Does self-hosting keep an AI coding agent away from sensitive source code?
IBM has made a customer-managed version of its Bob development agent generally available, including supported air-gapped deployments. Local inference can keep code inside an approved environment, but the announcement does not prove that every integration, model or generated change is secure.
Editorial responsibility: The Impact of AI Editorial Desk · Report a factual concern
Research topic
What self-hosting changes—and does not change—when an AI development agent can inspect and modify sensitive enterprise software
At a glance
- 1IBM says the self-hosted Bob deployment is generally available for customer-managed, hybrid and supported air-gapped environments.
- 2With a supported local-model configuration, code, development context and build artefacts can remain inside the customer's managed environment; hybrid configurations can still send inference to an external service.
- 3IBM publishes no customer denominator, independent security test, measured developer outcome, vulnerability rate or audit of generated changes, so the evidence establishes product availability rather than safety or effectiveness.
Living evidence record
Impact record IAI-17OI7GU
Evidence stage
Announced
Confidence
Supported
Reporting basis
Source analysis
Independent support
Not yet
Record status
Monitoring
Last checked
1 October 2026
Source trail
2 direct sources across 1 source type.
People impact
Documented in this record.
Uncertainty
Limits and next checks are explicit.
Stages describe the evidence available—not whether a technology is good or bad. See the public method.
Related-source reporting disclosure
This record analyses 2 linked source records around the same underlying development. The extra records add method, date or context, but they do not by themselves constitute independent replication of every performance claim or predicted outcome.
The new option changes where the agent can run
IBM announced general availability of a self-hosted deployment option for its Bob software-development agent on 30 September and issued a wider newsroom release on 1 October. The timing should remain clear: the controlling product source is dated 30 September, while the press release is today's material update. IBM says customers can run Bob in on-premises, private-cloud, sovereign-cloud and supported air-gapped environments rather than moving sensitive code and application context into a public AI service.
The product is meant to help development teams understand an application, plan multi-step work, make changes and validate outcomes. IBM lists an integrated development environment, a shell, parallel tool use, an agent harness, skills and modes among the core capabilities. Optional packages add workflows and context for Java modernisation, IBM i and IBM Z. That breadth is consequential for banks, governments, healthcare providers and critical-infrastructure operators whose older systems contain valuable business logic and regulated data.[1][2]
Self-hosted and hybrid are not the same privacy claim
IBM says a supported self-hosted model can keep source code, development context and build artefacts inside the customer-managed environment. At general availability, it names NVIDIA Nemotron and Poolside Laguna as supported self-hosted models. It separately lists Claude Sonnet 5.0, Claude Opus 4.8, Gemini 3.7 Flash and OpenAI GPT-5.6 Sol for hybrid or private-software-as-a-service configurations. Customers provide access to a supported model and may use eligible existing model licences.
Those choices create different data paths. An air-gapped local model can reduce exposure to an external inference provider, but a hybrid connection may process code or context outside the immediate installation depending on configuration. Procurement teams should therefore map every boundary: model inference, telemetry, updates, package downloads, identity services, plug-ins, repositories and support access. A product being installed locally does not by itself prove that no data leaves the environment.[1]
Local control does not remove agent risk
Self-hosting can support residency, network-segmentation and access-control requirements, yet the agent still receives powerful context and tools. It can misunderstand a task, change the wrong component, reproduce an insecure pattern, follow malicious instructions embedded in a repository or invoke a tool with excessive authority. A compromised developer account or extension can also remain dangerous inside a private network. The security question therefore moves from 'where is the service?' to 'what can the agent read, change, execute and send, and who reviews each action?'.
A cautious rollout would begin with read-only analysis on a bounded repository. Teams can then compare the agent's plans and proposed patches with human decisions, scan dependencies and generated code, run tests in an isolated environment and require approval before merges or production access. Credentials should be short-lived and narrowly scoped. Logs should retain the instruction, retrieved context, tool calls, model and version, proposed change, reviewer decision and resulting build so an incident can be reconstructed.[1][2]
The announcement contains no performance or failure denominator
IBM's two publications establish availability and describe supported configurations, but they do not say how many customers or developers have used the self-hosted version, how many repositories were tested, how installation differs in a genuinely disconnected environment or how often generated changes passed independent review. There is no measured time saving, acceptance rate, defect rate, security-vulnerability rate, false-positive rate or comparison with cloud-hosted Bob and other development tools.
There is also no public independent penetration test or evaluation of prompt injection, data exfiltration, model substitution and software-supply-chain attacks for this release. IBM's ability to support mainframe and regulated environments may be commercially relevant, but a vendor's general-availability label is not evidence that a particular deployment satisfies an organisation's legal duties or threat model. Customers still need architecture review, contractual data terms, testing and continuous monitoring.[1][2]
What would change the assessment
Confidence would rise with reproducible deployment documentation for disconnected environments, a clear data-flow inventory, independent security testing and aggregate operational results. Useful denominators would include participating developers, repositories, tasks and proposed patches, separated by language and platform. Outcomes should report reviewer effort, accepted and rejected changes, escaped defects, security findings, rollbacks and incidents—not only code produced or tasks completed.
Confidence would fall if supposedly local configurations required undisclosed external services, if updates could not be verified offline, if audit records omitted tool actions or if customers reported material code leakage or unsafe autonomous changes. The development is important because it opens agentic software work to systems often excluded from public-cloud AI. The defensible conclusion is narrower than IBM's sovereignty framing: self-hosting can give an organisation more architectural control, but only configuration evidence and observed outcomes can show whether that control protects people, systems and sensitive code in practice.[1][2]
What this means for people
- Developers working on regulated or mission-critical systems may gain AI assistance without sending every repository to a public service, but they will still carry responsibility for review and safe release.
- Security and compliance teams need visibility into model, plug-in and tool data flows rather than relying on the single label 'self-hosted'.
- Customers and citizens can be affected if an agent introduces defects into banking, healthcare, government or infrastructure software, making human approval and rollback capacity essential.
Global context
Data-residency, public-sector procurement and critical-infrastructure rules differ by country, while many organisations operate software and support teams across borders. Self-hosting may make deployment feasible in some jurisdictions, but it does not create one universal compliance outcome. Comparisons should examine the actual data path, model licence, operational controls, independent assurance and total review cost for each configuration.
What the evidence does not yet show
- Both public sources are IBM publications; there is no independent customer, auditor or regulator evaluation of the self-hosted release.
- No customer, developer, repository, task, patch, defect, vulnerability or incident denominator is disclosed.
- The 1 October newsroom release follows a product page dated 30 September; this article preserves both dates rather than presenting the underlying availability as first published today.
- Support varies by model, infrastructure, licence and optional package, and future multi-model routing is described as a plan rather than a committed feature.
What to watch next
- Independent tests of data exfiltration, prompt injection, tool permissions and software-supply-chain risk in self-hosted deployments.
- Public data-flow and telemetry documentation for local, air-gapped and hybrid configurations.
- Measured developer time, review burden, defect rates, security findings and rollback rates across supported platforms.
- Evidence from regulated customers showing which residency and assurance requirements the product can satisfy.
Evidence trail
Sources used for this report
Links checked 1 October 2026
This report is labelled source analysis. We summarise and analyse source material in our own words; company statements remain attributed claims until independently supported. Translated summaries preserve the meaning of the original source and link back to it. Read our editorial standards.
Continue the story
Related reporting
Technology
What can OpenAI's always-on dots do—and when must they ask?
OpenAI's 29 September agent launch puts ongoing work and permission boundaries at the centre of its product pitch. The announcement establishes capabilities offered, not independently verified reliability.
4 min · 3 sources
Technology
Meta’s Muse gains downloads while Amazon challenges its shopping access
A third-party estimate puts the agent at 2.8 million downloads in its first 12 days. Amazon says the service was not authorised to access its store, raising questions about consent and credentials.
6 min · 2 sources
Technology
What does beating a Stratego champion prove about AI under hidden information?
Ataraxos won 15 of 20 games against one of Stratego's most decorated players and transferred its methods to three other games. The peer-reviewed Nature paper shows a real advance in efficient game strategy—not that the system can already run negotiations, markets or military decisions.
6 min · 3 sources
Reader discussion
Add evidence, experience or a question
No account is required. Reader notes are published after a brief civility, relevance and safety check; disagreement is welcome.
Published reader notes
0No published reader notes yet. You can start the evidence-led discussion above.
Prefer a private correction or response? Contact the newsroom.