2026 this paragraph said OpenClaw had sandbox-on defaults). Its CVEs and their fixed releases are on the OpenClaw CVE page.

We recommend a current OpenClaw release for users who already have a working install, are comfortable with the migration work, and have a specific reason to stay (existing plugins, team familiarity, etc.). For new users, Hermes Agent is the easier on-ramp.

2.2 Hermes Agent

Hermes Agent is our default pick for new self-hosted AI deployments. Out of the box it runs shell commands on the host (the local terminal backend) and sends the ones that match its list of dangerous patterns through an approval step; it supports the major LLM providers and documents its security model in the open. Docker, SSH, Singularity, Modal, Daytona and Vercel Sandbox are alternative backends. Until October 2026 this section said Hermes ships Docker-sandboxed: local has been its default since its first GitHub release in March 2026.

Drawbacks: the safe setting is not the default. Its own security policy says the approval gate is a heuristic and only OS-level isolation is a boundary; for production, shared use or untrusted input it asks for the whole agent inside its Docker image or NVIDIA OpenShell. Inside a container backend the dangerous-command check is skipped, so the container's mounts and forwarded variables become the boundary. The installer also adds a browser tool with its own Chromium unless you pass --skip-browser.

We recommend Hermes Agent for:

• New deployments without specific constraints.
• Teams that want a single agent to support multiple LLM providers.
• Anyone who wants command approvals on from the first run, and will move it into a container before it reads untrusted input.

We do not recommend Hermes Agent for: highly resource-constrained hosts (consider Nanobot or ZeroClaw), or tools that read untrusted input from day one (consider IronClaw or NanoClaw, whose sandboxes are on by default). For a no-cloud setup it works, like most agents here, with a local model through Ollama.

2.3 Nanobot

Nanobot is the lighter personal agent of the group: a browser UI, a terminal UI and chat apps (Telegram, Discord, Slack, WeChat, email, Mattermost and others) on top of a Python core. It launched in February 2026 promising about 4,000 lines of core code; at v0.3.5 its nanobot/ package holds about 160,000 lines of Python by our count, so reading all of it is no longer an afternoon's job. Models are wide open: a native Anthropic provider, OpenAI, OpenRouter, AWS Bedrock, and local servers such as Ollama and vLLM.

Drawbacks: the isolation is there, but off. Until you set tools.exec.sandbox (bubblewrap on Linux, Seatbelt on macOS) and tools.restrictToWorkspace, shell commands run as your user behind a filter that blocks only obvious destructive patterns; its docs ask for both settings in production. Neither sandbox restricts network access, and Windows has no sandbox backend. Slack and Mattermost direct messages are open by default, while Telegram, Discord and WeChat require pairing. Until October 2026 this section said Nanobot has no sandbox, no auth layer and only OpenAI-compatible providers, with a shim needed for Anthropic: none of that matches its documentation.

We recommend Nanobot for:

• A personal agent with a browser UI and chat apps on a small machine.
• Linux ARM64 boards such as a 64-bit Raspberry Pi (it ships Linux ARM64 wheels).
• Builders who want a Python SDK and an OpenAI-compatible API around their agent.

We do not recommend Nanobot for: a shared agent with per-user accounts (it is built as a personal agent), or setups that will not revisit the config, since its sandbox and workspace guard stay off until you set them.

2.4 NanoClaw

NanoClaw is a small TypeScript assistant under the MIT licence that runs every agent group in its own Linux container, with Docker as the runtime on macOS, Linux and Windows through WSL2. Claude runs through Anthropic's Claude Agent SDK by default; OpenAI Codex, OpenCode and Ollama are provider skills you add. API keys stay in a credential gateway outside the containers. Until October 2026 this section described a macOS-only, Claude-only fork installed from a .pkg and sandboxed in Apple's container framework: its repository describes none of that (README, security model).

Drawbacks: customisation means changing the code with Claude Code, not editing a configuration file. The network lockdown that keeps agent containers off the internet is off by default. Every install is a fork that carries the channels and providers you added.

We recommend NanoClaw for: a personal assistant on chat apps, when container isolation from the first run matters more to you than a configuration file.

2.5 IronClaw

IronClaw is NEAR AI's agent, written in Rust and dual-licensed MIT or Apache-2.0; its README calls it a Rust reimplementation inspired by OpenClaw. Untrusted tools run in WebAssembly sandboxes (wasmtime) and may only reach the hosts, paths and credentials their capabilities.json declares. Secrets are encrypted with AES-256-GCM and injected into requests at the host boundary, a leak detector scans traffic, jobs can run in Docker containers and every tool execution is logged (README, sandboxed tools). Until October 2026 this section credited it with gVisor, hash-chained audit logs, RBAC, SAML SSO, a bug bounty, a contracted SLA, an air-gap mode and a $750 seat price: its repository documents none of them.

Drawbacks: its shell tool, once you enable it with ALLOW_LOCAL_TOOLS=true, runs on the host (shell docs). Its tools are its own WebAssembly extensions, so OpenClaw plugins don't carry over.

We recommend IronClaw for: setups where tools read input you don't control and must never see your keys.

2.6 ZeroClaw

ZeroClaw is an agent runtime shipped as a single Rust binary, dual-licensed MIT or Apache-2.0 and, per its README, built and maintained by the community under the ZeroClaw Labs name. It talks to Anthropic, OpenAI, Ollama, Bedrock, Gemini, Azure, OpenRouter and any OpenAI-compatible endpoint, and reaches more than 30 channels. Out of the box it is supervised (medium-risk actions need approval, high-risk ones are blocked), keeps file tools in the workspace and runs tools in the OS sandbox it detects (Landlock, Bubblewrap, Firejail or Docker on Linux, Seatbelt on macOS) (README, security model). Prebuilt binaries run on any Raspberry Pi. Until October 2026 this section said ZeroClaw only runs local models, denies egress at the iptables level, is AGPL-3.0 and bundles an offline RAG over a document folder: its documentation says none of that.

Drawbacks: sandboxed tools keep full network egress unless you restrict them (sandboxing), and its audit log covers certificate issuance only, not command execution. A smaller plugin ecosystem than OpenClaw's.

We recommend ZeroClaw for: small or low-power hosts, hardware projects (it drives GPIO, I2C and SPI on Raspberry Pi, STM32, Arduino and ESP32), and anyone who wants approvals and a sandbox on before the first run. With Ollama as its provider, it keeps prompts on your machine.

2.7 Moltworker

Moltworker is Cloudflare's proof of concept for running OpenClaw in a Cloudflare Sandbox container behind a Worker. It needs the Workers Paid plan ($5 a month) plus container time, about $34.50 a month for a standard-1 container running around the clock by its README's estimate, less if the container sleeps when idle. The admin UI sits behind Cloudflare Access and every new device must be paired; browser navigation goes through Cloudflare Browser Rendering (README). Until October 2026 this section described a 600-line agent that runs as a Worker with state in Durable Objects, free at low volume and unable to automate a browser: its README describes none of that.

Drawbacks: ties you to Cloudflare. Its README warns that it is experimental, not officially supported and may break without notice. Without R2 storage, paired devices and conversations are lost whenever the container restarts, and the first request can take a minute or two while the container starts.

We recommend Moltworker for: developers who already use Cloudflare and want to try OpenClaw without a server of their own. Less compelling for anything that needs to stay up.

Section 3: Security posture

The OpenClaw crisis of early 2026 is the reference point: a one-click takeover of the gateway (CVE-2026-25253) and more than 135,000 instances reachable from the internet. The agents that grew up around it answer the same threats with different defaults, and the defaults are what most people run.

3.1 The threat model, in 2026

The realistic threat model for a self-hosted AI agent includes, at minimum:

• Web-origin attacks. A page you visit can make your browser talk to services on your machine or your network. CVE-2026-25253 is the canonical example: a crafted link sent the gateway token to the attacker.
• Prompt injection. A document, web page, or tool description fed to the agent can attempt to redirect its behaviour. OWASP ranks it first in its Top 10 for LLM applications. Defences range from capability scoping to approvals to never letting the agent act on its own on untrusted input.
• Supply chain. Plugins, MCP servers, and pre-built tool configs are a major attack surface. Reading the code you run is one defence, though it scales badly once an agent passes 100,000 lines. Allowlists, approvals and a sandbox you switch on (Hermes Agent, OpenClaw, Nanobot) are another.
• Credential exfiltration. API keys, SSH keys, browser cookies and local secrets are all targets. Keep them out of the agent's reach: encrypted at rest, injected at the boundary (IronClaw's model), or at least in a file only the agent's user can read.
• Tool execution privilege escalation. Tools that need elevated privileges (filesystem write, shell execution, network egress) should be scoped and approved explicitly, not granted by default.

Each of the seven agents has a different posture against this threat model. Our agent comparison covers the per-project specifics.

3.2 Reporting and patches

How fast a project patches is visible in its advisories, not in its marketing: the CVE tracker lists, for each tracked component, every CVE with its publication date and the release that fixed it. How to report a flaw to each agent, from its own security policy:

• OpenClaw: GitHub security advisories, per its security page.
• Hermes Agent: GitHub Security Advisories or [email protected], no bug bounty (SECURITY.md).
• Nanobot: private GitHub advisories or the maintainers' email, with an answer aimed for within 48 hours (SECURITY.md).
• ZeroClaw: GitHub Security Advisories (SECURITY.md).
• NanoClaw: GitHub's private vulnerability reporting (SECURITY.md).

3.3 What self-hosters should actually do

• Pick an agent with a documented threat model. If the project doesn't have one, that's a signal.
• Run the agent, or at least its tools, in a sandbox. A container is the common choice; gVisor or a virtual machine isolate further.
• Don't expose the dashboard or the gateway on a public IP. Use Tailscale, an SSH tunnel, or a reverse proxy with strong authentication.
• Keep credentials out of the agent's home directory where you can, and inject them at runtime.
• Follow your agent's security advisories, or let the CVE tracker do it.
• Plan for migration: be ready to move to another agent if yours has a critical flaw and no fix.

We have a more detailed security guide focused on the OpenClaw-specific risks, but most of the principles apply broadly.

Section 4: Hosting economics

What it costs to run an agent depends on three things: where it runs, whether it calls a hosted model or a local one, and how much it calls it. Prices change often, so this section links the price pages instead of copying them, except where a figure is the point.

4.1 Free and nearly free

• Cloudflare Workers. The free plan covers 100,000 requests a day; the paid plan starts at $5 a month (pricing). Plain Workers cannot run native binaries or long-running processes, so most agents do not fit. Moltworker needs the paid plan plus container time, about $34.50 a month for a standard-1 container running around the clock by its README's estimate, less if it sleeps when idle.
• A machine you already own. A Raspberry Pi 5 or a mini PC runs an agent that calls a hosted model; see the hardware pages.

4.2 A small VPS

An entry VPS with 2 to 4 GB of RAM, a few euros or dollars a month at providers such as Hetzner, Hostinger or Contabo, runs one user's agent that calls a hosted model. Browser automation wants the upper end of that range. You are responsible for OS updates, the firewall and backups: the agent itself is the easy part.

4.3 Managed hosting

Managed OpenClaw services sell the operations instead: $19 or $49 a month at ClawRift, $20 or $100 at NitroClaw, the latter with AI credits included (their own pricing pages, read on October 18, 2026). The choice against a VPS is mostly about how much system administration you want to do.

4.4 Local models

Running the model yourself is where hardware costs rise: a 70B-class model quantised to 4 bits needs around 40 GB of memory for its weights alone, so a large-memory Mac, a GPU server or rented GPU time. It pays back only with sustained use, or when the data must not leave your hardware. The hardware sizer estimates what a given model needs.

4.5 The cost people forget

“Self-hosted” does not mean “free”: unless you run a local model, you still pay Anthropic, OpenAI, Google or OpenRouter per token, and an agent that loops through tools spends far more tokens than a chat. The cost calculator works it out from the providers' published prices. Browser-automation agents also use bandwidth, and local models need tens of gigabytes of disk each.

Section 5: Model integrations

Every agent here can call more than one model provider, and most can call a local server. What matters from the agent's side:

5.1 Hosted models

• Anthropic (Claude). The model family several of these agents were built around (NanoClaw through the Claude Agent SDK, Nanobot with a native provider). Prompt caching cuts the price of a repeated prefix, such as a long system prompt and tool list, by up to 90%, per Anthropic; prices are on its pricing page.
• OpenAI. Supported natively by OpenClaw, Hermes Agent, Nanobot and ZeroClaw.
• Google (Gemini). Supported natively by Hermes Agent and ZeroClaw.
• OpenRouter. One OpenAI-compatible endpoint in front of many providers: fallback between providers and one bill. Its fees are on its site.

Which model is best for agent work changes with every release; we do not rank them here. Try the one you plan to use on your own tasks, with the tools you will give it.

5.2 Local models

Llama, Qwen and Mistral publish open-weight models that run through Ollama, vLLM or llama.cpp, and every agent here can talk to such a server. Our opinion: on multi-step agent work, models small enough for a desk machine fall short of the large hosted models; on narrow tasks they are often enough, and they keep the data on your hardware. Test before you switch. The model families are described in the glossary.

Section 6: Regulatory environment

This is an overview, not legal advice.

6.1 EU AI Act

The AI Act entered into force on 1 August 2024 and applies in stages: prohibited practices from 2 February 2025, the obligations on general-purpose AI models from 2 August 2025, most other rules from 2 August 2026. Since the AI Omnibus, the high-risk rules apply from 2 December 2027 for the use cases of Annex III and from 2 August 2028 for AI built into regulated products (European Commission).

For a self-hosted agent this means:

• the obligations on general-purpose models fall on their providers (Anthropic, OpenAI, Google, Meta, Mistral and the others), not on you for calling them;
• using an agent for a high-risk purpose (hiring, education, critical infrastructure and the other Annex III uses) brings deployer obligations of its own, whatever model it runs;
• a personal assistant or an internal tool is rarely high-risk. If yours might be, read the Annex III list and ask a lawyer.

6.2 United States

There is no federal AI statute. The 2023 executive order on AI (EO 14110) was revoked on 20 January 2025 (White House). State laws are the moving part. California's SB 1047, often cited in 2024, was vetoed (veto message); Colorado's AI Act (SB 24-205) targets high-risk systems that make consequential decisions about consumers. For an internal tool or a personal assistant none of this is likely to bind; for a consumer-facing product built on an agent, get legal advice.

6.3 Sectoral rules

Healthcare (HIPAA in the US, health-data rules in the EU), finance and government each add requirements that reach AI agents through the data they touch. IronClaw's documentation makes no compliance claim: its sandboxed tools and encrypted secrets are building blocks, not a certification. Any agent that talks to a local Ollama server (ZeroClaw, Hermes Agent and Nanobot among them) can keep prompts on your hardware.

Section 7: What we watch next

• Whether more agents follow NanoClaw, IronClaw and ZeroClaw in turning a sandbox on by default, OpenClaw and Hermes Agent first.
• How the OpenClaw Foundation, announced on 8 July 2026 (OpenClaw Foundation), handles security reports and releases.
• The CVEs themselves: the CVE tracker shows, component by component, how many there are and how fast they are fixed.

This report is revised when the projects change; the last pass was on 27 October 2026. If you have a correction, email [email protected].

Methodology and sources

This report was assembled from:

• Each project's repository, documentation, release notes and security advisories (those checked on October 18, 2026 are listed below).
• Foundation announcements and public security writeups.
• The CVE database and public security disclosure feeds.

No agent was installed or tested for this report (how we compare agents is on /methodology). Until October 2026 this list also claimed direct testing on real deployments (Hetzner CX22, Cloudflare Workers, Hostinger Cloud, Mac Studio M3 Max), conversations with contributors to the major projects and usage or revenue data from the managed services. None of them left a trace we can show, so they are gone, along with the lines that said which providers “our own testing” used.

Correction, 27 October 2026: sections 3 to 7 used to give an OpenClaw install base (88,000 in April, down from 135,000), patch-time and embargo norms, VPS prices and a Fly.io free allowance, model shares and performance percentages for local models, a release date for GPT-5, a federal AI executive order “still in force” and California's SB 1047 as a law. None of it had a source, and several were wrong; the sections now keep what a source backs and say where we give an opinion.

No one pays for a place in this report. Partner links are listed on the disclosure page.

Sources for the October 2026 corrections

Read on 18 October 2026 (Hermes Agent v0.22.2, Nanobot v0.3.5, OpenClaw v2026.10.4).

• Hermes Agent: README, tools and terminal backends, security docs, SECURITY.md (trust model, reporting), default terminal backend in v0.22.2 and v2026.3.12, install script options, releases.
• Nanobot: README (v0.3.5), providers, configuration: security and pairing, SECURITY.md, README of February 2026; line count: Python files under nanobot/ in the v0.3.5 release archive, blank lines and comments included.
• OpenClaw: README (v2026.10.4), sandboxing docs.
• NanoClaw (main, 7be8d7f): README, security model, SECURITY.md.
• IronClaw (main, b0b999d): README, licence field, sandboxed tools, shell tool.
• ZeroClaw (v0.8.6): README, NOTICE, security model, sandboxing, SECURITY.md.
• Moltworker: README (main, 7b00c1d).

Related guides

• The OpenClaw timeline: from Clawdbot to a foundation
• OpenClaw security crisis 2026: what you need to know
• OpenClaw alternatives in 2026
• How to migrate from OpenClaw to Hermes Agent