Best open-source AI agents in 2026

1. 

   Personal assistant you run through chat apps

   1. OpenClaw

   6.5/10

   OpenClaw is for people who want a personal assistant running on their own machine and taking orders through chat apps they already use: the site cites 29 channels, including WhatsApp, Telegram, Slack, Signal, iMessage and, as a plugin, Zalo. You run a Gateway on your computer or server and connect it to Claude, GPT or a local model; it keeps memory across conversations, browses the web, fills in forms, reads and writes files, runs shell commands and extends through community skills. The software is free under the MIT license with no paid or hosted tier, so what you actually pay for is the model API and the machine. It has the largest community here (about 394k GitHub stars) and is stewarded by the OpenClaw Foundation, a US nonprofit. Security is the main thing to weigh. Unit 42 confirmed malicious skills on the ClawHub marketplace (citing Koi Security's disclosure of 341) and still found five that slipped past screening between February and May 2026; OpenClaw banned the accounts, deleted the skills and partnered with NVIDIA on screening. Wikipedia, citing The Register, says version 2.0 neither encrypts stored secrets nor enables the sandbox by default, and the README confirms tools run on the host unless sandboxing is configured. Bloomberg, citing anonymous sources, reported that Chinese state agencies and state-owned banks were told not to install it on office devices. A maintainer has warned it is unsafe for people who cannot use a command line, and the iOS app has 3.5/5 from 76 US App Store ratings.

   Read our full OpenClaw review
2. 

   Assistant with long-term memory and a choice of runtimes

   2. Hermes Agent

   7.0/10

   Hermes Agent, from Nous Research, suits people who want one agent with one memory across the terminal, Telegram, Discord, Slack, WhatsApp, Signal and email. Conversations, memories and the skills it writes itself persist between sessions; it schedules tasks from plain-language requests, hands work to isolated subagents, searches the web and drives a browser. You choose where it runs (locally, in Docker, over SSH, on Modal or as a cloud agent) and which model it uses (Nous Portal, OpenRouter, OpenAI or any endpoint). The software is free under the MIT license, and the GitHub repo shows about 262.6k stars. If you would rather not manage API keys, Nous Portal has Free (free models only), Plus at $20, Super at $100 and Ultra at $200 a month; the paid plans include capped usage and one cloud agent, but the pricing page states neither the included credit amounts nor refund terms. On Portal, the policy lets Nous use data to improve its services and share it with AI-training providers unless you turn on Privacy Mode; a local install keeps conversations, memory and skills on your machine. The security record needs reading: per the Cloud Security Alliance, an independent audit posted in April 2026 reported 4 Critical and 9 High findings in v0.8.0, largely in its default configuration; they have no CVE IDs, and CSA gives no patch status and records no response from Nous Research; and a file-permission flaw (CVE-2026-53870) is fixed in 0.16.0. The AI Incident Database also lists Hermes in reported intrusions by attackers, though those reports do not allege a flaw in Hermes. Docs are in English and Simplified Chinese only, and the desktop app has just 16 Microsoft Store ratings (4.7/5).

   Read our full Hermes Agent review
3. 

   General-purpose agent under a neutral foundation

   3. goose

   7.3/10

   goose suits people who want an agent for more than code: its README lists research, writing, automation and data analysis alongside coding. Block released it as open source in early 2025 under Apache 2.0, and in December 2025 contributed it to the Linux Foundation's Agentic AI Foundation, so no single vendor controls it. It ships as a desktop app for macOS, Linux and Windows, a CLI and an API, and the desktop source includes 16 interface languages. It connects to 15+ model providers and 70+ MCP extensions; local models run through Ollama or LM Studio, and the ACP protocol lets it reuse a Claude, ChatGPT or Gemini subscription you already pay for. Recipes package workflows as portable YAML files, and subagents run tasks in parallel. goose has no paid plan: costs sit with the model provider, from free tiers (Groq, Google Gemini) to pay-per-use. Usage metrics are opt-in and exclude conversations and code. The risk Block itself documented: in its Operation Pale Fire exercise (January 2026), its internal red team got an infostealer to run on an employee's laptop through a poisoned recipe; the sources report no harm to outside users. goose then started showing recipe instructions, stripping invisible characters and detecting prompt injection, while the docs call these a safeguard, not a guarantee. Approved commands run with your full permissions, and help comes only from docs and the community.

   Read our full goose review
4. 

   Coding agent not tied to one model vendor

   4. OpenCode

   7.0/10

   OpenCode, from Anomaly, is a coding agent for the terminal, a desktop app (macOS, Windows, Linux) and the web, with an iPhone app via TestFlight. Its draw is model freedom: 200+ providers through Models.dev, local models included, or sign in with a ChatGPT Plus/Pro or GitHub Copilot plan you already pay for. It runs several agents in parallel on one project, supports MCP, plugins, custom agents and SKILL.md skills, and lets you choose which actions need approval. The software is MIT-licensed and free; to get models from OpenCode itself, Go costs $10 a month and Go Plus $40, with limits given only as estimates, while Zen is pay-as-you-go with a 4.6% + $0.31 fee on each credit purchase. Go may be refunded if you ask within 14 days and have used almost none of it. The privacy policy says prompts pass to the model provider and are not stored, except hosted agent sessions. Two points weigh against it. In 2026 four flaws let a malicious website or MCP server run commands on users' machines, including the Critical-rated CVE-2026-22813; all are patched, so use 1.18.33 or later. The reporter of CVE-2026-22812 says an email to the project went unanswered, while Datadog credited Anomaly with quick patching of the flaw it reported. And per Shareuhack, early OpenCode versions sent a spoofed Claude Code header to use Claude subscriptions via OAuth; Anthropic blocked this from 9 January 2026 and OpenCode removed the code on 19 February 2026, so Claude now needs an API key or a separately installed Claude Code. Only an English interface is documented.

   Read our full OpenCode review
5. 

   Coding agent inside VS Code and JetBrains

   5. Kilo Code

   6.9/10

   Kilo Code fits developers who want the agent inside the editor they already use: VS Code (and Open VSX editors such as Cursor and Windsurf), JetBrains, plus a CLI, Slack, cloud agents in the browser, an iOS app and a desktop beta. The code is MIT-licensed (about 27,900 GitHub stars), and Anaconda acquired the company in July 2026, saying existing users keep their plans and support. It works with your own API keys, local models or 500+ models through Kilo Gateway, where the vendor says it adds no markup; credit purchases carry a 5% fee. The extensions are free, and the Auto Free tier needs no top-up. Kilo Pass Starter, Pro and Expert cost $19, $49 and $199 a month for up to $26.60, $68.60 or $278.60 in monthly credits; Teams, for businesses, is $15 per user a month, and cloud agents are billed by run time ($0.60–$1.20 an hour). Because spend follows usage, totals are hard to predict, and the pricing page states no refund policy; Trustpilot shows 2.4/5 from 19 reviews, mostly billing complaints, against 3.9/5 from 219 ratings on the Visual Studio Marketplace. The heaviest point is data: in August 2026 an incident at vendor Metabase exposed some users' names and emails, possibly prompts, billing addresses and location, and Slack tokens for a small subset of Slackbot users; Kilo confirmed it, invalidated those tokens, said payment information was not exposed and notified affected users. The privacy policy says nothing about model training or the data the IDE extensions collect.

   Read our full Kilo Code review
6. 

   Self-hosted platform for a team's coding agents

   6. OpenHands

   6.9/10

   OpenHands, from All Hands AI and formerly OpenDevin, is less a single assistant than a self-hosted platform for running coding agents across a team. Its open-source Agent Canvas (MIT, 93,000+ GitHub stars) runs the OpenHands agent and can also drive Claude Code, Codex, Gemini CLI or OpenCode, on a schedule or from webhooks; a Python SDK and an Agent Server (REST/WebSocket) let you build your own agents. Each conversation runs in a Docker container, and you bring your own key for any LLM. The team's ICLR 2025 paper evaluates its agents on 15 tasks, including SWE-bench and WebArena. Agent Canvas is free to run yourself, and there is no paid plan for individuals: Teams, a business plan, costs $500 a month for up to 10 users ($50 per extra seat, 5,000 sessions a month, 30-day trial), and Enterprise is custom-priced. The pricing page does not list OpenHands Cloud, though the vendor's blog announced a $20/month Cloud subscription in September 2025. On security, a command-injection flaw (CVE-2026-33718, CVSS 7.6) was fixed in 1.5.0. A researcher published a prompt-injection route that leaked a GitHub token and says he waited 148 days for a reply; OpenHands later published general mitigations that do not address the report specifically, said it had seen no real-world attack, and acknowledges its sandbox does not stop secrets in the agent's environment being exfiltrated. If you use the vendor's services, its privacy policy allows training on your content with no stated opt-out. The legacy CLI is no longer maintained, and the site and docs are English-only.

   Read our full OpenHands review
7. 

   Self-hosted infrastructure for agents and dev environments

   7. Coder

   6.9/10

   Coder is infrastructure rather than an assistant: a self-hosted platform (AGPL-3.0) for development environments and AI agents on servers you control. Workspaces are defined in Terraform and run on Kubernetes, Docker or EC2 VMs, reached from VS Code, JetBrains, Cursor, a web terminal or SSH. Its built-in Coder Agents run in the control plane with Anthropic, OpenAI, Google, Bedrock or self-hosted models, with audit logs and per-user spend limits, controls the single-user tools above leave to you. The Community edition is free with unlimited workspaces but caps you at 5 active Coder Agents and 1 platform integration; Premium and AI Premium are business plans with unpublished prices. The privacy policy says free users are opted in to usage metrics with no opt-out. The security record matters because Coder sits next to cloud credentials: on 31 August 2026, between 07:35 and 21:45 UTC, an attacker used a compromised Cloudflare API key to redirect part of the traffic to Coder's module registry to a server serving tampered Terraform modules built to collect AWS, GCP and Azure credentials. Coder says it remediated the issue the same day, that its own codebase and Google Cloud infrastructure were not compromised and that an outside firm confirmed the scope, and it recommends upgrading to patched releases and rotating any exposed credentials. Per BleepingComputer, Coder lacks the attacker's logs, so it cannot identify every affected deployment. The project also published a Critical Azure identity bypass (CVE-2026-46354, patched) in May 2026 and several advisories in October–November 2026, two of them rated High.

   Read our full Coder review