AI agents in 2026: frameworks, runtimes, autonomous assistants and personal agents

This month, GNU/Linux Magazine France dedicates its cover to AI agents, featuring a comprehensive tutorial by Mejri Issam: writing an agent with AWS's Strands Agents SDK, then deploying it on Bedrock AgentCore. The same month, Meta launches Muse, its personal agent, and autonomous assistants installed on a simple VPS, such as Hermes Agent or OpenClaw, exceed one hundred thousand stars on GitHub.

Everyone talks about agents, but not about the same objects. A Python SDK, a cloud service, self-hosted software, and a consumer application all share the same name, yet they address neither the same needs nor the same risks. Comparing them in a single ranking would make no sense.

This guide brings order. The first part addresses everyone: what an agent is, and the map of the four families. The second details each family for developers and technical teams. The last addresses IT management and CISOs: where data goes, what risks exist, what costs to expect, and how to choose.

1. What is an AI agent?

A chatbot receives a question and produces text from what it knows. The agent receives an objective and chains real actions (search, read a file, call an API, send an email) until achieving it.

For beginners: the intern metaphor

Imagine a brilliant intern who doesn't have the right to leave their office. The chatbot is this intern to whom you ask questions: they answer from memory. The agent is the same intern to whom you give a phone, access to the shared filing cabinet, and a task list. They call, check, note, call back, and return the finished work. The more access you give them, the more useful they are, and the more expensive their mistakes.

The four components

1. The model (LLM): the brain. It understands the request and decides the next action. Claude, GPT, Gemini, Llama, Qwen, or Mistral can play this role.
2. The tools: the hands. Each tool is a function described to the model (name, role, parameters). The model doesn't execute it itself: it asks to call it, and the surrounding programme executes. The MCP (Model Context Protocol) protocol standardises how to plug in these tools.
3. The loop (agent loop): the engine. The programme sends the request to the model, executes the requested tool, returns the result to the model, and repeats as long as the model doesn't declare it finished or a limit isn't reached.
4. Memory and state: the notebook. Short memory (the history of the current task, limited by the context window) and long memory (preferences, learned facts, stored outside the model and re-read when useful).

For experts: ReAct and what has changed

The ReAct schema (Reasoning + Acting, Yao et al., 2022) alternated written thought, an action, and an observation. Today, models call tools natively via structured output (function calling or tool use) and often reason in a dedicated reflection space. The loop remains the same, but tool calling has become reliable, contexts have lengthened, and models now handle tasks lasting several hours.

Three architectures appear everywhere:

• Single agent with many tools: simple to debug, but tool choice degrades when the list exceeds a few dozen entries.
• Orchestrator and sub-agents: a main agent breaks down the task and delegates to specialised agents, each with its own context. More robust on long tasks, more expensive in tokens.
• Graph or workflow: steps and branches are written by the developer, the model intervenes only at nodes. Less autonomous, much more predictable, often the right choice in enterprise.

The autonomy cursor

An agent's autonomy adjusts like a cursor. At the lowest, it proposes and a human validates each action. In the middle, it acts alone on reversible actions (read, search, draft) and asks before irreversible actions (send, pay, delete). At the highest, it runs continuously, triggered by events or a scheduler, without a human in the loop. Most incidents come from an agent placed too high on this cursor relative to the access granted.

2. The map: four families, two questions

To classify any agent, two questions suffice. Must you build it (code) or is it ready to use? And who hosts it: you, or a publisher?

Families combine. The agent presented in GNU/Linux Magazine France is a good example: it's written with a framework (Strands Agents) then deployed on a managed runtime (Bedrock AgentCore). Conversely, Hermes Agent or Meta Muse are used without writing a line of code.

3. Family 1: frameworks and SDKs

An agent framework is a library that writes the loop for you: you declare the model and tools, it handles calls, errors, context, and traces. It provides neither server, interface, nor hosting.

For beginners

It's the equivalent of a flat-pack furniture kit. You get exactly the furniture you want, but you need to know how to screw. If you don't code, skip directly to sections 5 and 6.

Here's the minimal agent with Strands Agents, from the official repository. Three lines suffice: the agent receives a calculator tool and decides alone to use it.

from strands import Agent
from strands_tools import calculator
agent = Agent(tools=[calculator])
agent("What is the square root of 1764")

The seven frameworks that matter in 2026

For experts: what truly separates them

• Autonomy or control. Strands, OpenAI Agents SDK, and Claude Agent SDK let the model drive the loop. LangGraph, Microsoft Agent Framework workflows, and CrewAI Flows write the path and entrust only local decisions to the model. In regulated production, the second approach audits much better.
• Recovery on failure. A 40-minute task that crashes at minute 38 must resume where it was. LangGraph and Microsoft Agent Framework natively handle recovery points; elsewhere, persisting state remains your responsibility.
• Vendor lock-in. The Claude Agent SDK only speaks to Claude, with very polished file and terminal tooling. The others are multi-model, which matters if you route between a local model and a premium model via a gateway like LiteLLM.
• Interoperability. MCP is now supported by all seven for plugging tools. The A2A (Agent-to-Agent) protocol, which enables dialogue between agents from different frameworks, is mainly carried by Google and Microsoft.
• Cloud ecosystem. Framework choice often follows the cloud: Strands towards AgentCore, ADK towards Vertex, Agent Framework towards Foundry. Nothing technically requires it (all run in a container), but integration is simplest there.

4. Family 2: managed runtimes

A managed runtime hosts and operates the agent you coded: it isolates it, gives it an identity, stores its memory, traces its actions, and scales it. You bring the code, the cloud handles the rest.

For beginners

If the framework is the furniture kit, the runtime is the store that displays it, insures it, and watches it at night. To go from your laptop to production, an agent needs authentication, logs, recovery after failure, and separation between users. The runtime provides precisely these building blocks.

Amazon Bedrock AgentCore, in detail

AgentCore is a set of modular services, usable together or separately:

• Runtime: serverless execution with isolation per session, quick start for interactive and long executions for asynchronous. It accepts any framework (Strands, LangGraph, CrewAI, LlamaIndex, Google ADK, OpenAI Agents SDK) and any model, including outside Bedrock, as well as MCP and A2A protocols.
• Harness: a managed agent loop, called in a single API request. You provide the model, system prompt, and tools; each session runs in an isolated micro-VM with filesystem and terminal.
• Memory: short memory (conversation) and long memory (between sessions), shareable between agents.
• Gateway: transforms existing APIs, databases, or Lambda functions into tools usable by the agent, notably via MCP.
• Identity: manages the agent's identity and its delegated access to third-party services.
• Browser and Code Interpreter: a managed browser and code execution sandbox.
• Observability and Policy: metrics, traces, and logs in CloudWatch, and rules that frame what the agent is allowed to call.

The equivalents at Google and Microsoft

At Google, Sessions and Memory Bank reached general availability in December 2025 and have been billed per usage since 28 January 2026. Memory Bank isolates memories by identity, allows configurable lifetime, and IAM rights per scope.

For experts: what to check

• The region. Not all building blocks are available everywhere. According to the AWS regions page, Frankfurt offers the full AgentCore suite whilst Paris only offers part of the services (Gateway, Identity, Memory): an agent intended for France therefore often runs in Frankfurt or Ireland. Check each building block, not just the runtime, in your target region.
• The model is a separate subprocessor. A runtime in Europe calling a model hosted elsewhere sends data out. Runtime and inference are evaluated separately in your GDPR registry.
• The hidden cost of memory. Sessions, long memory, and code execution are billed separately from compute. A chatty agent that memorises everything costs more in storage and retrieval than in tokens.
• Reversibility. An agent written with an open-source framework redeploys elsewhere; an agent depending on Harness, Gateway, or Memory Bank is tied to its cloud. Isolate these calls behind an abstraction layer if reversibility matters to you.

5. Family 3: self-hosted autonomous assistants

An autonomous assistant is a complete agent, already written, that you install on your machine, a mini-PC, or a VPS. It runs continuously, you talk to it from Telegram, WhatsApp, or a terminal, and it acts with the model of your choice. It's the family that exploded in 2026, and the one raising the most security questions.

For beginners

Think of a digital butler who lives at your place. They can read your files, launch commands, browse the web, send you a summary every morning. They belong to you: no mandatory subscription, no data sent to an agent publisher. In return, the front door is your responsibility. If you don't know what a firewall or a non-administrator user is, get help before installing.

Hermes Agent (Nous Research)

Hermes Agent is the open-source project (MIT licence) from Nous Research, previously known for its Hermes models. Its promise is an agent that learns:

• Learning loop. After a complex task, it writes its own reusable skill, improves it with use, and maintains its memory. It retrieves old conversations by full-text search and can model the user via Honcho. Its skills follow the open agentskills.io standard.
• Any model. Nous Portal, OpenRouter, OpenAI, or your own endpoint, and you change models without touching the code. It can therefore go through a gateway like LiteLLM, which distributes tasks between a local model (Ollama), an economical API, and a premium API.
• Everywhere. A single gateway for Telegram, Discord, Slack, WhatsApp, Signal, and command line. Multiple execution environments: local, Docker, SSH, Singularity, Modal, or Daytona.
• Scheduled tasks and sub-agents. An integrated scheduler launches daily reports or weekly audits described in natural language. Isolated sub-agents process work in parallel.
• Migration. It automatically imports settings, memories, skills, and API keys from OpenClaw.

OpenClaw

OpenClaw (first called Clawdbot then Moltbot) is the open-source personal agent that went viral in early 2026. It extends through skills published on ClawHub, its community marketplace. Bitdefender described it in February 2026 as one of the most popular AI projects of the year, with over 160,000 GitHub stars and approximately 5,000 third-party skills.

For experts: hardening an autonomous assistant

1. Dedicated machine or VM, non-administrator user, no access to your SSH keys or personal keychain.
2. No network exposure. Gateway listening on 127.0.0.1, remote access by VPN or tunnel, sender whitelist on messaging.
3. Skills verified one by one. Read the SKILL.md and scripts before installation, refuse any "prerequisite" that asks to run a command or binary, pin versions.
4. API keys with reduced scope. One key per agent, with quota and list of authorised models, behind a gateway (LiteLLM) that logs every call.
5. Human validation on irreversible: send, payment, deletion, sudo command.
6. CVE monitoring on the agent itself, with monthly updates at minimum.
7. Sensitive data local only. A routing rule that forces the local model and forbids fallback to an external API for what must not leave.

6. Family 4: consumer personal agents

A personal agent is a turnkey service: you create an account, connect your applications, and the agent acts for you at the publisher. No installation, no code, but everything goes through the publisher's servers.

For beginners

It's the executive assistant of a large agency. Very competent, available everywhere, but they work in the agency's premises and keep a copy of your calendar, emails, and sometimes your credit card. Before hiring them, ask yourself what you'd accept to entrust to the company employing them.

Meta Muse, the newcomer

Announced on 8 September 2026, Muse is Meta's personal agent. It's built on models developed under Alexandr Wang's direction and relies on Muse Spark, a multimodal model designed for agentic work.

• What it does. It connects to your applications (emails, calendar, payments, health, connected home, purchases, music) to execute multi-step tasks. It runs in a dedicated virtual machine, Muse Secure VM, continues working after closing the application, and requests your approval before a purchase or message send. You use it in a dedicated application or in WhatsApp.
• On computer. A Mac version requests explicit activation and approval before deleting or sending data; it works in files, emails, messages, calendar, and notes.
• What's coming. At the Connect conference on 23 September, Meta announced a real-time video avatar, arrival in its connected glasses, a dedicated email address for the agent, and merchant partnerships (Shopify, Stripe, PayPal, Walmart, Sephora…).
• The business model. According to Mark Zuckerberg, Muse is free for a large volume of tokens and Meta plans to earn through a small commission on transactions. The agent therefore has an interest in making you buy.
• Availability. At launch, Muse is reserved for the United States and those over 18. No opening date in Europe was announced when this guide was written.

The American press itself raises the question of trust: TechCrunch points out that Muse requests more personal data than any Meta service before, days after an $18 billion settlement on social media harms.

Other personal agents

• ChatGPT Work (OpenAI): launched on 9 July 2026 with GPT-5.6, it succeeds ChatGPT Agent, which already grouped Operator and deep research. It works hours in the background in your applications and files, has you validate key actions, then delivers a document, spreadsheet, or presentation.
• Claude Cowork (Anthropic): a desktop application where Claude works in your files and applications, with connectors to your work tools.
• Gemini (Google): the assistant integrates agent capabilities connected to Gmail, Calendar, Drive, and Chrome.

For experts: read the conditions before the demo

• Legal basis and transfers. An agent reading your emails also processes your correspondents' data. In Europe, this requires a legal basis, information, and for an American service, a valid transfer mechanism.
• Health data. Plugging a health application brings in sensitive data within the meaning of Article 9 of GDPR. In enterprise, it's excluded without impact assessment.
• Commercial incentive. An agent paid per transaction isn't neutral in its purchase recommendations. Check whom it favours.
• Professional use. These services are designed for individuals. Their use on enterprise data falls under shadow AI until an enterprise offering with contract, DPA, and logging has been validated.

7. Special case: code agents

Code agents are today the most used and most accomplished agents, because code offers what's lacking elsewhere: a verifiable result. Tests pass or fail, and the agent can correct alone.

They span families. Claude Code, Codex (OpenAI), or Gemini CLI run on your machine, in your terminal or editor, like a self-hosted assistant; they also exist in cloud version working on a repository copy. Cursor and VS Code or JetBrains extensions integrate them into the editor. OpenCode and Goose are open-source alternatives accepting any model.

• For beginners: if you want to understand agents through practice, start here. Ask a code agent to write a small script, watch it read files, run tests, make mistakes, and correct. You'll see the loop from section 1 live.
• For experts: these tools are also general-purpose agent platforms. The same building blocks (instruction files like CLAUDE.md or AGENTS.md, skills, sub-agents, MCP servers, hooks) serve to automate monitoring, writing, or system administration. The Claude Agent SDK from section 3 is Claude Code's engine made available to developers.

The hardening rules from section 5 apply: a code agent has terminal access. Restrictive permission mode by default, list of authorised commands, and never "accept all" mode on a machine containing production secrets.

8. The comparison: where it runs, who sees what, who decides

This table indicates, for each agent, where your data goes and who keeps control, without establishing a ranking. For a framework, columns describe the most common deployment; everything then depends on your choices.

How to read this table

• "Where it runs" and "your data goes to" are two different columns. An assistant installed on your server still sends every request to the API provider if you're not using a local model. Sovereignty plays out on inference as much as on hosting.
• The higher the autonomy, the narrower the access should be. An agent running at night with your emails and a terminal is a privileged account, to be treated as such.
• The required level is what's needed to use it securely. OpenClaw installs with one command; securing it requires an administrator.

9. Security and governance

An agent behaves like a service account that decides by reading texts of variable origin, and most risks come from there.

For beginners: the three-ingredient rule

An agent becomes dangerous when it combines three things at once: access to your private data, reading external content (web pages, received emails, documents), and a means to send something outward (email, web request, publication). With all three, a simple compromised page can order it to send your data elsewhere, and it risks obeying.

Threats specific to agents

For experts: the governance foundation

1. Inventory. Each agent has a sheet: owner, purpose, model, tools, accessible data, autonomy level. An agent absent from inventory falls under shadow AI.
2. Identity and least privilege. One account or identity per agent, never a human's. Short tokens, reduced scope, automatically renewed.
3. Complete logging. Every model call and every tool call are traced with their parameters. Without traces, no investigation after incident and no proof of compliance.
4. Graduated human validation. Free reading, monitored reversible writing, validated irreversible action. The threshold is set per tool, not per agent.
5. Adversarial testing. Before production, try to trick the agent with injections in documents it will read. Repeat at every new tool.
6. Cut-off plan. A means to revoke all an agent's access in one action.

GDPR and AI Act

• GDPR. An agent processing personal data is a processing like any other: registry, legal basis, minimisation, retention period of its memory, subprocessors (runtime host, model provider, each with its DPA). An agent reading emails or health data in practice justifies an impact assessment (DPIA).
• AI Act. The regulation classifies uses, whatever technology employed. An internal monitoring agent falls under minimal risk; the same engine used to sort candidates or assess creditworthiness becomes a high-risk system. The company deploying the agent is "deployer", and "provider" if it puts it on the market under its name. Transparency obligations (inform that one exchanges with AI) apply to agents dialoguing with the public. The "Digital Omnibus" on AI, published in the Official Journal on 24 July 2026, postponed high-risk system obligations to 2 December 2027 for those of Annex III (recruitment, credit, education…) and to 2 August 2028 for AI integrated into regulated products. Transparency obligations and those of general-purpose models are not postponed.

10. The real costs of an agent

An agent costs much more than a chatbot for the same question, because at each loop turn it resends to the model everything it has already read. Cost therefore increases faster than the number of steps.

For beginners

Imagine you pay a translator per word read. The chatbot reads your question once. The agent re-reads the entire conversation, search results, and open files at each new action. After ten actions, it has re-read ten times a growing file.

The calculation

For a task of n turns, total cost is the sum, turn by turn, of sent tokens multiplied by input price and received tokens multiplied by output price.

Numerical example in tokens, without price: a 10-turn task whose context goes from 5,000 to 50,000 tokens (5,000 more per turn, 27,500 on average) sends approximately 275,000 input tokens in total. The same question asked to a chatbot sends 5,000. The ratio is 55 to 1, before even counting outputs. Then multiply by the chosen model's price; nAIvigate's Cost Engine does this calculation model by model.

Other line items

• The runtime. Compute time, sessions, long memory, code sandbox, and browser are often billed separately in managed runtimes.
• Hosting. For a self-hosted assistant, a modest VPS suffices if the model is called by API; running the model locally requires a GPU or lots of unified memory (see Hardware Match).
• Humans. Re-reading, validating, correcting, and maintaining skills and tools. It's often the first real line item in enterprise.

For experts: seven levers

1. Prompt cache on the stable part of context (instructions, tool descriptions), billed at reduced price by most providers.
2. Routing by difficulty: local or economical model for extraction and classification, premium model only for difficult reasoning or after failure, via a gateway like LiteLLM.
3. Sub-agents with own context returning only a summary to the orchestrator.
4. Compacting history beyond a threshold.
5. Bounded tool outputs: a search returning 50 complete pages costs 50 times more than a search returning 5 extracts.
6. Ceilings: maximum number of turns, budget per task and per day, alert on overrun.
7. Measure at cost per successful task. A model twice as expensive succeeding in three turns instead of ten costs less.

11. How to choose according to your profile

Three questions guide towards the right family: will you code, must your data stay at your location, and do you have a team to operate a cloud?

• Curious individual. Start with a personal agent on tasks without stakes (organise a trip, sort ideas), without connecting your bank or health accounts. To understand the workings, a code agent on a small project remains the best school.
• Technical individual. An autonomous assistant on a mini-PC or dedicated VPS, with local model for sensitive and API for the rest. Apply the seven hardening rules from section 5 before plugging any messaging.
• Developer. Choose the framework according to your cloud and your need for control: Strands or OpenAI Agents SDK to move fast, LangGraph for a controlled path and recovery after failure, Claude Agent SDK if work focuses on files and code.
• SME without AI team. Enterprise offerings of personal agents or a code assistant, with contract and DPA, rather than an autonomous assistant installed by an employee. Explicitly forbid use of consumer versions on customer data.
• IT management or CISO. Open-source framework and managed runtime in a European region for business cases, mandatory inventory, identity per agent, logging, and routing rule keeping sensitive data on a model hosted in Europe or internally. Evaluate each model with the Trust Index before authorising it.

Frequently asked questions

Does an AI agent replace a chatbot? To answer a question, a chatbot suffices and costs much less. The agent is justified when the task requires acting in multiple tools or verifying its own work.

Do you need to know how to code to use an agent? No for personal agents. A bit of system administration for autonomous assistants. Yes for frameworks and managed runtimes.

Does an agent installed on my server keep my data at my location? Only if the model also runs locally. Otherwise, each request goes to the API provider, with the context the agent sends.

Is Meta Muse usable in France? Not as of writing date: it's reserved for the United States and those over 18, with no announced opening date in Europe.

Can you let an agent run at night without supervision? Yes, provided its access is limited to reversible actions, it has a capped budget, and each action is logged. Everything irreversible awaits human validation.

Which framework to choose for beginners? The one matching your cloud and language. For a first try, Strands Agents or OpenAI Agents SDK enable a functional agent in a few lines; LangGraph demands more effort but offers more control.

To go further

The nAIvigate Trust Index documents, publisher by publisher, what each model provider does with data it receives: it's the direct complement to section 8 for choosing the model that will animate your agent. The Cost Engine calculates an agent's cost according to model and volume, and Hardware Match indicates which local model fits on your machine. In the Tools Finder, the "Autonomous assistants" section details Hermes Agent and OpenClaw.

If you need to frame agents in your organisation (inventory, usage policy, choice of models and hosting), it's the type of assessment an AI Radar produces.

Sources

• Mejri Issam, "Build and deploy an autonomous AI agent on AWS with Strands Agents SDK and Bedrock AgentCore", GNU/Linux Magazine France, "AI Agents" dossier.
• Strands Agents, official repository
• Amazon Bedrock AgentCore, service presentation and supported regions
• Vertex AI Agent Builder, release notes and Memory Bank
• Microsoft Agent Framework 1.0, official announcement
• Claude Agent SDK, overview
• Hermes Agent, Nous Research repository
• Bitdefender, OpenClaw exploitation in enterprise, Conscia, the OpenClaw security crisis and Unit 42, skills supply chain
• TechCrunch, Meta Muse launch and Connect announcements, Axios
• Reuters via The News, ChatGPT Work launch
• Software Improvement Group, AI Act and Digital Omnibus synthesis