Correction, October 2026. The first version of this report gave star counts for seven agents, a reader survey with hardware and vector-store shares, a price cut, a benchmark ratio, and three CVE identifiers with patch-latency figures. None of these had a source we can show, and in NVD those three identifiers belong to unrelated products. All of it has been removed. Two kinds of content are left: the security section, where every CVE links to its NVD entry, and editorial opinion, which is ours and is not data.
This is PocketClaw's Q2 2026 look at the ecosystem: self-hosted AI agents, the CVEs around them, the hardware they run on, and the providers around them.
The report has six sections. Skip to whichever matters to you.
1. The agent landscape
There is no star table here any more: the one in the first version had no trace. Stars, latest release and last commit for each agent we follow are on the live tracker, which reads them from GitHub.
Our view, as opinion and not as data: the field is consolidating around a few projects. OpenClaw is still the reference, security history included. Hermes Agent is the alternative we point to most often. The smaller agents each serve a narrower need.
Takeaway: choose an agent for its sandbox and its release discipline. A star count measures attention.
2. Security
What the NVD record shows for March to June 2026 is that the serious bugs moved down the stack, from the agents to the infrastructure they run on:
- CVE-2026-48746, vLLM from 0.3.0, fixed in 0.22.0, CVSS 9.1, published June 22: an authentication bypass in how vLLM's ASGI server handled requests. Our breakdown: vLLM security CVEs 2026.
- CVE-2026-4944 and CVE-2026-5817, May:
trust_remote_code=Truehardcoded in vLLM model code and in the vllm-metal backend of Docker Model Runner. - The multi-tenant authorization gaps in vector databases and in MLflow, covered in vector database authorization CVEs and MLflow authorization CVEs.
Takeaway: the agent you picked matters less than the inference server, vector store and tracking server under it. Most teams watch the agent's release notes and nothing else. The live list of every CVE we ingest from NVD is on /cves.
3. Hardware
Our pick for the quarter is the Mac Mini M4 16 GB: unified memory makes 7B to 13B models usable, idle power is low, and macOS hosts Docker reasonably well. This is an opinion, not a market share: the survey figures of the first version have been removed.
The first version also called the 16 GB Raspberry Pi 5 a rumour. It is not: it has been on sale since January 2025, at $120 at launch. Eight gigabytes is the ceiling that holds a lot of Pi users back; sixteen lifts it for memory, not for speed.
Takeaway: if you're buying hardware, the boring answer is a Mac Mini M4 16 GB. The cheaper answer for small models is a Pi 5. The wrong answer is a GPU box that sits idle 90% of the day.
4. Providers (LLM and infrastructure)
The first version listed provider news for the quarter (a model release, a price cut, a new hosting tier) that we cannot source. It has been removed.
What we keep is a strategy, and it is an opinion: a small model with prompt caching for the cheap calls, a larger one for reasoning, and a second provider behind OpenRouter for resilience. Prompt caching matters most for agents, whose long system prompt is sent on every call.
For EU hosting, our guides use Hetzner.
Takeaway: the LLM strategy we recommend for a self-hosted agent is "Claude Haiku + prompt caching for cheap calls; Sonnet for reasoning; OpenRouter fallback for resilience."
5. Models (open-weight)
Our picks, as opinion: Qwen 2.5 Coder 7B for code workloads, Mistral Small 22B as the mid-tier for general workloads, Llama 3.3 70B as the capability ceiling for a solo developer's hardware budget.
One correction: the first version presented Qwen3 as a May 2026 release. The Qwen3 series was released on 29 April 2025. Its 32B model has a thinking mode worth trying on reasoning-heavy tasks.
llama.cpp, Ollama and mlx-lm are the three runtimes to know. On Apple Silicon, mlx-lm is built for the platform. We no longer give a speed ratio against Ollama: the one in the first version had no published measurement behind it.
Takeaway: there is no "right" open-weight model, there are right matches between model and workload. For code, Qwen Coder. For general work, Mistral Small. For maximum local capability, Llama 3.3 70B.
6. Infrastructure (the boring layer)
Tailscale: still our default mesh VPN for self-hosted AI access patterns. The free tier covers most home labs. Headscale is the self-hosted coordination server if you want one.
Caddy: still the easiest reverse-proxy-with-TLS for self-hosted agents. Nginx remains the right call when you need rate limiting and fail2ban integration.
Docker vs Podman: tutorials assume Docker, so Docker is the path of least resistance. Podman makes sense where rootless-by-default matters.
Vector stores: Qdrant is our default, for its lighter footprint, its simple REST API and bring-your-own embeddings. Weaviate is the call for larger organisations that need built-in RBAC and multi-tenancy. Read the authorization CVEs linked in section 2 before relying on multi-tenancy in either. The reader shares given in the first version have been removed.
Takeaway: Docker + Caddy + Tailscale + Qdrant is our default stack. Anything else deserves a written reason.
What happened to the Q3 report
The first version announced a Q3 report for early September 2026. It was not published. The live pages are the current state: agents and CVEs.
Methodology and sources
The security section relies on the NVD record of each CVE cited, linked in the text. The two corrections on hardware and models link to the vendor's own page. Everything else in this report is editorial opinion: mine (Robin Monteiro) unless attributed. Corrections welcome at [email protected].
Reference reading:
- Live agent tracker, stars, releases and CVE counts per agent
- CVE archive, every CVE we ingest from NVD for the components we follow
- Pocket AI hardware hub, the hardware pages
- Provider reviews: long-form takes on each provider