The Register / Personal & desktop agents / DeerFlow

DeerFlow

Name: DeerFlow
Author: ByteDance (open source)

DeerFlow began in 2025 as a LangGraph-based deep-research framework. Version 2.0, a full rewrite released in February 2026, describes itself as a long-horizon 'super agent harness' with sub-agents, sandboxed execution, long-term memory, extensible skills, a web workspace and IM-channel gateways (Telegram, Slack, Feishu and others). It is MIT-licensed, self-hosted, and works with OpenAI-compatible, Claude, Gemini, DeepSeek and local vLLM/Ollama models. Version 2.1.0 shipped on 24 September 2026.

deerflow.tech Source repository Docs Add to compare

What reviewers and users praise

Runs long research tasks unattended with local models (HN user reports good results even with low context sizes)
Broad all-in-one feature set: sandbox, sub-agents, memory and skills in one package (Flowtivity review)

What they criticise

Setup and deployment friction: hardcoded Linux paths on Windows, IM-channel integration failures and UI bugs reported in GitHub issues
Security posture needs operator care: three CVEs in March-April 2026 (sandbox escape, stored XSS, path traversal); README strongly recommends trusted-network deployment
Memory reliability and production hardening flagged as open problems (DEV Community review)

Rating certificate · AW/26-09/11726 Sept 2026

70of 100

DeerFlow

ByteDance (open source) · Personal & desktop agents

ProvisionalTrust BOpen source

Adoption74

Experts67

Crowd—

Experts vs the crowdneeds both scores

Experts67

Crowd—

Price	Free
Use it via	Web app, API, MCP server, Chat apps
Runs on	macos, linux, windows
Licence	MIT
Updated	Evidence collected 26 Sept 2026

How the rating was worked out

Weights for Personal & desktop agents: adoption 30%, experts 35%, crowd 35%. Pillars without enough evidence are left out and the others re-weighted. The method.

Adoption & momentumweight 30%	74	GitHub stars `83k` → 88 · `1` releases in 90 days → 40 reach × 0.7 + momentum × 0.3
Expertsindependent reviews · weight 35%	67	3 independent reviews (2 positive · 1 mixed · 0 negative), averaged toward 50 for small samples.
Crowdcommunity sample · weight 35%	—	Only 4 community items sampled (6 needed)
Rating	70	Provisional: low confidence (2 of 3 pillars, 4 community posts).

Evidence checks. 3 items removed: date does not match the source (3). 3 GitHub issues not counted as sentiment. How evidence is checked.

Editorial adjustment. Incident-history re-grade under methodology revision 2 (see the trust section).

Trust & safety

Seven dimensions graded A–D from documented facts. Overall: B.

Permission model

Default config uses LocalSandboxProvider ('Executes commands directly on the host machine'; the config notes it 'is not a secure isolation boundary for shell access'). Host bash is disabled by default (allow_host_bash: false) but file read/write tools run without approval. Docker/Kubernetes sandboxes and pre-execution guardrails (allowlist/OAP/custom) exist but are opt-in. source

Data access scope

Agent works in virtual paths (/mnt/user-data) scoped per user and thread; additional host directories must be explicitly mounted, optionally read-only; a sandbox network allowlist mode is documented for the AIO sandbox. source

Data storage

Self-hosted; state, memory and artifacts are stored on the operator's deployment. README strongly recommends deployment in a local trusted network. source

n/e

Data retention & training

No vendor-hosted data store for the self-hosted product; retention and training depend on the model provider the operator configures. The data policy of the public deerflow.tech demo was not reviewed.

Incident history (24 months)

Three CVEs published March-April 2026: stored XSS in the artifacts API, a sandbox escape in bash-tool handling (LocalSandboxProvider), and a path traversal / arbitrary file write in custom-agent creation. Each was fixed by a commit and disclosed as a CVE. Regraded from D: Revision 2: serious issues that were each fixed and publicly disclosed grade C; D is kept for unresolved issues or slow or undisclosed fixes. source

Compliance

No SOC 2 / ISO 27001 attestation for the open-source project; it is self-hosted by the operator. source

Transparency

MIT-licensed source; GitHub releases with detailed notes and a CHANGELOG.md in the repository. source

The experts

3 named independent reviews found; dated reviews from the last 12 months are scored.

positive
DeerFlow's combination of sandboxed execution, multi-agent orchestration, persistent memory, and an extensible skill system makes it one of the most complete options available today.AJ Awan (Flowtivity) · 25 Apr 2026 · flowtivity.ai
mixed
Agent memory is still a difficult problem. Do not assume it will recall the right things at the right times without testing.ArshTechPro (DEV Community) · 24 Mar 2026 · dev.to
positive
DeerFlow 2.0, freshly open-sourced by ByteDance, is a superagent harness that turns complex goals into seamless executions.Brian Roemmele (X) · 6 Mar 2026 · x.com

The crowd

4 coded posts from hackernews, reddit.

1 positive2 mixed1 negative

positive
I've been running deer-flow ( https://github.com/bytedance/deer-flow ) for doing research and it's quite good even with low context sizes.Artificial Intelligence Policy (comment by cyanydeez) · 21 Aug 2026 · news.ycombinator.com
negative
I have not tried deerflow 2.0 but the community showcase is not particularly impressive to be honest. Single agent system can do just as good.Multi-Agent is a snake oil (comment by akrylov) · 26 May 2026 · news.ycombinator.com
mixed
Is this the future we're entering? Where we have to use agents to install agents?Deer-Flow Installing Line (comment by cnrd) · 30 Mar 2026 · news.ycombinator.com
mixed
another good option, but I was only able to run it in text mode (without webui)r/LocalLLaMA 'solution for local deep research' (u/jacek2023) · 15 Jan 2026 · reddit.com

Pricing

As published, checked 26 Sept 2026.

Plan	Price	Notes
Open source (self-hosted)	Free	MIT-licensed; model/API costs are paid separately to the chosen provider.

Recent changes

24 Sept 2026
v2.1.0: verifiable agent execution, durable batch delegation, pluggable memory backends, four new sandbox providers, extension system, enterprise authentication; 772 merged PRs since 2.0.0. source
25 Jun 2026
v2.0.0 stable release of the super-agent harness rewrite. source
1 Apr 2026
Sandbox-escape CVE-2026-34430 disclosed and fixed; host bash disabled by default for the local sandbox. source

Ranked alongside

Other ranked entries in Personal & desktop agents.

Compare with the top two

Hermes AgentNous Research69

OpenClawOpenClaw Foundation (created by Peter Steinberger)63

ZeroClawZeroClaw Labs61

Sources

Every figure above traces to one of these, observed up to 26 Sept 2026.