Open criteria · Open evidence · Open to dispute

Is your agent
working for you?

AI agents are one of the most consequential technologies we have ever built. They will know us better than any system before them, and they will act on our behalf as extensions of ourselves rather than tools. We think it is essential to know whether an agent serves the person using it or someone else's interests, so we built a benchmark to test it.

See the leaderboard Read the criteria

What we check

Six criteria, 26 tests

A sovereign agent closes the whole ring.

An agent is certified only when every test passes. Each test is scored pass, partial, fail or unverified, with the evidence published. Read the criteria

Public preview: we want your feedback

Tell us if a test, finding or agent is wrong or missing. Re-run a score and show us where it disagrees.

Criteria feedback Flag a result Re-run a score

Leaderboard

Sovereignty Scores

Preliminary desk assessments of 49 agents against all 26 tests. Last updated 30 Sept 2026.

Coding agents Personal agents Full leaderboard →

Open source Proprietary / hostedSovereignty Score, 0–100. A ranking aid; it never certifies.† Maintainer's own agent: built by the person who runs AOH and designed around these criteria.

49: agents assessed
26: tests per agent
1807: sources cited
0: certified so far

Breakdown

Scores by criterion

Share of tests passed per criterion. Partial results count half, and unverified claims count zero until demonstrated.

	P Portable	T Transparent	A Auditable	V Verifiable	M Modifiable	C Controllable
ADF^†	80	100	17	67	70	67
Aider	80	75	67	33	70	58
Pi	90	75	17	50	80	58
ZeroClaw	90	75	17	67	70	50
OpenClaw	80	63	17	50	70	58
Open WebUI	80	88	17	17	80	50
OpenCode	80	50	0	33	90	58
nanobot	70	75	17	50	60	33
goose	70	88	0	33	80	33
OpenHands	70	38	33	33	80	25
AnythingLLM	50	63	17	33	70	42
DeepSeek Harness	60	38	33	33	60	25
Open Interpreter	80	38	17	17	70	25
Hermes Agent	70	38	0	50	60	25
OpenAI Codex	70	38	17	33	60	25
Gemini CLI	50	50	0	33	60	42
Cline	70	38	17	17	60	25
GitHub Copilot	50	38	17	17	70	33
Claude Code	30	38	17	17	80	33
LobeHub	30	38	17	33	40	33
Cursor	20	25	17	17	50	33
Microsoft Copilot Cowork	10	25	17	17	40	33
AutoGPT Platform	30	13	17	33	20	25
ChatGPT	10	25	17	17	30	25
Devin	0	13	17	17	40	33
Letta	10	13	0	17	50	25
Grok	0	13	17	17	40	25
Lovable	0	13	17	17	40	25
Mistral Vibe	10	13	17	17	30	25
Gemini	10	25	17	0	40	17
Meta Muse	0	25	17	17	30	17
ChatGPT Atlas	0	13	17	0	40	25
Doubao	0	13	17	0	40	25
Manus	0	13	17	0	40	25
Replit Agent	0	13	0	17	30	33
Claude Cowork	0	25	0	0	40	25
Grok Bot	0	13	17	0	30	25
Alexa+	0	0	17	0	40	25
Gemini Spark	10	13	17	0	30	8
Perplexity Comet	0	13	0	0	30	25
Claude	0	13	17	0	30	8
Microsoft Copilot	0	13	17	0	10	25
Genspark	0	13	0	0	20	25
Meta AI	0	13	0	17	20	8
Siri	0	13	0	0	20	25
OpenAI Dots	0	0	0	0	30	25
DeepSeek	0	13	17	0	10	8
Google CC	0	13	0	0	0	25
Instinct	0	0	0	0	10	8

The standard · v1.0

The six criteria

The criteria are individually necessary and jointly sufficient. There is no partial certification: an agent must meet all six to be certified.

Every test, explained →

01 · 5 tests

Portable

Can you leave, take the whole agent with you, and keep it alive?

The owner can take the complete agent at any time, including after the provider ends the relationship, and keep operating it with full capability on infrastructure of their choosing, without the provider's servers, permission or continued existence.

02 · 4 tests

Transparent

Can you see everything the agent is, and everything shaping it?

The owner can see the agent's complete state and logic, every instruction and setting in effect, everything the provider holds about them, and every outside influence on the agent's choices, without the provider's permission and in a form usable outside the provider's software.

03 · 3 tests

Auditable

Can you reconstruct exactly what the agent did, and trust the record?

Every consequential action leaves a durable record that the owner can check for tampering without the provider, and that the agent cannot rewrite.

04 · 3 tests

Verifiable

Can you prove what it runs, who it is, and what changed?

The owner, or a verifier the owner chooses, can confirm that the running software matches source the owner can obtain and maintain, that the agent's identity is the owner's, and what changed in the agent and who changed it, without trusting the provider.

05 · 5 tests

Modifiable

Can you change anything, and can only you change it?

The owner can change any part of the agent without the provider's permission, the owner's changes persist, and nobody else changes the agent without the owner's consent.

06 · 6 tests

Controllable

Is your word final?

Owner controls over whom the agent obeys and contacts, what it can reach and spend, what it may do unapproved, where the owner's data goes, its credentials and its lifecycle hold no matter what the model outputs or is prompted to do.

Process

How we assess

Step 1
Public criteria
Every test and its 'does not require' clause are published and versioned. Anyone can challenge them, and changes are logged.
Step 2
Evidence-backed assessment
Each of the 26 tests is scored with a written finding and cited sources: docs, terms, privacy policies and source code. Anyone can re-run any assessment with their own agent.
Step 3
Certification, then re-certification
Only hands-on AOH verification certifies, and only when every test passes. Major versions trigger re-certification.

Why this matters

An agent that can be ad-supported, remotely switched off, or quietly re-instructed isn't yours. We don't judge what an agent does. We check who it answers to.

About the project →

Is your agentworking for you?