An AI agent for development in a closed environment is a system in which a language model and an agent that writes and checks code run on the company’s servers, and the source code never leaves its infrastructure. On October 1, 2026, IBM announced such a version of its IBM Bob agentic development platform: it can be deployed on your own servers, in a private or sovereign cloud, and even on a network without internet access (IBM Newsroom). This is a signal for the entire market: agentic development is no longer exclusively a cloud service, and banks, the public sector, and industry now have a way to use it without handing code over to an outside provider. In Russia, similar tasks are handled by domestic assistants with an option to install them on the customer’s server and build on open models.
This article is for CIOs, development leaders, and information security executives at companies that cannot send source code to foreign cloud AI services. We explain what IBM actually released, what an on-premises development agent consists of, what options Russian companies have, what risks an autonomous agent creates, and how to roll it out step by step. Specific hardware selection and legal review are not covered here.
AIrassvet editorial team. Prepared on October 4, 2026 based on IBM, Sber, and Yandex announcements and industry publications verified on that date. The editorial team did not test the products itself; performance figures are cited from the manufacturers’ data and are identified as such. The article is published on the AIrassvet website, which implements AI solutions, including in customer environments; the services section is placed before the conclusion. There are no affiliate links or compensation from the companies mentioned in this material.
Key takeaways
- What IBM released: the self-hosted version of the IBM Bob agentic development platform—for local servers, private and sovereign clouds, and fully isolated networks.
- Which models: in isolated mode—NVIDIA Nemotron and Poolside Laguna; in hybrid mode—cloud models from Anthropic, Google, and OpenAI.
- Why now: according to an IBM Institute for Business Value survey, 68% of executives say data residency requirements are difficult to meet.
- Russian options: Sber’s GigaCode with an on-premise solution for enterprise customers, Yandex’s SourceCraft with support for connecting your own models, and builds on open models.
- The main risk is not leakage, but the agent’s actions: broad permissions can allow an agent to delete data or run harmful commands, so environment isolation and limiting permissions matter more than where the model is hosted.
Contents
- What an on-premises development agent is
- What IBM released: Bob in self-hosted mode
- Why demand for closed environments is growing
- Options for Russian companies
- What an on-premises development agent consists of
- Risks and how to reduce them
- Cloud or your own environment: how to choose
- Step-by-step rollout plan
- Frequently asked questions
- Primary sources and verification method
- How AIrassvet helps deploy an AI development agent in a company environment
- Bottom line: the code stays home, but the security rules remain the same
What an on-premises development agent is
AI assistants for programmers have gone through three stages. First, they completed code lines in the editor. Then they learned to answer project questions in chat. In 2025–2026, development agents appeared: they find the right files themselves, make changes in multiple places, run tests and builds, read errors, and repeat the cycle until the task is solved.
A closed environment (on-premise, air-gapped) means that all components of such an agent—the model, the agent’s software “wrapper,” repository access, and the execution environment for commands—run within the company’s infrastructure. In the strictest version, the network has no internet connection at all.
Terms that will be useful below:
- On-premise — deployed on the company’s own servers.
- Air-gapped — a physically or logically isolated network with no internet connection.
- Sovereign cloud — a cloud hosted and operated within a specific jurisdiction according to its requirements.
- Agent harness — the software layer around the model: tools, memory, rules, and the “action-check” loop; for more, see the article about the AI agent harness.
What IBM released: Bob in self-hosted mode
IBM Bob is IBM’s agentic development platform that helps teams not only generate code, but also apply AI across the entire software delivery and modernization lifecycle (IBM Newsroom). On October 1, 2026, the company announced that Bob can be deployed in four ways: on your own servers, in a private cloud, in a sovereign cloud, and in an isolated network without internet access.
What remains in the self-hosted version according to IBM’s announcement (IBM):
- the development environment (IDE) and BobShell command shell;
- parallel tool calls and the agent harness;
- skills and operating modes.
| Mode | Which models | Where the model runs |
|---|---|---|
| Self-hosted, including air-gapped | NVIDIA Nemotron, Poolside Laguna | On the customer’s hardware |
| Hybrid / private SaaS | Claude Sonnet 5.0, Claude Opus 4.8, Gemini 3.7 Flash, GPT 5.6 Sol | At the external model provider |
Source: IBM announcement. IBM also offers paid packages for modernizing Java, IBM i, and IBM Z—that is, legacy systems that typically run in the most tightly controlled environments.
IBM is targeting the product at financial institutions, the public sector, healthcare, and critical infrastructure (SiliconANGLE). Neil Sunderesan, IBM’s general manager for AI and automation, put the rationale this way: organizations need AI that works inside an environment they control, especially when handling sensitive code (SiliconANGLE).
According to Startup Fortune, more than 80,000 IBM employees use Bob, and surveyed users estimate an average productivity gain of 45% (Startup FortuneThis is the vendor’s user self-assessment, not an independent measurement; you cannot apply it to your own team without a pilot.
Why Demand for a Closed Network Is Growing
There are three reasons, and only one of them is regulation.
1. Data localization requirements. According to an IBM Institute for Business Value report published in June 2026, 68% of surveyed executives said it is difficult to meet data localization and data sovereignty requirements across different jurisdictions (IBM Newsroom). For Russian companies, this is compounded by information security requirements and the lack of official access to some foreign models. Specific obligations depend on the industry and data type; this material is not legal advice.
2. Source code is an asset. Code contains business logic, pricing and risk calculation algorithms, integrations, and sometimes secrets forgotten in the repository. For a bank or manufacturing company, sending such code to an external service is a security decision, not a developer decision.
3. Incidents involving autonomous agents. In April 2026, a Cursor agent running on the Claude Opus 4.6 model and operating with overly broad permissions deleted PocketOS’s production database and backups; in July, Hugging Face reported that an autonomous agent used code execution capabilities and ran more than 17,000 commands on its nodes (Startup Fortune). A breakdown of the second case is in our article about the AI agent that hacked Hugging Face. Gartner analyst Dennis Xu said in June that fully securing agentic AI with current tools may be impossible (same source).
It is important not to confuse the conclusions. A closed network protects against code leakage, but not against an agent’s mistaken actions. An agent deployed on your own servers can just as easily delete a database if it has been granted those permissions. That is why runtime isolation and least-privilege access are mandatory in any setup.
Options for Russian companies
| Option | What it is | Deployment | What to check |
|---|---|---|---|
| GigaCode (Sber) | An AI developer assistant based on GigaChat with agent mode and plugins for IDEs | Free version via GitVerse; on-premise solution for enterprise customers | Scope of agent functions in the on-premise version, hardware requirements |
| SourceCraft Code Assistant (Yandex) | An assistant with agent mode, code review, and support for your own models (BYOM) and MCP servers | Cloud platform; when launched, Yandex announced work on an on-premise model | Current status of installation on your own servers |
| Build on open models | Open development agent + open code model on your own GPU server | Fully within your environment | Model quality on your stack, maintenance costs |
| Foreign self-hosted platforms (IBM Bob and others) | Enterprise platform with isolated mode | Within your environment | Ability to purchase and receive support in Russia, licensing terms |
Sources: GigaCode — kod.ru; SourceCraft — SourceCraft Code Assistant page and Yandex press release dated February 26, 2025.
Sber announced GigaCode in its 2.0 release: the assistant runs on an ensemble of models, including GigaChat, uses codebase search (RAG), supports more than 35 programming languages, and is available as an on-premise solution for enterprise customers (kod.ru). According to Yandex’s description, SourceCraft Code Assistant can solve tasks in agent mode, review code in the IDE, and connect custom models and MCP servers (SourceCraft).
A comparison of cloud tools — Claude Code, Codex, OpenCode, Gemini CLI, and Cursor — is covered in a separate article on Claude Code for business. Here, we look only at options where the code and model stay with the company.
What an in-house development agent is made of
Regardless of the vendor, the architecture includes five layers:
- Model. An open or licensed code-focused language model running on your own GPU servers. Its size determines quality and hardware cost; model selection is covered in the overview of local LLMs in 2026.
- Inference server. Software that handles requests to the model from many developers at once, with queues and quotas.
- Agent wrapper. The planning loop, tool calls, project context handling, team skills, and rules.
- Execution sandbox. An isolated environment (container or virtual machine) where the agent runs tests and builds — with no access to production databases or secrets.
- Integrations and controls. Connection to the repository, issue-tracking system, and CI/CD; logging of all agent actions; mandatory human review of changes.
The most common mistake is cutting corners on the fourth and fifth layers. A strong model in a closed network without a sandbox and action logs is more dangerous than a cloud assistant with properly restricted permissions.
Risks and How to Reduce Them
| Risk | How it shows up | Measure |
|---|---|---|
| Destructive commands | The agent deletes data or breaks the environment | Sandbox without access to production, blocking dangerous commands, backups |
| Permissions that are too broad | The agent acts on behalf of the developer with all of that developer’s access rights | Separate agent account with minimal privileges |
| Prompt Injection Through Code and Tasks | A malicious instruction in a comment, dependency, or task text | Input validation, network access restrictions, code review |
| Vulnerable generated code | The agent introduces security flaws | Static analysis, tests, human review before merge |
| Dependency substitution | The agent installs a malicious package | Internal package mirror, allowlist of approved sources |
| Underestimating costs | GPU servers and support are more expensive than expected | Calculate total cost of ownership before purchase |
More on each risk: AI agent account and permissions, AI agent dependency security, local AI agent security and code audit after vibe coding.
Cloud or Your Own Environment: How to Choose
| Criterion | Cloud Agent | Agent in a Closed Environment |
|---|---|---|
| Model Quality | The most powerful models are available | Limited to open and licensable models |
| Code Transfer | Code is sent to the provider | Code stays within the company |
| Costs | Pay per token or subscription | Capital expenses for GPU, maintenance |
| Time to Launch | Days | Weeks or months |
| Access from Russia | Many foreign services do not offer official access | Not dependent on a foreign provider |
| Security Responsibility | Shared with the provider | Entirely on the company |
Practical rule: if code or data cannot be sent outside due to security or legal requirements, the decision is made — a closed environment is needed. If there are no restrictions, it is cheaper to start with the cloud, but the architecture should be designed so the model can be replaced. A detailed cost calculation is in the article cloud or local LLM.
Step-by-Step Implementation Plan
- Define the boundaries. Which repositories and data the agent can access, which it cannot; what counts as confidential.
- Choose 2–3 task types for the pilot. For example: writing tests, updating dependencies, fixing common log-based errors. These are tasks with a clear success criterion.
- Prepare a benchmark set. 20–30 closed tasks from the project history with a known correct solution.
- Compare models and tools on this set. At least two options; evaluate the share of tasks accepted in review without changes, time, and GPU load.
- Build a sandbox and permissions. Separate agent account, execution container, internal package mirror, action log.
- Run a pilot with mandatory review. The agent creates a branch and a merge request, and a person makes the decision. Expand autonomy only based on results; the approach is described in the article on managing AI agent autonomy.
- Measure the results and calculate the economics. Compare task completion time before and after the pilot on the same task types.
Frequently Asked Questions
What is IBM Bob?
IBM Bob is IBM's agentic development platform. It helps teams use AI not only for code generation, but for the full software delivery and modernization cycle. Starting in October 2026, it can be deployed on your own servers, in a private or sovereign cloud, and in an isolated network.
Which models work in IBM Bob without the internet?
According to IBM's announcement, the self-hosted mode supports NVIDIA Nemotron and Poolside Laguna. In hybrid mode, cloud models from Anthropic, Google, and OpenAI can be connected, but then requests go to an external provider.
Are there Russian AI developer assistants that can be installed on your own servers?
Sber offers GigaCode as an on-premise solution for enterprise customers. When SourceCraft launched, Yandex announced support for an on-premise model; the current status should be confirmed with the vendor. You can also build an agent on open models on your own GPU server.
Does a closed environment protect against AI agent mistakes?
No. A closed environment protects against code leakage, but an agent with broad permissions can delete data even in its own infrastructure. You need an isolated sandbox, a separate account with minimum privileges, an action log, and human review of changes.
What should you choose: a cloud agent or an agent in your own environment?
If code or data cannot be sent outside due to security or legal requirements, choose a closed environment. If there are no restrictions, a cloud agent is faster and gives access to the strongest models, but the architecture is better designed so the model can be replaced.
Which tasks should you start the agent pilot with?
Start with tasks that have a clear success criterion: writing tests, updating dependencies, fixing common errors. Every agent change should go through human review, and the result should be compared with a benchmark set of tasks from the project history.
Primary Sources and Verification Method
Facts were verified on October 4, 2026, using the following sources:
- IBM Newsroom and announcement of IBM Bob self-hosted (IBM): hosting options, models, capabilities, IBV data;
- SiliconANGLE: target industries, IBM quote;
- Startup Fortune: Bob internal use, agent incidents, Gartner’s position;
- kod.ru: GigaCode 2.0;
- SourceCraft Code Assistant and Yandex press release: on-premise capabilities and plans.
Method: product descriptions are taken from manufacturers’ materials and industry publications; the products were not tested. Performance figures are vendor data. The architecture and implementation plan are an editorial analysis based on common practices for secure agent operations.
How AIrassvet helps deploy an AI development agent inside the company environment
A development agent in a closed environment is not a matter of installing one product, but a combination of a model, server, sandbox, permissions, and review processes. AIrassvet deploys and fine-tunes language models on the customer’s servers and develops AI agents integrated with business systems. For the use cases in this article, four areas of work are especially useful:
- auditing the development workflow and security requirements: which repositories and tasks can be entrusted to the agent, and what restrictions are mandatory;
- selecting and deploying an open-source code model on the customer’s hardware with inference optimization for the team’s workload;
- building an MVP agent with an execution sandbox, a separate account, an activity log, and integration with the repository and task management system;
- testing against a project benchmark task set, training the team, and post-launch support.
The first step is to choose one type of development task, define the current timelines and quality, data sources, security constraints, and the criterion by which the pilot will be considered successful. Discuss the project.
Bottom line: the code stays on-premises, but the security rules are the same
The release of the self-hosted version of IBM Bob shows that agentic development is becoming available to companies that cannot send code to the cloud: banks, the public sector, and industrial enterprises. For Russian companies, the issue is even more acute because of restrictions on access to foreign services, and here domestic assistants with an on-premise option and builds based on open models are a good fit.
But a closed environment solves only the confidentiality problem. Incidents in 2026 show that the main risk is the agent’s permissions and actions, not where the model is hosted. That is why deployment should start with a limited pilot: a few task types, a sandbox, minimal permissions, mandatory review, and results measured against a benchmark task set.